Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1465336
MD5:	a081cff1d93f1bcc478835dcb98e7c47
SHA1:	00e6cb7c41860aeb346958192c68eb86b4015fb2
SHA256:	c0db81c7d38819926df96d6fb3adda34fb8783acede83d5f9bc0b681f2287845
Infos:

Detection

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	34
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Modifies Internet Explorer zone settings

Modifies Internet Explorer zonemap settings

Overwrites Mozilla Firefox settings

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Yara detected Generic Downloader

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates or modifies windows services

Drops PE files

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Is looking for software installed on the system

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: IE Change Domain Zone

Stores files to the Windows start menu directory

Uses 32bit PE files

Classification

Process Tree

System is w7x64

Setup.exe (PID: 848 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: A081CFF1D93F1BCC478835DCB98E7C47)

WebCompanion-Installer.exe (PID: 2412 cmdline: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080 MD5: A27F9713DB1688D03D2082BFA1827803)

cmd.exe (PID: 1724 cmdline: "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone MD5: AD7B9C14083B52BC532FBA5948342B98)

netsh.exe (PID: 2496 cmdline: netsh http add urlacl url=http://+:9007/ user=Everyone MD5: 784A50A6A09C25F011C3143DDD68E729)

WebCompanion.exe (PID: 2596 cmdline: "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo= MD5: D5180525E08932A69DD1903AB30313EF)

WebCompanion.exe (PID: 1304 cmdline: "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize MD5: D5180525E08932A69DD1903AB30313EF)

WebCompanion.exe (PID: 204 cmdline: "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize MD5: D5180525E08932A69DD1903AB30313EF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, ProcessId: 2596, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion

Sigma detected: IE Change Domain Zone

Source: Registry Key set

Author: frack113: Data: Details: 2, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe, ProcessId: 2412, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\localhost\*

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 3, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe, ProcessId: 2412, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2301

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Setup.exe

ReversingLabs: Detection: 29%

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	EXE: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	Jump to behavior

Uses 32bit PE files

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{a056d2c3-adf7-4778-84b5-d927fc6847f2}

Jump to behavior

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Jump to behavior

PE / OLE file has a valid certificate

Source: Setup.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49251 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49254 version: TLS 1.2

Binary contains paths to debug symbols

Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.SysInfo\obj\Debug\Lavasoft.SysInfo.pdb source: WebCompanion.exe, 00000008.00000002.746264076.0000000005252000.00000020.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils.SqlLite\obj\x86\Debug\Lavasoft.Utils.SqlLite.pdb source: WebCompanion.exe, 00000008.00000002.742184545.0000000000752000.00000020.00000001.01000000.00000013.sdmp, Lavasoft.Utils.SqlLite.dll.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\FeatureMainComponent\obj\Debug\FeatureComponent.pdb source: WebCompanion.exe, 00000008.00000002.742359242.0000000000CF2000.00000020.00000001.01000000.00000016.sdmp, FeatureComponent.dll.2.dr
Source:	Binary string: C:\Users\michael.bilinsky\Downloads\managedesent-88b673\EsentInterop\obj\Debug\Esent.Interop.pdb source: Esent.Interop.dll.2.dr
Source:	Binary string: p\C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application/WebCompanion-Installer.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2008\Release\System.Data.SQLite.pdb source: WebCompanion.exe, 00000009.00000002.742241549.0000000000CEC000.00000020.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.CSharp.Utilities\obj\x86\Debug\Lavasoft.CSharp.Utilities.pdb source: Lavasoft.CSharp.Utilities.dll.2.dr
Source:	Binary string: p\C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Projects\WebCompanion\Common\SearchProtect.WinService\obj\Debug\Lavasoft.WCAssistant.WinService.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002915000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: eApplication/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023D1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils\obj\x86\Debug\Lavasoft.Utils.pdb source: WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Lavasoft.AppCore\obj\Release\Lavasoft.AppCore.pdbp source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: WebCompanion-Installer.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Events\obj\x86\Debug\Lavasoft.Events.pdb source: WebCompanion.exe, 00000008.00000002.742206694.0000000000B22000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.WcfService\obj\Debug\Lavasoft.WCAssistant.WcfService.pdbL source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002915000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb source: WebCompanion.exe, 00000008.00000002.747353038.00000000063A2000.00000020.00000001.01000000.0000001C.sdmp, Ionic.Zip.dll.2.dr
Source:	Binary string: Application/WebCompanion-Installer.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.2.dr
Source:	Binary string: CreateLavasoft.Utils.Features.PartnerInfoppCore.pdbpdbore.pdbo source: WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb$# source: WebCompanion.exe, 00000008.00000002.747353038.00000000063A2000.00000020.00000001.01000000.0000001C.sdmp, Ionic.Zip.dll.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils.SqlLite\obj\x86\Debug\Lavasoft.Utils.SqlLite.pdbl< source: WebCompanion.exe, 00000008.00000002.742184545.0000000000752000.00000020.00000001.01000000.00000013.sdmp, Lavasoft.Utils.SqlLite.dll.2.dr
Source:	Binary string: CreateLavasoft.Utils.Features.PartnerInfoppCore.pdbpdbore.pdb source: WebCompanion.exe, 00000008.00000002.746342130.00000000055F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2008\Release\System.Data.SQLite.pdbX. source: WebCompanion.exe, 00000009.00000002.742241549.0000000000CEC000.00000020.00000001.01000000.00000014.sdmp
Source:	Binary string: p&Application/WebCompanion-Installer.pdb@\ source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.WcfService\obj\Debug\Lavasoft.WCAssistant.WcfService.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002915000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Events\obj\x86\Debug\Lavasoft.Events.pdbX source: WebCompanion.exe, 00000008.00000002.742206694.0000000000B22000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.Service.Logger\obj\Debug\Lavasoft.WCAssistant.Service.Logger.pdbh- source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000281A000.00000004.00000800.00020000.00000000.sdmp, Lavasoft.WCAssistant.Service.Logger.dll.2.dr
Source:	Binary string: c:\dev\sqlite\dotnet\bin\2008\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb`: source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils\obj\x86\Debug\Lavasoft.Utils.pdb$ source: WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr
Source:	Binary string: &Application/WebCompanion-Installer.pdb source: WebCompanion.zip.2.dr
Source:	Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.745547016.0000000005589000.00000020.00000001.01000000.00000008.sdmp, WebCompanion.exe, 00000008.00000002.745271283.0000000004C72000.00000020.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\SourceCode\TFS\MozCompressor\Debug\MozCompressor.pdb source: WebCompanion.exe, 00000008.00000002.745149373.0000000004BF5000.00000002.00000001.01000000.00000018.sdmp, MozCompressor.dll.2.dr
Source:	Binary string: C:\Windows\TEMP\drone-ME4saUyIgSY9rSgY\drone\src\Common\VPNService\obj\x86\Debug\VPNServiceWCF.pdb source: VPNServiceWCF.dll.2.dr
Source:	Binary string: vcruntime140d.i386.pdb+++ source: WebCompanion.exe, 00000008.00000002.749384362.0000000062361000.00000020.00000001.01000000.00000019.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.Service.Logger\obj\Debug\Lavasoft.WCAssistant.Service.Logger.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000281A000.00000004.00000800.00020000.00000000.sdmp, Lavasoft.WCAssistant.Service.Logger.dll.2.dr
Source:	Binary string: ucrtbased.pdb source: WebCompanion.exe, 00000008.00000002.748533348.00000000621C1000.00000020.00000001.01000000.0000001A.sdmp
Source:	Binary string: vcruntime140d.i386.pdb source: WebCompanion.exe, 00000008.00000002.749384362.0000000062361000.00000020.00000001.01000000.00000019.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: Application/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023D1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.2.dr
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Lavasoft.AppCore\obj\Release\Lavasoft.AppCore.pdb source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanion-Installer.pdb source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp
Source:	Binary string: webcompanion-installer.pdb source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005899000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net35\WpfAnimatedGif.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000262D000.00000004.00000800.00020000.00000000.sdmp, WpfAnimatedGif.dll.2.dr
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net35\WpfAnimatedGif.pdbSHA256 source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000262D000.00000004.00000800.00020000.00000000.sdmp, WpfAnimatedGif.dll.2.dr
Source:	Binary string: c:\dev\sqlite\dotnet\bin\2008\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr

Spreading

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, type: DROPPED

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 470Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 421
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 531
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 669
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 538
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 505
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 538
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 511
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 550
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 489
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 550
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 481
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 543
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 483
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 543
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 498
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 543
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 514
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 508
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 541
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 536
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 514
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 545
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 510
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 508
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 546
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 514
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 484
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 541
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 508
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 546
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 509
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 542
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 492
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 503
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 544
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 502
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 502
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 466Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4686Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Launch&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 423
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=FirstRun&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 326
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FirstRun&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 326
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1801
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 7931Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1020
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ToggleButton&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 577
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 715
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 548
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 7931Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 963
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 565
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 551
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1020
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 542
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1369
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1355
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 545
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=UIOpen&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 342
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 623
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 497
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540
Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 485Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 621
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 540
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 4705Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 490
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Launch&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 428
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=CompleteInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 443
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=CompleteInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 399
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 550
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 515
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 479
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 1020
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402 HTTP/1.1Host: wc-partners.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_wb HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_ab HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_ac HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /version_logs?json=true&version=13.900.0.1080 HTTP/1.1Host: webcompanion.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 64.18.87.81 64.18.87.81
Source: Joe Sandbox View	IP Address: 104.18.27.149 104.18.27.149

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402 HTTP/1.1Host: wc-partners.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_wb HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_ab HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /Partner.svc/GetPartnerInfo?partner=IN240402_ac HTTP/1.1Host: wc-partners.lavasoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /version_logs?json=true&version=13.900.0.1080 HTTP/1.1Host: webcompanion.comConnection: Keep-Alive

Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp	String found in binary or memory: <td align="right" width="24"><a target="_blank" href="https://www.facebook.com/lavasoft.adaware"><img src="http://webcompanion.com/images/email/fb-icon.png" width="16" height="16" alt="fb" style="display:block;border:0;" /></a></td> equals www.facebook.com (Facebook)
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.comD0 equals www.youtube.com (Youtube)
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: geo.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: featureflags.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: flwadw.com
Source: global traffic	DNS traffic detected: DNS query: wcdownloadercdn.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: wc-partners.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: webcompanion.com
Source: global traffic	DNS traffic detected: DNS query: partners.webcompanion.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: sg-bitmask.adaware.com
Source: global traffic	DNS traffic detected: DNS query: geolocation.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: cdn.inspectlet.com

Source: unknown

HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive

Source: WebCompanion.exe, 00000009.00000002.751140953.000000000698A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ad-blocker-update-service.lav
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002614000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.763606524.000000000D959000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe.config.2.dr	String found in binary or memory: http://ad-blocker-update-service.lavasoft.com/update.asmx
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://aia.entrust.net/evcs2-chain.p7c01
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxD0
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.000000000539C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://crl.entrust.net/evcs2.crl0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://crl.entrust.net/g2ca.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.000000000539C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002679000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002679000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/d$
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.google.com/D0
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.google.com/D0
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002679000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002706000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000271F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002647000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026D3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026ED000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002787000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr, WebCompanion.resources.dll7.2.dr, WebCompanion.exe.2.dr	String found in binary or memory: http://em.lavasoft.com/subscribe/profile?f=21&id=
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002614000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.763606524.000000000D959000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe.config.2.dr	String found in binary or memory: http://feedback-service.lavasoft.com/feedback.asmx
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000282C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geo.lavasoft.com
Source: WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000282C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geo.lavasoft.com/
Source: WebCompanion.exe, 00000008.00000002.745271283.0000000004C72000.00000020.00000001.01000000.00000017.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://localhost:9008Fhttp://localhost:9008/webcompanion/4http://rt.webcompanion.com
Source: WebCompanion.exe, 00000009.00000002.741867833.0000000000292000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://ocsp.entrust.net00
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://ocsp.entrust.net01
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/ActiveFeatures.zip
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/Silverlight_x64.exe
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/aabrowser.zip
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pp.webcompanion.com/notifications/download/rt/chbrowser.exe
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/ActiveFeatures.zip
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/FeatureActions.zip
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/IEBhoHelper.exe
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/IEBhoHelperTest.exe
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/IESPHelper.exe
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/Silverlight_x64.exe
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/aabrowser.zip
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/adblocker.zip
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/chbrowser.exe
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/extension.txtuhttps://staging-feedback-service.
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/postrun/preprod/v1/FeatureActions.zip
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/postrun/prod/v1/FeatureActions.zipkhttp://pp.we
Source: WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/postrun/v1/searchengine_v1.zip
Source: WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/searchenginetemplate.xmlQhttps://appdownload.la
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/SearchProtect.WcfService(
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/SearchProtect.WcfServicef
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/VPNService.WCF.Model
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/VPNService.WCF.Model_
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000282C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000027C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000021C8000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://staging-cloudflow.lavasoft.net/v1/event-stat-wc
Source: WebCompanion.exe, 00000009.00000002.742241549.0000000000CEC000.00000020.00000001.01000000.00000014.sdmp	String found in binary or memory: http://system.data.sqlite.org/
Source: WebCompanion.exe, 00000008.00000002.742307382.0000000000C14000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://system.data.sqlite.org/X
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://tempuri.org/$
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/:WebHttpBinding4
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/A
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/AddT
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://tempuri.org/GetComponentsInfoByProductT
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/GetComponentsInfoT
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/GetComponentsVersionInfoT
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://tempuri.org/GetProductInfoT
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/GetNotify
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/GetNotifyResponse
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/GetParameters
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/GetParametersResponse
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/Rewards
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedService/RewardsResponse
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreen
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValues
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValuesResponse
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPN
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPNResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPNT
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetConnectionInfo
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetConnectionInfoResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetConnectionInfoT
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetLocations
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetLocationsResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/GetLocationsT
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/IsVPNConnected
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/IsVPNConnectedResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/IsVPNConnectedT
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/LoadConfig
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/LoadConfigResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/LoadConfigT
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/TurnOffVPN
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/TurnOffVPNResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IVPNServiceWCF/TurnOffVPNT
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/CopyFilesResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/CopyFilesT
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/CreatUninstallInfoResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/CreatUninstallInfoT
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentHomePageIEResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentHomePageIET
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentSearchIEResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/GetCurrentSearchIET
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/ProcessRemoteFeatureResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/ProcessRemoteFeatureT
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/RunProcessResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/RunProcessT
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/RunasAdminResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/RunasAdminT
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetAutoRestoreSessionIEResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetAutoRestoreSessionIET
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetHomePageIEResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetHomePageIET
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetNewTabIEResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetNewTabIET
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetSearchEngineIEResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SetSearchEngineIET
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SilentUninstallResponse
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/SilentUninstallT
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/UpdateUninstallInfoResponse=
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/IWCAssistantService/UpdateUninstallInfoT
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/SendEmailT
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/SendFeedbackT
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/SendWCFeedbackT
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://tempuri.org/SignZipInstallerByProductT
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/SignZipInstallerT
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/T
Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://tempuri.org/WcSendAutoResponseEmailT
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wc-partners.lavasoft.com
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_ab
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_ac
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_wb
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfoLR
Source: WebCompanion.exe, 00000009.00000002.751140953.000000000698A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wc-update-service.lavasoft.com/co
Source: Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002614000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.763606524.000000000D959000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr, WebCompanion.exe.config.2.dr	String found in binary or memory: http://wc-update-service.lavasoft.com/components.asmx
Source: Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002614000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.763606524.000000000D959000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr, WebCompanion.exe.config.2.dr	String found in binary or memory: http://wc-update-service.lavasoft.com/update.asmx
Source: WebCompanion-Installer.exe, 00000002.00000002.741957823.0000000000500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1
Source: Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip
Source: Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000298B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://webcompanion.com
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000282C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.000000000282C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://webcompanion.com/check
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp, Frequently Asked Questions.url.8.dr	String found in binary or memory: http://webcompanion.com/faq
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://webcompanion.com/google_chrome_incompatibility
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002679000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002706000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000271F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002647000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026D3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026ED000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002787000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr, WebCompanion.resources.dll7.2.dr, WebCompanion.exe.2.dr	String found in binary or memory: http://webcompanion.com/help
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr, WebCompanion.exe.2.dr	String found in binary or memory: http://webcompanion.com/images/email/hdr_main.png
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr, WebCompanion.exe.2.dr	String found in binary or memory: http://webcompanion.com/images/email/tw-icon.png
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr, WebCompanion.exe.2.dr	String found in binary or memory: http://webcompanion.com/images/email/wc-title-header.png
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr, WebCompanion.exe.2.dr	String found in binary or memory: http://webcompanion.com/mail-report-reply
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://webcompanion.com/notifications/includes/wl.phpthttp://webcompanion.com/version_logs?json=true
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://webcompanion.com/unsafe
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000298B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://webcompanion.com/version_logs?json=true&version=
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000298B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://webcompanion.com/version_logs?json=true&version=13.900.0.1080
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000262D000.00000004.00000800.00020000.00000000.sdmp, WpfAnimatedGif.dll.2.dr	String found in binary or memory: http://wpfanimatedgif.codeplex.com
Source: WebCompanion.exe, 00000009.00000002.741867833.0000000000292000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.apache.org/).
Source: WebCompanion.exe, 00000009.00000002.741867833.0000000000292000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: WebCompanion.exe, 00000009.00000002.741867833.0000000000292000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Ionic.Zip.dll.2.dr	String found in binary or memory: http://www.codeplex.com/DotNetZip
Source: WebCompanion.exe.2.dr	String found in binary or memory: http://www.codeproject.com/Articles/28093/Using-RoutedCommands-with-a-ViewModel-in-WPF
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://www.entrust.net/rpa0
Source: Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: WebCompanion.exe.2.dr	String found in binary or memory: http://www.gophish.com
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002679000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002706000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000271F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002647000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026D3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026ED000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000027A2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002787000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr, WebCompanion.resources.dll7.2.dr	String found in binary or memory: http://www.lavasoft.com
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002679000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002706000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000271F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002647000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026D3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026ED000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002787000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr, WebCompanion.resources.dll7.2.dr, WebCompanion.exe.2.dr	String found in binary or memory: http://www.lavasoft.com/mylavasoft/contact
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002679000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002706000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000271F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002647000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026D3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026ED000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002787000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr, WebCompanion.resources.dll7.2.dr, WebCompanion.exe.2.dr	String found in binary or memory: http://www.lavasoft.com/privacy_policy/
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002679000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002706000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000271F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002647000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026D3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026ED000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002787000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr, WebCompanion.resources.dll7.2.dr, WebCompanion.exe.2.dr	String found in binary or memory: http://www.lavasoftsupport.com/index.php?/forum/191-web-companion/
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000272B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.749913986.0000000069A7A000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	String found in binary or memory: http://www.sqlite.org/copyright.html4
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.webcompanion.com
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.comD0
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000021C4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287B000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.2.dr	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/blacklist
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/blacklist1http://geo.lavasoft.com/ihttps://acscdn.lavasoft.com/u
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/permanentwh
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000021C4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287B000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.2.dr	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/permanentwhitelist
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://acs.lavasoft.comZhttps://acs.lavasoft.com/api/v2/url/blacklistlhttps://acs.lavasoft.com/api/
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://acscdn.lavasoft.com/urlnotificationlist.json
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://acscdn.lavasoft.comhhttps://acscdn.lavasoft.com/urlnotificationlist.json0https://webcompanio
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: https://addons.mozilla.org/en-US/firefox/
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreD0
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxD0
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/D0
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?usp=chrome_appD0
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/D0
Source: WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/settingsD0
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr	String found in binary or memory: https://easylist-downloads.adblockplus.org/easylist.txtzhttps://easylist-downloads.adblockplus.org/e
Source: WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr	String found in binary or memory: https://easylist-downloads.adblockplus.org/easylistgermany.txt
Source: WebCompanion.exe, 00000008.00000002.742359242.0000000000CF2000.00000020.00000001.01000000.00000016.sdmp, FeatureComponent.dll.2.dr	String found in binary or memory: https://eventstaging.lavasoft.com/v1/event-stat
Source: WebCompanion.exe, 00000008.00000002.742206694.0000000000B22000.00000020.00000001.01000000.00000012.sdmp	String found in binary or memory: https://eventstaging.lavasoft.com/v1/event-statFhttps://flwadw.com/v1/event-stat-wclhttp://staging-c
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002848000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.000000000282C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002972000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WC
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002848000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC$https://flwadw.comFhttps://flwadw.com/v1/event-stat
Source: WebCompanion.exe, 00000009.00000002.742425946.000000000282C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC4
Source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: https://feedbackapi.adaware.com/api/feedback;http://webcompanion.com/check
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://flow.lavasoft.com/v1/event-stat/v1/event-stat
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002435000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002421000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000021C8000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002D2F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com
Source: FeatureComponent.dll.2.dr	String found in binary or memory: https://flwadw.com/v1/event-stat
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000021C8000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000002.742206694.0000000000B22000.00000020.00000001.01000000.00000012.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002435000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000281A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000027DA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000027A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1LR
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000298B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wcH
Source: WebCompanion.exe, 00000009.00000002.763606524.000000000D8F1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1LR
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002435000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000281A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002421000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000027DA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000027A2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002794000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1LR
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000021C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=Start&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000009.00000002.763606524.000000000D8F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=UIOpen&ProductID=wc&EventVersion=1
Source: WebCompanion.exe, 00000009.00000002.763606524.000000000D959000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=UIOpen&ProductID=wc&EventVersion=1LR
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://flwadw.com/v1/event-statJhttp://staging-cloudflow.lavasoft.netlhttp://staging-cloudflow.lava
Source: WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr	String found in binary or memory: https://indonesianadblockrules.googlecode.com/hg/subscriptions/abpindo.txtxhttps://easylist-download
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://partner-tracking.lavasoft.com/api/Tracking/Decrypt
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: https://partners.webcompanion.com/api/Partners/get-partner-by-id
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000021C4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr, WcInstaller.log.2.dr	String found in binary or memory: https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip
Source: WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr	String found in binary or memory: https://ruadlist.googlecode.com/hg/advblock.txt(AdBlockAcceptableAds
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://sandbox-featureflags-api.lavasoft.net/api/Update/WC
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox-featureflags-api.lavasoft.net/api/feature/WC
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/ff
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/yhs/search
Source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: https://sg-bitmask.adaware.com/bitmask/allmaskvalues
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: https://staging-bitmask.lavasoft.net/bitmask/allmaskvalues
Source: Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr	String found in binary or memory: https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000298B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: WebCompanion.exe, 00000009.00000002.741867833.0000000000292000.00000020.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000009.00000002.741887657.00000000002DC000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://svn.apache.org/repos/asf/logging/log4net/tags/1.2.13RC3
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr, WebCompanion.exe.2.dr	String found in binary or memory: https://twitter.com/lavasoft
Source: WebCompanion.exe, 00000008.00000002.747621560.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/search
Source: Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip
Source: Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe
Source: Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-internal.zip
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wcdownloadercdn.lavasoft.com
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217E000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.2.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe
Source: Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe
Source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217E000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.2.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip
Source: WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com/en/DJ
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://webcompanion.com/en/help.php
Source: WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://webcompanion.com/en/install.php?partner=
Source: WcInstaller.log.2.dr	String found in binary or memory: https://webcompanion.com/images/favicon.ico
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.adaware.com/privacy-policy
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.adaware.com/terms-of-use
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002A90000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000298B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com:443

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49227
Source: unknown	Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49217
Source: unknown	Network traffic detected: HTTP traffic on port 49233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 49262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49207
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49204
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 49187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49286
Source: unknown	Network traffic detected: HTTP traffic on port 49286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49276
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49273
Source: unknown	Network traffic detected: HTTP traffic on port 49247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49262
Source: unknown	Network traffic detected: HTTP traffic on port 49189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49254
Source: unknown	Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49250
Source: unknown	Network traffic detected: HTTP traffic on port 49249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49244
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49240
Source: unknown	Network traffic detected: HTTP traffic on port 49248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49238
Source: unknown	Network traffic detected: HTTP traffic on port 49243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49234
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49194
Source: unknown	Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49191
Source: unknown	Network traffic detected: HTTP traffic on port 49226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown	Network traffic detected: HTTP traffic on port 49229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49229
Source: unknown	Network traffic detected: HTTP traffic on port 49215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49228
Source: unknown	Network traffic detected: HTTP traffic on port 49232 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.22:49219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.26.149:443 -> 192.168.2.22:49246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.22:49251 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.22:49254 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Creates a window with clipboard capturing capabilities

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Users\user\Desktop\Setup.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 770B0000 page execute and read and write

Sample file is different than original file name gathered from version info

Source: Setup.exe, 00000000.00000002.741840276.000000000096D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe
Source: Setup.exe, 00000000.00000000.347117320.0000000000427000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe
Source: Setup.exe, 00000000.00000003.347718441.0000000000A50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.347718441.0000000000A50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dll8 vs Setup.exe
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll4 vs Setup.exe
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: get_OriginalFilename vs Setup.exe
Source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000002.741770183.0000000000611000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: get_OriginalFilename vs Setup.exe
Source: Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe

Uses 32bit PE files

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: ICSharpCode.SharpZipLib.dll.0.dr, InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.0.dr, DeflaterOutputStream.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.0.dr, ZipAESTransform.cs	Cryptographic APIs: 'TransformBlock'

Source: classification engine

Classification label: mal54.phis.troj.spyw.evad.winEXE@11/150@26/6

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Roaming\Lavasoft

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Mutant created: \Sessions\1\BaseNamedObjects\AdAwareWebCompanionuser

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002BB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='SearchNotificationDismissedAge'statistic.db;Version=3;igt-
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='FirefoxSearchRemoveDays'ptions\statistic.db;Version=3;igt-
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='FirefoxSearchUsedDays'\Options\statistic.db;Version=3;igt-
Source: WebCompanion.exe, 00000008.00000002.742500209.000000000298B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='InstallAge'b Companion\Options\statistic.db;Version=3;gn":"20541619131","wcyid":"WCYID10249","clidhp":21733
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002BC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM bwl_stats ORDER BY date DESC LIMIT 1t\Web Companion\Options\statistic.db;Version=3;Read Only=True;t-
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='ChromeSearchUsedDays'n\Options\statistic.db;Version=3;igt-
Source: WebCompanion.exe, 00000008.00000002.742500209.0000000002B8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT Value FROM DataCollector where key='ChromeSearchRemoveDays'Options\statistic.db;Version=3;igt-

Source: Setup.exe

ReversingLabs: Detection: 29%

Source: Setup.exe

String found in binary or memory: RunProgram="WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080"

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: d3d8thk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: shcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: odbc32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpqec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: qutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ws2help.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nci.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: napmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pcollab.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140d.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbased.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: liblz4.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140d.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbased.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: liblz4.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: pcwum.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: httpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: d3d9.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: d3d8thk.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: shcore.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: mscms.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: windowscodecsext.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: icm32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: atl.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: msdtcprx.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: mtxclu.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: clusapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: cryptdll.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: resutils.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ktmw32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: utildll.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: logoncli.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rpcrtremote.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: wbemcomn2.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: vcruntime140d.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ucrtbased.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: liblz4.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: credssp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: pcwum.dll
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Section loaded: httpapi.dll

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Registry value created: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{a056d2c3-adf7-4778-84b5-d927fc6847f2}

Jump to behavior

PE / OLE file has a valid certificate

Source: Setup.exe

Static PE information: certificate valid

Binary contains paths to debug symbols

Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.SysInfo\obj\Debug\Lavasoft.SysInfo.pdb source: WebCompanion.exe, 00000008.00000002.746264076.0000000005252000.00000020.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils.SqlLite\obj\x86\Debug\Lavasoft.Utils.SqlLite.pdb source: WebCompanion.exe, 00000008.00000002.742184545.0000000000752000.00000020.00000001.01000000.00000013.sdmp, Lavasoft.Utils.SqlLite.dll.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\FeatureMainComponent\obj\Debug\FeatureComponent.pdb source: WebCompanion.exe, 00000008.00000002.742359242.0000000000CF2000.00000020.00000001.01000000.00000016.sdmp, FeatureComponent.dll.2.dr
Source:	Binary string: C:\Users\michael.bilinsky\Downloads\managedesent-88b673\EsentInterop\obj\Debug\Esent.Interop.pdb source: Esent.Interop.dll.2.dr
Source:	Binary string: p\C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application/WebCompanion-Installer.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2008\Release\System.Data.SQLite.pdb source: WebCompanion.exe, 00000009.00000002.742241549.0000000000CEC000.00000020.00000001.01000000.00000014.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.CSharp.Utilities\obj\x86\Debug\Lavasoft.CSharp.Utilities.pdb source: Lavasoft.CSharp.Utilities.dll.2.dr
Source:	Binary string: p\C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Projects\WebCompanion\Common\SearchProtect.WinService\obj\Debug\Lavasoft.WCAssistant.WinService.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002915000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: eApplication/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023D1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils\obj\x86\Debug\Lavasoft.Utils.pdb source: WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Lavasoft.AppCore\obj\Release\Lavasoft.AppCore.pdbp source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: WebCompanion-Installer.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Events\obj\x86\Debug\Lavasoft.Events.pdb source: WebCompanion.exe, 00000008.00000002.742206694.0000000000B22000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.WcfService\obj\Debug\Lavasoft.WCAssistant.WcfService.pdbL source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002915000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb source: WebCompanion.exe, 00000008.00000002.747353038.00000000063A2000.00000020.00000001.01000000.0000001C.sdmp, Ionic.Zip.dll.2.dr
Source:	Binary string: Application/WebCompanion-Installer.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.2.dr
Source:	Binary string: CreateLavasoft.Utils.Features.PartnerInfoppCore.pdbpdbore.pdbo source: WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb$# source: WebCompanion.exe, 00000008.00000002.747353038.00000000063A2000.00000020.00000001.01000000.0000001C.sdmp, Ionic.Zip.dll.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils.SqlLite\obj\x86\Debug\Lavasoft.Utils.SqlLite.pdbl< source: WebCompanion.exe, 00000008.00000002.742184545.0000000000752000.00000020.00000001.01000000.00000013.sdmp, Lavasoft.Utils.SqlLite.dll.2.dr
Source:	Binary string: CreateLavasoft.Utils.Features.PartnerInfoppCore.pdbpdbore.pdb source: WebCompanion.exe, 00000008.00000002.746342130.00000000055F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2008\Release\System.Data.SQLite.pdbX. source: WebCompanion.exe, 00000009.00000002.742241549.0000000000CEC000.00000020.00000001.01000000.00000014.sdmp
Source:	Binary string: p&Application/WebCompanion-Installer.pdb@\ source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.WcfService\obj\Debug\Lavasoft.WCAssistant.WcfService.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002915000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Events\obj\x86\Debug\Lavasoft.Events.pdbX source: WebCompanion.exe, 00000008.00000002.742206694.0000000000B22000.00000020.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.Service.Logger\obj\Debug\Lavasoft.WCAssistant.Service.Logger.pdbh- source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000281A000.00000004.00000800.00020000.00000000.sdmp, Lavasoft.WCAssistant.Service.Logger.dll.2.dr
Source:	Binary string: c:\dev\sqlite\dotnet\bin\2008\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb`: source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\Lavasoft.Utils\obj\x86\Debug\Lavasoft.Utils.pdb$ source: WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr
Source:	Binary string: &Application/WebCompanion-Installer.pdb source: WebCompanion.zip.2.dr
Source:	Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.745547016.0000000005589000.00000020.00000001.01000000.00000008.sdmp, WebCompanion.exe, 00000008.00000002.745271283.0000000004C72000.00000020.00000001.01000000.00000017.sdmp
Source:	Binary string: C:\SourceCode\TFS\MozCompressor\Debug\MozCompressor.pdb source: WebCompanion.exe, 00000008.00000002.745149373.0000000004BF5000.00000002.00000001.01000000.00000018.sdmp, MozCompressor.dll.2.dr
Source:	Binary string: C:\Windows\TEMP\drone-ME4saUyIgSY9rSgY\drone\src\Common\VPNService\obj\x86\Debug\VPNServiceWCF.pdb source: VPNServiceWCF.dll.2.dr
Source:	Binary string: vcruntime140d.i386.pdb+++ source: WebCompanion.exe, 00000008.00000002.749384362.0000000062361000.00000020.00000001.01000000.00000019.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: D:\Projects\Adaware\webcompanion\Common\SearchProtect.Service.Logger\obj\Debug\Lavasoft.WCAssistant.Service.Logger.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000281A000.00000004.00000800.00020000.00000000.sdmp, Lavasoft.WCAssistant.Service.Logger.dll.2.dr
Source:	Binary string: ucrtbased.pdb source: WebCompanion.exe, 00000008.00000002.748533348.00000000621C1000.00000020.00000001.01000000.0000001A.sdmp
Source:	Binary string: vcruntime140d.i386.pdb source: WebCompanion.exe, 00000008.00000002.749384362.0000000062361000.00000020.00000001.01000000.00000019.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: Application/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023D1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.2.dr
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Lavasoft.AppCore\obj\Release\Lavasoft.AppCore.pdb source: WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanion-Installer.pdb source: Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp
Source:	Binary string: webcompanion-installer.pdb source: WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005899000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net35\WpfAnimatedGif.pdb source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000262D000.00000004.00000800.00020000.00000000.sdmp, WpfAnimatedGif.dll.2.dr
Source:	Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net35\WpfAnimatedGif.pdbSHA256 source: WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000262D000.00000004.00000800.00020000.00000000.sdmp, WpfAnimatedGif.dll.2.dr
Source:	Binary string: c:\dev\sqlite\dotnet\bin\2008\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb source: WebCompanion.exe, 00000008.00000002.749822920.0000000069A58000.00000002.00000001.01000000.00000015.sdmp, SQLite.Interop.dll0.2.dr

Data Obfuscation

PE file contains an invalid checksum

Source: Setup.exe	Static PE information: real checksum: 0x8f918 should be: 0x88572
Source: WebCompanion-Installer.resources.dll8.0.dr	Static PE information: real checksum: 0x0 should be: 0xa6a7
Source: WebCompanion-Installer.resources.dll5.0.dr	Static PE information: real checksum: 0x0 should be: 0xc6c2
Source: WebCompanion-Installer.resources.dll1.0.dr	Static PE information: real checksum: 0x0 should be: 0x3e3f
Source: WebCompanion-Installer.resources.dll7.0.dr	Static PE information: real checksum: 0x0 should be: 0xcb69
Source: WebCompanion-Installer.resources.dll2.0.dr	Static PE information: real checksum: 0x0 should be: 0x4885
Source: WebCompanion-Installer.resources.dll4.0.dr	Static PE information: real checksum: 0x0 should be: 0x5659
Source: WebCompanion-Installer.resources.dll6.0.dr	Static PE information: real checksum: 0x0 should be: 0xd8a3
Source: WebCompanion-Installer.resources.dll0.0.dr	Static PE information: real checksum: 0x0 should be: 0xe72f
Source: WebCompanion-Installer.resources.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x2ab0
Source: WebCompanion-Installer.resources.dll3.0.dr	Static PE information: real checksum: 0x0 should be: 0x842b

PE file contains sections with non-standard names

Source: Setup.exe	Static PE information: section name: .sxdata
Source: acs17.dll.2.dr	Static PE information: section name: .textbss
Source: acs17.dll.2.dr	Static PE information: section name: .msvcjmc
Source: acs17.dll.2.dr	Static PE information: section name: .00cfg

Source: DotNetZip.dll.2.dr

Static PE information: section name: .text entropy: 6.825871161326248

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\vcruntime140d.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceWCF.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ucrtbased.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.Shell32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	File created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Jump to behavior

Boot Survival

Creates or modifies windows services

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage

Modifies existing windows services

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Frequently Asked Questions.url	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Web Companion.lnk	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Web Companion			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Web Companion			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Memory allocated: 2D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Memory allocated: 2110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Memory allocated: 770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 200000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 27C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 3B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 1C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 27C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 400000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 2C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 27C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Memory allocated: 990000 memory reserve \| memory write watch

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 1348
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Window / User API: threadDelayed 667

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceWCF.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS053FCFED\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file

Is looking for software installed on the system

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Registry key enumerated: More than 403 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe TID: 1940	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe TID: 1128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe TID: 1128	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 1200	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 200	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2344	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 960	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2236	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2344	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 1756	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2544	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 1252	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2544	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 1756	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2424	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 1444	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 268	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 1520	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 2840	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe TID: 1444	Thread sleep time: -300000s >= -30000s

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Thread delayed: delay time: 300000

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\	Jump to behavior

Source: WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe.2.dr	Binary or memory string: #=zJcSAKVf2Oq7SX1AJhgfS4PSYmp4K
Source: WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	Binary or memory string: vmware

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Enables debug privileges

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Process created: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe "C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone	Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS053FCFED\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS053FCFED\en-US\WebCompanion-Installer.resources.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS053FCFED\ICSharpCode.SharpZipLib.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\156647e90ed1919cfafce12417c2892c\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\156647e90ed1919cfafce12417c2892c\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionIcon.ico VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\156647e90ed1919cfafce12417c2892c\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	Queries volume information: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies Internet Explorer zone settings

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 2301

Jump to behavior

Modifies Internet Explorer zonemap settings

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\localhost *			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com http			Jump to behavior

Overwrites Mozilla Firefox settings

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\prefs.js
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\prefs.js

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh http add urlacl url=http://+:9007/ user=Everyone

Adds / modifies Windows certificates

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4 Blob

Jump to behavior

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\prefs.js
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\search.json.mozlz4
Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	311 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Deobfuscate/Decode Files or Information	LSASS Memory	33 System Information Discovery	Remote Desktop Protocol	3 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	21 Windows Service	21 Windows Service	1 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	11 Process Injection	1 Software Packing	NTDS	21 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	11 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Search Order Hijacking	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	29%	ReversingLabs	Win32.PUA.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\7zS053FCFED\ICSharpCode.SharpZipLib.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\Newtonsoft.Json.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\de-DE\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\en-US\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\es-ES\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\fr-CA\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\it-IT\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\ja-JP\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\pt-BR\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\ru-RU\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\tr-TR\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS053FCFED\zh-CHS\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.Shell32.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe	5%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceWCF.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe	12%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion-Installer.resources.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll	4%	ReversingLabs

Source	Detection	Scanner	Label
http://tempuri.org/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://flwadw.com/v1/event-stat?Type=UIOpen&ProductID=wc&EventVersion=1LR	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/CreatUninstallInfoT	0%	Avira URL Cloud	safe
https://staging-bitmask.lavasoft.net/bitmask/allmaskvalues	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=CompleteInstall&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_ac	0%	Avira URL Cloud	safe
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_ab	0%	Avira URL Cloud	safe
https://partners.webcompanion.com/api/Partners/get-partner-by-id	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat	0%	Avira URL Cloud	safe
http://www.codeproject.com/Articles/28093/Using-RoutedCommands-with-a-ViewModel-in-WPF	0%	Avira URL Cloud	safe
https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe	0%	Avira URL Cloud	safe
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/ProcessRemoteFeatureT	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/IsVPNConnectedResponse	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/GetConnectionInfo	0%	Avira URL Cloud	safe
http://drive.google.com/D0	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPNResponse	0%	Avira URL Cloud	safe
http://www.youtube.comD0	0%	Avira URL Cloud	safe
https://search.yahoo.com/yhs/search	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://ruadlist.googlecode.com/hg/advblock.txt(AdBlockAcceptableAds	0%	Avira URL Cloud	safe
https://completion.amazon.com/search/complete?q=	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/SilentUninstallT	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/IEBhoHelperTest.exe	0%	Avira URL Cloud	safe
http://tempuri.org/SendWCFeedbackT	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	Avira URL Cloud	safe
https://www.amazon.com/exec/obidos/external-search/	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www	0%	Avira URL Cloud	safe
http://aia.entrust.net/evcs2-chain.p7c01	0%	Avira URL Cloud	safe
http://wpfanimatedgif.codeplex.com	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/searchenginetemplate.xmlQhttps://appdownload.la	0%	Avira URL Cloud	safe
http://www.lavasoft.com/mylavasoft/contact	0%	Avira URL Cloud	safe
http://www.gophish.com	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/Silverlight_x64.exe	0%	Avira URL Cloud	safe
https://addons.mozilla.org/en-US/firefox/	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedService/Rewards	0%	Avira URL Cloud	safe
http://www.entrust.net/rpa03	0%	Avira URL Cloud	safe
https://featureflags.lavasoft.com	0%	Avira URL Cloud	safe
https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip	0%	Avira URL Cloud	safe
https://acs.lavasoft.com/api/v2/url/permanentwh	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/LoadConfig	0%	Avira URL Cloud	safe
https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=	0%	Avira URL Cloud	safe
https://twitter.com/search	0%	Avira URL Cloud	safe
https://search.yahoo.com/sugg/ff	0%	Avira URL Cloud	safe
http://geo.lavasoft.com/	0%	Avira URL Cloud	safe
http://wc-partners.lavasoft.com	0%	Avira URL Cloud	safe
https://feedbackapi.adaware.com/api/feedback;http://webcompanion.com/check	0%	Avira URL Cloud	safe
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe	0%	Avira URL Cloud	safe
https://drive.google.com/?usp=chrome_appD0	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/SetHomePageIET	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedService/RewardsResponse	0%	Avira URL Cloud	safe
http://webcompanion.com/version_logs?json=true&version=	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedService/GetParameters	0%	Avira URL Cloud	safe
https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=ToggleButton&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/SetNewTabIET	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/postrun/preprod/v1/FeatureActions.zip	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1LR	0%	Avira URL Cloud	safe
https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPN	0%	Avira URL Cloud	safe
http://wcdownloadercdn.lavasoft.com/13.0.0.1	0%	Avira URL Cloud	safe
http://tempuri.org/WcSendAutoResponseEmailT	0%	Avira URL Cloud	safe
http://webcompanion.com/version_logs?json=true&version=13.900.0.1080	0%	Avira URL Cloud	safe
http://wc-update-service.lavasoft.com/components.asmx	0%	Avira URL Cloud	safe
http://pp.webcompanion.com/notifications/download/rt/aabrowser.zip	0%	Avira URL Cloud	safe
http://crl.entrust.net/g2ca.crl0	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	Avira URL Cloud	safe
http://tempuri.org/A	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/VPNService.WCF.Model	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/TurnOffVPN	0%	Avira URL Cloud	safe
https://eventstaging.lavasoft.com/v1/event-stat	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/GetLocationsT	0%	Avira URL Cloud	safe
https://svn.apache.org/repos/asf/logging/log4net/tags/1.2.13RC3	0%	Avira URL Cloud	safe
https://wcdownloadercdn.lavasoft.com	0%	Avira URL Cloud	safe
https://www.adaware.com/privacy-policy	0%	Avira URL Cloud	safe
https://eventstaging.lavasoft.com/v1/event-statFhttps://flwadw.com/v1/event-stat-wclhttp://staging-c	0%	Avira URL Cloud	safe
https://acs.lavasoft.com/api/v2/url/permanentwhitelist	0%	Avira URL Cloud	safe
http://tempuri.org/SendEmailT	0%	Avira URL Cloud	safe
http://www.apache.org/).	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	Avira URL Cloud	safe
http://webcompanion.com/google_chrome_incompatibility	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/CopyFilesT	0%	Avira URL Cloud	safe
http://tempuri.org/IWCAssistantService/SetSearchEngineIET	0%	Avira URL Cloud	safe
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_wb	0%	Avira URL Cloud	safe
https://www.google.com:443	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=FirstRun&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
http://webcompanion.com/images/email/tw-icon.png	0%	Avira URL Cloud	safe
http://tempuri.org/IVPNServiceWCF/IsVPNConnected	0%	Avira URL Cloud	safe
http://system.data.sqlite.org/X	0%	Avira URL Cloud	safe
https://sg-bitmask.adaware.com/bitmask/allmaskvalues	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating	0%	Avira URL Cloud	safe
https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
geo.lavasoft.com	104.16.149.130	true	false	unknown
partners.webcompanion.com	104.19.208.152	true	false	unknown
cdn.inspectlet.com	104.22.56.245	true	false	unknown
wcdownloadercdn.lavasoft.com	104.16.149.130	true	false	unknown
featureflags.lavasoft.com	104.16.148.130	true	false	unknown
flwadw.com	104.18.26.149	true	false	unknown
sg-bitmask.adaware.com	104.16.213.94	true	false	unknown
webcompanion.com	104.19.159.224	true	true	unknown
cdn.cookielaw.org	104.19.178.52	true	false	unknown
geolocation.onetrust.com	104.18.32.137	true	false	unknown
wc-partners.lavasoft.com	64.18.87.81	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://flwadw.com/v1/event-stat?Type=CompleteInstall&ProductID=wc&EventVersion=1	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1	false	Avira URL Cloud: safe	unknown
https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip	false	Avira URL Cloud: safe	unknown
http://geo.lavasoft.com/	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat?Type=ToggleButton&ProductID=wc&EventVersion=1	false	Avira URL Cloud: safe	unknown
http://webcompanion.com/version_logs?json=true&version=13.900.0.1080	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat?Type=FirstRun&ProductID=wc&EventVersion=1	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://flwadw.com/v1/event-stat?Type=UIOpen&ProductID=wc&EventVersion=1LR	WebCompanion.exe, 00000009.00000002.763606524.000000000D959000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe	Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_ac	WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_ab	WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IWCAssistantService/CreatUninstallInfoT	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://staging-bitmask.lavasoft.net/bitmask/allmaskvalues	WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat	FeatureComponent.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.codeproject.com/Articles/28093/Using-RoutedCommands-with-a-ViewModel-in-WPF	WebCompanion.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://partners.webcompanion.com/api/Partners/get-partner-by-id	WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	WebCompanion.exe, 00000009.00000002.741867833.0000000000292000.00000020.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IVPNServiceWCF/IsVPNConnectedResponse	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://drive.google.com/D0	WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/	Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/IWCAssistantService/ProcessRemoteFeatureT	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/yhs/search	WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip	Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPNResponse	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IVPNServiceWCF/GetConnectionInfo	WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.youtube.comD0	WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ruadlist.googlecode.com/hg/advblock.txt(AdBlockAcceptableAds	WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IWCAssistantService/SilentUninstallT	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://completion.amazon.com/search/complete?q=	WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rt.webcompanion.com/notifications/download/rt/IEBhoHelperTest.exe	WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/SendWCFeedbackT	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www	Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://aia.entrust.net/evcs2-chain.p7c01	Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	false	Avira URL Cloud: safe	unknown
http://rt.webcompanion.com/notifications/download/rt/searchenginetemplate.xmlQhttps://appdownload.la	WebCompanion.exe, 00000008.00000002.742035065.00000000005B2000.00000020.00000001.01000000.00000011.sdmp, Lavasoft.Utils.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000282C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000027C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://wpfanimatedgif.codeplex.com	WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000262D000.00000004.00000800.00020000.00000000.sdmp, WpfAnimatedGif.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.gophish.com	WebCompanion.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://www.lavasoft.com/mylavasoft/contact	WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002679000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002706000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000271F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002647000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026BA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026D3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000026ED000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002787000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion.resources.dll0.2.dr, WebCompanion.resources.dll7.2.dr, WebCompanion.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://rt.webcompanion.com/notifications/download/rt/Silverlight_x64.exe	WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/ILocalyHostedService/Rewards	WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.org/en-US/firefox/	WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	false	Avira URL Cloud: safe	unknown
https://featureflags.lavasoft.com	WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002848000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.000000000282C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IVPNServiceWCF/LoadConfig	WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://acs.lavasoft.com/api/v2/url/permanentwh	WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005810000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/sugg/ff	WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twitter.com/search	WebCompanion.exe, 00000008.00000002.747621560.00000000065AF000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=	Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://wc-partners.lavasoft.com	WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://feedbackapi.adaware.com/api/feedback;http://webcompanion.com/check	WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe	WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217E000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.2.dr	false	Avira URL Cloud: safe	unknown
https://drive.google.com/?usp=chrome_appD0	WebCompanion.exe, 00000009.00000002.742425946.0000000002CC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IWCAssistantService/SetHomePageIET	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/ILocalyHostedService/RewardsResponse	WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/ILocalyHostedService/GetParameters	WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.0000000002921000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://webcompanion.com/version_logs?json=true&version=	WebCompanion.exe, 00000008.00000002.742500209.000000000298B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a	Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IWCAssistantService/SetNewTabIET	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
http://rt.webcompanion.com/notifications/download/rt/postrun/preprod/v1/FeatureActions.zip	WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1LR	WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002435000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000281A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002421000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000027DA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000027A2000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002794000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W	Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IVPNServiceWCF/ConnectDisconnectVPN	WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/WcSendAutoResponseEmailT	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
http://wcdownloadercdn.lavasoft.com/13.0.0.1	WebCompanion-Installer.exe, 00000002.00000002.741957823.0000000000500000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wc-update-service.lavasoft.com/components.asmx	Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002614000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.763606524.000000000D959000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr, WebCompanion.exe.config.2.dr	false	Avira URL Cloud: safe	unknown
http://pp.webcompanion.com/notifications/download/rt/aabrowser.zip	WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	WebCompanion-Installer.exe, 00000002.00000002.745666551.0000000005828000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.747621560.00000000065D1000.00000004.00000020.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.749471346.00000000052DD000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/g2ca.crl0	Setup.exe, WebCompanion.resources.dll3.2.dr, WebCompanion.resources.dll2.2.dr, WebCompanion-Installer.resources.dll0.2.dr, Ionic.Zip.dll.2.dr, WebCompanion.resources.dll0.2.dr, SQLite.Interop.dll0.2.dr, vcruntime140d.dll.2.dr, ICSharpCode.SharpZipLib.dll.2.dr, MozCompressor.dll.2.dr, liblz4.dll.2.dr, Esent.Interop.dll.2.dr, WebCompanion-Installer.resources.dll3.2.dr, Lavasoft.Utils.SqlLite.dll.2.dr, Lavasoft.Utils.dll.2.dr, FeatureComponent.dll.2.dr, WebCompanion-Installer.resources.dll1.2.dr, Lavasoft.WCAssistant.Service.Logger.dll.2.dr, VPNServiceWCF.dll.2.dr, WpfAnimatedGif.dll.2.dr, WebCompanion-Installer.resources.dll4.2.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/A	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/VPNService.WCF.Model	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IVPNServiceWCF/TurnOffVPN	WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://eventstaging.lavasoft.com/v1/event-stat	WebCompanion.exe, 00000008.00000002.742359242.0000000000CF2000.00000020.00000001.01000000.00000016.sdmp, FeatureComponent.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://svn.apache.org/repos/asf/logging/log4net/tags/1.2.13RC3	WebCompanion.exe, 00000009.00000002.741867833.0000000000292000.00000020.00000001.01000000.0000000F.sdmp, WebCompanion.exe, 00000009.00000002.741887657.00000000002DC000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IVPNServiceWCF/GetLocationsT	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://wcdownloadercdn.lavasoft.com	WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000023E9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://acs.lavasoft.com/api/v2/url/permanentwhitelist	WebCompanion-Installer.exe, 00000002.00000002.742310595.00000000021C4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002181000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000217E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000287B000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.2.dr	false	Avira URL Cloud: safe	unknown
https://www.adaware.com/privacy-policy	Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://eventstaging.lavasoft.com/v1/event-statFhttps://flwadw.com/v1/event-stat-wclhttp://staging-c	WebCompanion.exe, 00000008.00000002.742206694.0000000000B22000.00000020.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/SendEmailT	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/).	WebCompanion.exe, 00000009.00000002.741867833.0000000000292000.00000020.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse	WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002111000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IWCAssistantService/CopyFilesT	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://webcompanion.com/google_chrome_incompatibility	WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240402_wb	WebCompanion.exe, 00000008.00000002.742500209.0000000002D59000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IWCAssistantService/SetSearchEngineIET	WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com:443	WebCompanion.exe, 00000008.00000002.742500209.0000000002A90000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000002.742500209.000000000298B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://webcompanion.com/images/email/tw-icon.png	WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002660000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000008.00000000.456336095.000000000133B000.00000020.00000001.01000000.0000000E.sdmp, WebCompanion.exe, 00000009.00000002.750980749.00000000063C2000.00000020.00000001.01000000.00000020.sdmp, WebCompanion.resources.dll0.2.dr, WebCompanion.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/IVPNServiceWCF/IsVPNConnected	WebCompanion.exe, 00000009.00000002.742425946.00000000029CB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://system.data.sqlite.org/X	WebCompanion.exe, 00000008.00000002.742307382.0000000000C14000.00000002.00000001.01000000.00000014.sdmp	false	Avira URL Cloud: safe	unknown
https://sg-bitmask.adaware.com/bitmask/allmaskvalues	WebCompanion.exe, 00000008.00000002.742500209.000000000287F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.exe, 00000009.00000002.741896612.00000000002E2000.00000020.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip	Setup.exe, 00000000.00000003.347402334.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.000000000256A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000002.742310595.0000000002494000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WebCompanion-Installer.exe.config.2.dr	false	Avira URL Cloud: safe	unknown
http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating	Setup.exe, 00000000.00000003.347718441.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.347764084.0000000000260000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000002.00000000.347791007.0000000000992000.00000020.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.19.159.224	webcompanion.com	United States	13335	CLOUDFLARENETUS	true
64.18.87.81	wc-partners.lavasoft.com	Canada	21548	MTOCA	false
104.18.27.149	unknown	United States	13335	CLOUDFLARENETUS	false
104.16.149.130	geo.lavasoft.com	United States	13335	CLOUDFLARENETUS	false
104.16.148.130	featureflags.lavasoft.com	United States	13335	CLOUDFLARENETUS	false
104.18.26.149	flwadw.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465336
Start date and time:	2024-07-01 15:21:23 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	4
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal54.phis.troj.spyw.evad.winEXE@11/150@26/6
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, vga.dll, WMIADAP.exe, conhost.exe, WmiApSrv.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 216.58.215.227, 172.217.168.14, 142.250.102.84, 216.58.215.234, 142.250.203.106, 34.104.35.123, 172.217.168.3, 142.250.203.104, 204.79.197.237, 13.107.21.237
Excluded domains from analysis (whitelisted): fonts.googleapis.com, bat-bing-com.dual-a-0034.a-msedge.net, accounts.google.com, ajax.googleapis.com, fonts.gstatic.com, clientservices.googleapis.com, clients2.google.com, redirector.gvt1.com, edgedl.me.gvt1.com, www.googletagmanager.com, bat.bing.com, dual-a-0034.a-msedge.net, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
06:23:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Web Companion C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
06:23:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Web Companion C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
09:23:20	API Interceptor	85691x Sleep call for process: WebCompanion-Installer.exe modified
09:24:20	API Interceptor	429x Sleep call for process: WebCompanion.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.19.159.224	Setup.exe	Get hash	malicious	Unknown	Browse	webcompanion.com/version_logs?json=true&version=12.901.4.1003
64.18.87.81	https://filezilla-project.org/download.php?type=client	Get hash	malicious	Unknown	Browse	wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=FZ210427_ac
	Setup.exe	Get hash	malicious	Unknown	Browse	wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
	Setup.exe	Get hash	malicious	Unknown	Browse	wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
	f_038023.exe	Get hash	malicious	Unknown	Browse	wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
	f_000aab.exe	Get hash	malicious	Unknown	Browse	wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
	f_000aab.exe	Get hash	malicious	Unknown	Browse	wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
	f_000aab.exe	Get hash	malicious	Unknown	Browse	wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
	f_000aab.exe	Get hash	malicious	Unknown	Browse	wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
	f_000aab.exe	Get hash	malicious	Unknown	Browse	wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN220101_ac
104.18.27.149	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
	APInstaller (4).exe	Get hash	malicious	Unknown	Browse
	APInstaller.exe	Get hash	malicious	Unknown	Browse
	https://download.adaware.com/nano_download.php?partner=IN221105&nonadmin&tych&campaign=20540828322	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	WebCompanionInstaller-12.901.4.1003-prod.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geo.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup (1).exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup (1).exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	https://webcompanion.com/nano_download.php?savename=Setup.exe&partner=IN230901&nonadmin&direct&tych&campaign=18022583703	Get hash	malicious	Unknown	Browse	104.16.148.130
	https://download.adaware.com/nano_download.php?partner=IN221105&nonadmin&tych&campaign=20540828322	Get hash	malicious	Unknown	Browse	104.17.8.52
	https://download.adaware.com/nano_download.php?partner=IN221105&nonadmin&tych&campaign=20540828322	Get hash	malicious	Unknown	Browse	104.17.8.52
wcdownloadercdn.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup (1).exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup (1).exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.17.9.52
	Setup.exe	Get hash	malicious	Unknown	Browse	104.17.8.52
	https://filezilla-project.org/download.php?type=client	Get hash	malicious	Unknown	Browse	104.17.8.52
cdn.inspectlet.com	https://houkht.za.com/	Get hash	malicious	Unknown	Browse	172.67.10.172
	Setup.exe	Get hash	malicious	Unknown	Browse	172.67.10.172
	http://webcompanion.com	Get hash	malicious	Unknown	Browse	104.22.56.245
	http://www.corporateworldwidetransportation.com/	Get hash	malicious	Unknown	Browse	104.22.56.245
	Setup.exe	Get hash	malicious	Unknown	Browse	104.22.57.245
	f_038023.exe	Get hash	malicious	Unknown	Browse	104.22.56.245
	f_000aab.exe	Get hash	malicious	Unknown	Browse	104.22.56.245
	f_000aab.exe	Get hash	malicious	Unknown	Browse	104.22.56.245
	Setup.exe	Get hash	malicious	Unknown	Browse	172.67.10.172
featureflags.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup (1).exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup (1).exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	https://webcompanion.com/nano_download.php?savename=Setup.exe&partner=IN230901&nonadmin&direct&tych&campaign=18022583703	Get hash	malicious	Unknown	Browse	104.16.149.130
	https://download.adaware.com/nano_download.php?partner=IN221105&nonadmin&tych&campaign=20540828322	Get hash	malicious	Unknown	Browse	104.17.9.52
	https://download.adaware.com/nano_download.php?partner=IN221105&nonadmin&tych&campaign=20540828322	Get hash	malicious	Unknown	Browse	104.17.9.52

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://forms.office.com/e/tBp2XcGpEy	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	Drawing specification and June PO #07329.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	IMG_067_6331002.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	invoice-72717953897646054572255005658360083176291774189023-quiltercheviot.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	MV RIVA WIND - VESSEL's PARTICULARS.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	new shippment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
MTOCA	Setup.exe	Get hash	malicious	Unknown	Browse	64.18.87.82
	SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exe	Get hash	malicious	Unknown	Browse	64.18.87.4
	SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exe	Get hash	malicious	Unknown	Browse	64.18.87.4
	ffff6f6.msi	Get hash	malicious	Unknown	Browse	64.18.87.10
	uXUrccWxXO.elf	Get hash	malicious	Unknown	Browse	67.22.231.120
	https://filezilla-project.org/download.php?type=client	Get hash	malicious	Unknown	Browse	64.18.87.81
	dagQSRLYsB.elf	Get hash	malicious	Unknown	Browse	206.55.88.228
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	206.55.88.205
	PDFViewer_46615443.msi	Get hash	malicious	Unknown	Browse	64.18.87.10
CLOUDFLARENETUS	https://forms.office.com/e/tBp2XcGpEy	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	Drawing specification and June PO #07329.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	IMG_067_6331002.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	invoice-72717953897646054572255005658360083176291774189023-quiltercheviot.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	MV RIVA WIND - VESSEL's PARTICULARS.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	new shippment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	S#U0130PAR#U0130#U015e-260624.exe	Get hash	malicious	Unknown	Browse	162.159.133.233
CLOUDFLARENETUS	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://forms.office.com/e/tBp2XcGpEy	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	Drawing specification and June PO #07329.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	IMG_067_6331002.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	invoice-72717953897646054572255005658360083176291774189023-quiltercheviot.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	MV RIVA WIND - VESSEL's PARTICULARS.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	new shippment.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
36f7277af969a6947a61ae0b815907a1	paediatric neurologist medico legal 68003.js	Get hash	malicious	Unknown	Browse	104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	Alinco Pipe Supply FE Product Specification & Drawing DESIGN.xls	Get hash	malicious	Unknown	Browse	104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	Product Inquiry_#466788.xls	Get hash	malicious	FormBook	Browse	104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	Alinco Pipe Supply FE Product Specification & Drawing DESIGN.xls	Get hash	malicious	Unknown	Browse	104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	7YZlAbfKMg.rtf	Get hash	malicious	AgentTesla	Browse	104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	Product Inquiry466789.xls	Get hash	malicious	AgentTesla	Browse	104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	fs-windows-agent-3.4.0.msi	Get hash	malicious	Unknown	Browse	104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	PROFORMA INVOICE.xls	Get hash	malicious	Remcos	Browse	104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149
	RY94HT.docx	Get hash	malicious	Remcos	Browse	104.18.27.149 104.16.149.130 104.16.148.130 104.18.26.149

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	42930
Entropy (8bit):	5.504613987639663
Encrypted:	false
SSDEEP:	768:VAZRg759YLgtfzqAIfRr+nIfRC+gJ/VUh67TPBccOJ2+dMM2mibe1MxxHbIVPi3i:jzvIfRSnIfR/gJ/VUh67TPBcco2+dMM/
MD5:	CB4B82AA1C05F03BB1DA2B1B5F6D72D5
SHA1:	9E29D89075D1EA3EAE9015CB94D96E3A5243D369
SHA-256:	256BDA9CF794F3BF72F1B115DB7FFEE031C21A61D15A2671F7F6A62423D38B12
SHA-512:	C1C517969605FCBFE7DA6A0C4419F961F38E12A668974193FEFC0C1D1BB182A4E937EA6BF621D9C1D5DFB58E137A7B4877AFBAD7CA56401A3CFBE1674E1027D0
Malicious:	false
Reputation:	low
Preview:	INFO 2024-07-01 09:23:05 [1] [WebCompanion.UI.App #=zTY688A6jMj8KGHur5R$oUfHWnqjE] ------------------------------------------------------------------------------------------------------..INFO 2024-07-01 09:23:05 [1] [WebCompanion.UI.App #=zTY688A6jMj8KGHur5R$oUfHWnqjE] Starting Webcompanion with :C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe --install --geo=..INFO 2024-07-01 09:23:06 [1] [FeatureMainComponent.Browsers.Firefox.FirefoxBrowser .ctor] Start monitoring FireFox Browser..INFO 2024-07-01 09:23:06 [1] [FeatureMainComponent.SearchProtect GetAllBrowserSetttings] Starting to collect ..INFO 2024-07-01 09:23:06 [1] [FeatureMainComponent.SearchProtect GetAllBrowserSetttings] Successfully collected information about all installed browsers..INFO 2024-07-01 09:23:06 [1] [FeatureMainComponent.SearchProtect GetAllBrowserSetttings] Starting to collect ..INFO 2024-07-01 09:23:06 [1] [FeatureMainComponent.SearchProtect GetAllBrowserSetttings] Succe

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\155oeosf.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2630
Entropy (8bit):	4.261511082118919
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+vEAndocLpQGntXKwEAnd3YEAnw:ZnvlAnIn86hhmVChNKnAAE8AndoKpntp
MD5:	8FEC1DE52E5B589C74341F3909A7DAA6
SHA1:	D23ADE1CD26184F69DEAE71C919139F8115A8C9A
SHA-256:	FAF909118142201F116EE75D7BCC3279CBA96673A203D2F02C599941304ABF86
SHA-512:	9AE4B63F32C2C0F4CA17DD21C4786D2142F02EAC9A168F5C03976EF41F12DC5BC86EC3564A67F582396A5ACEC6A2DC13229D8398FCAEE182C83B3A1A5F2AF6D5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\1eyjg5un.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2768
Entropy (8bit):	4.262196460157488
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+vEAndocLpQGntXKwEAnd3L/fW/:ZnvlAnIn86hhmVChNKnAAE8AndoKpntI
MD5:	1A413B4606EF8A49D5FE1B238CDCD20F
SHA1:	BFBD4C53E3FBFA12AC88EE9EC4F35E6E178729BC
SHA-256:	B84499CAA3F8FBA9E7E096C1B4467E321EFF82A335C9447FE1B865DA0BA86E6A
SHA-512:	DB4AEFB7A1983F8160A7A73B9F636287B778BEDE14EB1CE7AAFBA31F498D3782EE94742A1A206A3EAECF689E642168AF00EDFF6674673EA1BF38C39D4A7741F6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\3ljphqa5.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2372
Entropy (8bit):	4.280758565227378
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+doc0tXKwEAnd3YEAnw:ZnvlAnIn86hhmVChNKnAAEdoRtuAnBdh
MD5:	1F90088599EFEC8832F98C128E716CA3
SHA1:	9502A70EF3055B07EAE4DDD4B0E85AE763637FFA
SHA-256:	222AFC850ADFB522D8502BDD1676C69708F9368FF8806781599870A34A41B974
SHA-512:	141168D4EA2DEE32B7C3D4D3A21CAFF6104245BDADF46F62C2FCF2DAFA107A7199C003634376DFD025DBF50F812381BF34BBB41DBE340B2B87964D22A6D355BE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\bu202zfu.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	4.287094386265253
Encrypted:	false
SSDEEP:	24:2dFGnvHQEKpnvUxgv1j0cZvVXvVJvyREKpnvo:cFGnvQEAn8xgdocZtXdJYEAnw
MD5:	5E9E5CAEA0E9C4E8B9451FA2E417EF31
SHA1:	CFF95E107D3F17213A9131DB68A342BA5F85833F
SHA-256:	A4E3A68EC05D7BDC8B3AF1E9CF8BDD719C228E079C8489CA2A188A4541CA8093
SHA-512:	225DD12DDFC61CDBFA3E7F8BEBCCA47D4273998806B18F29FDA2AF7F2F2993F692C169C3811D1EB0A16BA83910F035ABFA1CE41119DCCDF2836FEDF4E6A85E2C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="AfterUpdateStartCount" serializeAs="String">.. <value>1</value>.. </setting>.. <setting name="MTTimerTrigger" serializeAs="String">.. <value>Every24HoursRun</value>.. </setting>.. <setting name="TriggerType" serializeAs="String">.. <value>afterinstall</value>.. </setting>.. <setting name="IsOldActiveFeature" serializeAs="String">.. <value>F

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\cjju51tc.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	861
Entropy (8bit):	4.351346194212837
Encrypted:	false
SSDEEP:	12:TMHdGGnOhrOXQEN+uKpvvvXaRDBfEN+IvvXlEN+9vvXY6EN+7vvX3SREN+uKpvvw:2djQEKpnvUxgvVXvVJvyREKpnvo
MD5:	B4ECCCF8F6CB66ED6C222E0D32F34065
SHA1:	5166BB516A533296B2F6914290C01359912CEB86
SHA-256:	1631FF1BC4B474303BE696EF05DC79AA8A58014383019C4D84366C6C25E349FD
SHA-512:	FEE6E5B6D9A90CFDE669843EF7BC408E054B955691535DF9735BAE5A225C36BEC342D4DEAD83D6A82EA724F6C47B0CCCC5D62D007870B48C0577FD768F067E3A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="MTTimerTrigger" serializeAs="String">.. <value>Every24HoursRun</value>.. </setting>.. <setting name="TriggerType" serializeAs="String">.. <value>afterinstall</value>.. </setting>.. <setting name="IsOldActiveFeature" serializeAs="String">.. <value>False</value>.. </setting>.. </WebCompanion.UI.Properties.Settings>.. </userSettings>..</configuration>

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\ckxtsujp.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2372
Entropy (8bit):	4.280758565227378
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+doc0tXKwEAnd3YEAnw:ZnvlAnIn86hhmVChNKnAAEdoRtuAnBdh
MD5:	1F90088599EFEC8832F98C128E716CA3
SHA1:	9502A70EF3055B07EAE4DDD4B0E85AE763637FFA
SHA-256:	222AFC850ADFB522D8502BDD1676C69708F9368FF8806781599870A34A41B974
SHA-512:	141168D4EA2DEE32B7C3D4D3A21CAFF6104245BDADF46F62C2FCF2DAFA107A7199C003634376DFD025DBF50F812381BF34BBB41DBE340B2B87964D22A6D355BE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\d2zczf42.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2497
Entropy (8bit):	4.268847321532049
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+vEAndoc0tXKwEAnd3YEAnw:ZnvlAnIn86hhmVChNKnAAE8AndoRtuAd
MD5:	1734AD7C8E9269E43084761AA7879CD7
SHA1:	894514E9C8181B3DB689B091E8AF241E29C8CB14
SHA-256:	6B25EC04527AA8DD57099280DEFF617ADEF4939942D519D45F77A10A809E99EF
SHA-512:	3ECA0973F20D1B41EE4424C388A6932D6CB75508225A55ACA32E4BFC410D32215ECFE988D84F6CAE60662153DB9BBB88761A9113F3FC801FBDB068DB5FE05DCF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\ecx1uqkv.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	4.2917510170176225
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+docZtXd3YEAnw:ZnvlAnIn86hhmVChNKnAAEdoMtBdAnw
MD5:	E106333FAD7343FFC316DC6D57A20DED
SHA1:	2E9CAB95C3F2F9C150BB7AAA64F46B72CC7EC554
SHA-256:	ABA1AC41297C03AB049F4AA375DD85896B0F230D6E70C1DDBDA2FF61DC1F418A
SHA-512:	01B28600A0A6BC57FA3E21840E2A2A65181DC18C27AEABB57DD48D96A7AAC56E9FDF59718CA0E4BE0C122F81B22018857EF6244266BF7F3299EA5D04ADBD1EE5
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\epvcswql.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	723
Entropy (8bit):	4.349915906206985
Encrypted:	false
SSDEEP:	12:TMHdGGnOhrOXQEN+uKpvvvXaRDBfEN+IvvXY6EN+7vvX3SREN+uKpvvvXCONI3xT:2djQEKpnvUxgvVJvyREKpnvo
MD5:	C471093B49CA1D7770D7E39A57743626
SHA1:	905D25E85ACB63FC6088390FF0E30A993BFCF777
SHA-256:	398633B8F978F449FDB4107AA450CAE694A02E334D61E90BD0116610539F3435
SHA-512:	EE41BB38CB0A38801A622D263CCBCDEFC48392C8FD290231B858AE348CC776105EED58CA8DF2F45AA3A7D26E335321F658AB0F1E2247F01D14AC0CB6025FF7B2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="TriggerType" serializeAs="String">.. <value>afterinstall</value>.. </setting>.. <setting name="IsOldActiveFeature" serializeAs="String">.. <value>False</value>.. </setting>.. </WebCompanion.UI.Properties.Settings>.. </userSettings>..</configuration>

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\figgaxwc.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	594
Entropy (8bit):	4.396608312952902
Encrypted:	false
SSDEEP:	12:TMHdGGnOhrOaRDBfEN+IvvXY6EN+7vvX3SREN+uKpvvvXCONI3xT:2dgxgvVJvyREKpnvo
MD5:	911EECFF48F496119302A40BBD4A24B7
SHA1:	1D0C0C1FAB96676E6F6D642350A7F8229CCCFD21
SHA-256:	E1860FB491A053511DCB794E6DBACDBBE4FAFAF5B72FAC016FE7FF8A3CDA0FAB
SHA-512:	84315C669ED55915C58B5C9E88A5F8AB880101D899326BB5DC7F569B67F605E2822C93D650D0B5A3EDA95902C1335B912B53829FD0B5D93F8753DD53E4583B0D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="TriggerType" serializeAs="String">.. <value>afterinstall</value>.. </setting>.. <setting name="IsOldActiveFeature" serializeAs="String">.. <value>False</value>.. </setting>.. </WebCompanion.UI.Properties.Settings>.. </userSettings>..</configuration>

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\fyq3btjf.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2887
Entropy (8bit):	4.248539546813047
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+0ZvEAndocLpQGntXKwEAnd3L/O:ZnvlAnIn86hhmVChNKnAAE08AndoKpnO
MD5:	14992F8FBB45E05A982A678D94C82884
SHA1:	860F065D2411A5BF9E9CD67E69072540A0A2F581
SHA-256:	F4D9D74389EC0E569EFD3823E937DCE97CAEE70846F4596365120FB9A359BAC7
SHA-512:	137EE8F86788DA2E1F5825006EA0A9FB026543820D5E3AC58F4A7CD918529E3AFBC360CE31FAD2153853500686C179A1FB9B597433A4E3E489F7FCA02D6DD4DF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\gvivsu1u.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1288
Entropy (8bit):	4.30506402449963
Encrypted:	false
SSDEEP:	24:2dFGnvHQEKpnvUxgvQ/TxDAQUv1j0cZvVXvVJvyREKpnvo:cFGnvQEAn8xgY/TV+docZtXdJYEAnw
MD5:	D1C6088A5B0C97A92D275BB8C3380007
SHA1:	9D28B1216B9A94C3386490804366E224EB10F9AE
SHA-256:	E1CB88B5FD162DB1BB5EC2A81648328BB05F8E811FB26BAD29B783C303304E44
SHA-512:	43153CC15828A5B2E61C6866DD88DA53F84EA52C031D6BBFA52B19EF1DC0F627D302343E9B98B5E1B2E7C23B9F03C5C3BED13E1E77E61EB0DABF9992A76AFDDB
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="CurrentOS" serializeAs="String">.. <value>Microsoft Windows 7 Professional Service Pack 1</value>.. </setting>.. <setting name="AfterUpdateStartCount" serializeAs="String">.. <value>1</value>.. </setting>.. <setting name="MTTimerTrigger" serializeAs="String">.. <value>Every24HoursRun</value>.. </setting>.. <setting name="TriggerType" serializeAs="String">

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\hdoy2tpb.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2630
Entropy (8bit):	4.261511082118919
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+vEAndoc0pQGntXKwEAnd3YEAnw:ZnvlAnIn86hhmVChNKnAAE8AndoRpntp
MD5:	E991C33294C923BEEAC83E577F6936F3
SHA1:	302067B553B7CCCE9A3BC74971B6A4A8B1ED7357
SHA-256:	88102329FE07B6E594A5CF9DC15A4468112A7C9368BE2DD7274B84290C8025AA
SHA-512:	52EDE93E3BD9FD08BC7D093EE97BBB755988C2A9FDF932F414C2AADE22C88C48170371DEA9DED86078857F933524EB6289F2E09D6CE2D7FCE9D5F0507FC4FAB8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\hrw05uta.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	4.2917510170176225
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+docZtXd3YEAnw:ZnvlAnIn86hhmVChNKnAAEdoMtBdAnw
MD5:	E106333FAD7343FFC316DC6D57A20DED
SHA1:	2E9CAB95C3F2F9C150BB7AAA64F46B72CC7EC554
SHA-256:	ABA1AC41297C03AB049F4AA375DD85896B0F230D6E70C1DDBDA2FF61DC1F418A
SHA-512:	01B28600A0A6BC57FA3E21840E2A2A65181DC18C27AEABB57DD48D96A7AAC56E9FDF59718CA0E4BE0C122F81B22018857EF6244266BF7F3299EA5D04ADBD1EE5
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\hzv5bafh.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1288
Entropy (8bit):	4.30506402449963
Encrypted:	false
SSDEEP:	24:2dFGnvHQEKpnvUxgvQ/TxDAQUv1j0cZvVXvVJvyREKpnvo:cFGnvQEAn8xgY/TV+docZtXdJYEAnw
MD5:	D1C6088A5B0C97A92D275BB8C3380007
SHA1:	9D28B1216B9A94C3386490804366E224EB10F9AE
SHA-256:	E1CB88B5FD162DB1BB5EC2A81648328BB05F8E811FB26BAD29B783C303304E44
SHA-512:	43153CC15828A5B2E61C6866DD88DA53F84EA52C031D6BBFA52B19EF1DC0F627D302343E9B98B5E1B2E7C23B9F03C5C3BED13E1E77E61EB0DABF9992A76AFDDB
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="CurrentOS" serializeAs="String">.. <value>Microsoft Windows 7 Professional Service Pack 1</value>.. </setting>.. <setting name="AfterUpdateStartCount" serializeAs="String">.. <value>1</value>.. </setting>.. <setting name="MTTimerTrigger" serializeAs="String">.. <value>Every24HoursRun</value>.. </setting>.. <setting name="TriggerType" serializeAs="String">

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\i32miihx.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2497
Entropy (8bit):	4.268847321532049
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+vEAndoc0tXKwEAnd3YEAnw:ZnvlAnIn86hhmVChNKnAAE8AndoRtuAd
MD5:	1734AD7C8E9269E43084761AA7879CD7
SHA1:	894514E9C8181B3DB689B091E8AF241E29C8CB14
SHA-256:	6B25EC04527AA8DD57099280DEFF617ADEF4939942D519D45F77A10A809E99EF
SHA-512:	3ECA0973F20D1B41EE4424C388A6932D6CB75508225A55ACA32E4BFC410D32215ECFE988D84F6CAE60662153DB9BBB88761A9113F3FC801FBDB068DB5FE05DCF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\iudxh05o.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2497
Entropy (8bit):	4.268847321532049
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+vEAndoc0tXKwEAnd3YEAnw:ZnvlAnIn86hhmVChNKnAAE8AndoRtuAd
MD5:	1734AD7C8E9269E43084761AA7879CD7
SHA1:	894514E9C8181B3DB689B091E8AF241E29C8CB14
SHA-256:	6B25EC04527AA8DD57099280DEFF617ADEF4939942D519D45F77A10A809E99EF
SHA-512:	3ECA0973F20D1B41EE4424C388A6932D6CB75508225A55ACA32E4BFC410D32215ECFE988D84F6CAE60662153DB9BBB88761A9113F3FC801FBDB068DB5FE05DCF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\k5nunx4g.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2497
Entropy (8bit):	4.268847321532049
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+vEAndoc0tXKwEAnd3YEAnw:ZnvlAnIn86hhmVChNKnAAE8AndoRtuAd
MD5:	1734AD7C8E9269E43084761AA7879CD7
SHA1:	894514E9C8181B3DB689B091E8AF241E29C8CB14
SHA-256:	6B25EC04527AA8DD57099280DEFF617ADEF4939942D519D45F77A10A809E99EF
SHA-512:	3ECA0973F20D1B41EE4424C388A6932D6CB75508225A55ACA32E4BFC410D32215ECFE988D84F6CAE60662153DB9BBB88761A9113F3FC801FBDB068DB5FE05DCF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\ldofyk2c.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2247
Entropy (8bit):	4.289927981293589
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+docZtXdJYEAnw:ZnvlAnIn86hhmVChNKnAAEdoMtbdAnw
MD5:	D8EA442F777FDF5FE96B5726FB123034
SHA1:	30588D1773E70D418445276B8C3D549E097C0D43
SHA-256:	832C01CDCBA9AF62BCEEDD1843A038743B2716F1D9C34CEF30C4AE8DE3883D25
SHA-512:	D5FAA2B73582218F042935A1BC09AD31CF2EA43B0106A856E9585A86CC3398B326FA8B57DA323FA283478244BEB0FADA444BDB7C60E64841CBE9EC79CC19BB00
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\m3n50oif.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1843
Entropy (8bit):	4.3072775248972395
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRLuEAY/TV+docZtXdJYEAnw:ZnvlAnIn86hhmAAEdoMtbdAnw
MD5:	B940E06E2C362B5EECDC3C034E8EE12F
SHA1:	10704BF8B1CE41CBBC20B9BC0FDDCEB5B53EB8CF
SHA-256:	8ACDBE6C2C373E19F503BC063CC9809AC69C602F189D20A0EBEE6CAA23D9DEB8
SHA-512:	4F65B938276154C875C1E1794A6DBDC10CE34972684D4949C2DDE88D9735442A19684CF303B31E5BAA03F6F48AD91EC91A06842EFA38E5A90ACEC93FE5B84C70
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="CultureOverride" serializeAs="String">..

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\pqkkvf53.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	4.325703635113229
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRLY/TV+docZtXdJYEAnw:ZnvlAnIn86hhmAEdoMtbdAnw
MD5:	64B01C16E6B526F16C3CAD4B7C0E9AB8
SHA1:	A36BDA0B6370DC4D2328B0ECE4DE381B560663B4
SHA-256:	57B948D27BEC18113C2318A63A7E05403226F758DF6DB9CFCBC042F552C50434
SHA-512:	0802D003C433338E2C29F41A9EE6D6958CDB39A76305B369657B4B1117A83125D32CA0A1D6D94B50FB0420388BE012D3344DE22ED756E83D5545B69ACA7F465D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="CurrentOS" serializeAs="String">..

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\rswovpp3.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3028
Entropy (8bit):	4.248665908414528
Encrypted:	false
SSDEEP:	48:cFGnyEAnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+0ZvEAndocLpQGntXKwEAn0:ZnjAnvlAnIn86hhmVChNKnAAE08AndoF
MD5:	E486327B479E555DF41E15386DA235D9
SHA1:	C78B76785BEFD3B1CDDD8CAA40859403470D272D
SHA-256:	CF3755DE537EAA094BDFA5573866EF9EA14237A6ED459373F39824049756BC53
SHA-512:	24928B0681D8BE0002DFAFCF7B7871044C852E32911ADD44413035E3CE0B74B43DED03847BB8D29B7BCA478D8A69C6CCD6F90CC40D5BB52EA9ADABE3B5322DC3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="IsAppRunningForTheFirstTime" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serialize

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\sjmsqgba.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2241
Entropy (8bit):	4.2917510170176225
Encrypted:	false
SSDEEP:	48:cFGnvQEAnann8xgzNhaRL2SUNhNwXnuEAY/TV+docZtXd3YEAnw:ZnvlAnIn86hhmVChNKnAAEdoMtBdAnw
MD5:	E106333FAD7343FFC316DC6D57A20DED
SHA1:	2E9CAB95C3F2F9C150BB7AAA64F46B72CC7EC554
SHA-256:	ABA1AC41297C03AB049F4AA375DD85896B0F230D6E70C1DDBDA2FF61DC1F418A
SHA-512:	01B28600A0A6BC57FA3E21840E2A2A65181DC18C27AEABB57DD48D96A7AAC56E9FDF59718CA0E4BE0C122F81B22018857EF6244266BF7F3299EA5D04ADBD1EE5
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="RunAtSystemStartup" serializeAs="String">.. <value>True</value>.. </setting>.. <setting name="UpgradeRequired" serializeAs="String">.. <value>False</value>.. </setting>.. <setting name="AppHeartbeat" serializeAs="String">.. <value>1.09:23:15</value>.. </setting>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="OriginalDefaultBrowserHomePage" serializeAs="String">.. <value>about:blank</value>.. </setting>.. <setting name="OriginalDefaultBrowserDefaultSearch" serializeAs="String">.. <value>3</value>.. </setting>.. <setting name="LastCheckedNotificationID" serializeAs="St

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\ufgpykmt.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	330
Entropy (8bit):	4.5750970925689005
Encrypted:	false
SSDEEP:	6:TMVBd1IGnOhrPOYY4RDBQ0RXKRF/+IvvX8PONI3QIT:TMHdGGnOhrOaRDBfEN+IvvXCONI3xT
MD5:	88BAC5DB79AB9307B4AECA937B6E4936
SHA1:	EFE6B00DF096EE515F1DF0689198DFDA8A7A7635
SHA-256:	ED4BB00BA1024503CBA62BC4BFEDF3DF1CEBA8C29104C6BB91772E7871771908
SHA-512:	811EF8A62C9BA3BE0E84CD9D66ABA8651F709605571E7EFD092D5F4FBBE77CD1540813B1F81D28BB85291C30F0E1EF81A16BC171CFD4368EA70249FD11D13A8A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. </WebCompanion.UI.Properties.Settings>.. </userSettings>..</configuration>

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\user.config (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	330
Entropy (8bit):	4.5750970925689005
Encrypted:	false
SSDEEP:	6:TMVBd1IGnOhrPOYY4RDBQ0RXKRF/+IvvX8PONI3QIT:TMHdGGnOhrOaRDBfEN+IvvXCONI3xT
MD5:	88BAC5DB79AB9307B4AECA937B6E4936
SHA1:	EFE6B00DF096EE515F1DF0689198DFDA8A7A7635
SHA-256:	ED4BB00BA1024503CBA62BC4BFEDF3DF1CEBA8C29104C6BB91772E7871771908
SHA-512:	811EF8A62C9BA3BE0E84CD9D66ABA8651F709605571E7EFD092D5F4FBBE77CD1540813B1F81D28BB85291C30F0E1EF81A16BC171CFD4368EA70249FD11D13A8A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. </WebCompanion.UI.Properties.Settings>.. </userSettings>..</configuration>

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\xptk20h4.newcfg

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	462
Entropy (8bit):	4.459364461536046
Encrypted:	false
SSDEEP:	12:TMHdGGnOhrOaRDBfEN+IvvXY6EN+7vvXCONI3xT:2dgxgvVJvo
MD5:	EA94CB9595ADB65764E4D641C444FF97
SHA1:	E603F3AF615BB74FDFB59F63ABF4023FB9EEECB8
SHA-256:	9B03A1514068D541D07A107ABB7C0D7CE347A32E9CED04EADCE146A2DB540907
SHA-512:	3A82173E5A53BAEA82CA77F35194462BF1AE6AFBB3F7DAC0B686C378468576C762AA0131F44E1278A55FA18A852D6E552C308632AA4EE960A7B5F8C62FA7417B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="CountryISO" serializeAs="String">.. <value>US</value>.. </setting>.. <setting name="TriggerType" serializeAs="String">.. <value>afterinstall</value>.. </setting>.. </WebCompanion.UI.Properties.Settings>.. </userSettings>..</configuration>

C:\Users\user\AppData\Local\Temp\7zS053FCFED\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	213656
Entropy (8bit):	5.7590593524797615
Encrypted:	false
SSDEEP:	3072:LK1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4Q:Ge9OAQsFtJrGPBnmIRZUL
MD5:	0CFE19791546A96C6699657A94604596
SHA1:	5D1A1B74CCA9F74FFFEBCB583661C02E4CA626DD
SHA-256:	56FDFD148F0D60805B2873A5A49739909001D11789B75DAB2B0EA8E55BC60913
SHA-512:	586CC695A2C3C03008D0A1032C221CD3384B5F4363E83C9D903753FB1DAD65B340BC8CD0659F7F891A641F8BD7535C9B889219842045854AA98CD380F0FE4AA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......... ........... ........@.. .......................@......sC....@.................................d...W........................2... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS053FCFED\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	438424
Entropy (8bit):	6.09887709092106
Encrypted:	false
SSDEEP:	6144:fHerwzLkqCG3uKWf4g6tUwoOkErUx5/Rsnaszr0tZDPEaN+YB5+GonYy:fHerIacuKUtOkESbKQrvB5+qy
MD5:	461C476F474A5F13D2EA9344AE6F70F6
SHA1:	8F74702B99F08277D4514C63956E2E69E8090073
SHA-256:	4F0EC6439B24652F16DF066F4A38B64518B5A874080EDA63DE45968545830F67
SHA-512:	E69080C205CD82EA2C056FA1328BBEC4C03CA3FDC3EE381C4FB44CB356247BE5FE4B8ADD53036DCB19CAC2C6D59B8E02F81932320EA534B5BA50DB80A0647017
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.R...........!.....t............... ........... ..............................%.....@.....................................K.......8............~...2..........x................................................ ............... ..H............text....s... ...t.................. ..`.rsrc...8............v..............@..@.reloc...............\|..............@..B........................H.......h...................X...P ......................................yK.N...f....i5.#I..xV. ..%BR..^.....t0"..z.%./.G'.j....{...2...k)w...'>.c..P..X.......n...h....E...ex..X/H].R.e.{..;&.-.'....{...."..}....V.(x.....(......}....2.{....oy...2.{....oz...B..(....&..(.......0...........oo........YE....}...............}...n...............n.......I...I...I...I...3...I...X...8D....t......{.....or...o{....ow.....+U..o\|.....{.....o....oo...o}.....o....o....t.....o....o..

C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	438936
Entropy (8bit):	6.4311342686757245
Encrypted:	false
SSDEEP:	6144:p0CMChRMg/ZytotgM7/J/NMFkl619WTRIlY57pMF9v2aiSVRlY/8a:CGhGI1Wo/J1l619WQY57pMfi8a
MD5:	A27F9713DB1688D03D2082BFA1827803
SHA1:	B8DF4649659003609419D052757166499D2322E8
SHA-256:	2F86EB0D3902A11DA1F534D9734DABAE37D33E2C57B03F968198A1CFC2E652A9
SHA-512:	F952C6792F10CB60CA3ECC00B317C33AADB65C8471D106171660EC0FCB0603C8D18B8AD2A90AACDA6581D342647290099AF0ED0FDD897EDB390D5BF9209EA905
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf.....................t.......(... ...@....@.. ....................................@..................................(..K....@...q...............2..........X'............................................... ............... ..H............text........ ...................... ..`.rsrc....q...@...r..................@..@.reloc...............~..............@..B.................(......H..................{....i...9............................................~....}.....(......su...}......(....}.....r...pz.(....r'..p.{....(......(........0..j..........{....r...pov...,.(.....+.(......r...p(......(......r...p.{....o....o.......(........sG........o......z..........UU......N.(....r...p..(.....r...p.......{...."..}.....rA..p.rS..p.(....oV...f.~....}.....(......(.....ro..pN.(....r...p..(.....0..i.......~......(....(!...,.r...p.+..(.......(j.....(...+

C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe.config

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2273
Entropy (8bit):	5.064418012146103
Encrypted:	false
SSDEEP:	48:c5+qM3DzYnwAGvSy6ZYEcCUkmPlrAn6EVr6R841docr7S3tB:jV3f84CRvur+rAN3r7sz
MD5:	E3D3AA100B93504676414B9268DFBAD4
SHA1:	A7D1E59C9D8C48DFE259D2973C13B0E2965E67AA
SHA-256:	EA7747D876307B0022F055C311C4F8F8112FDDE380E0848FD35508C00EDF8E7A
SHA-512:	9470E0B4784CE3AA94248DDBD9C17BCA988B6A680754511CBE1F1C368270F6D18C75AD1EA0F3A438CA5BB1A12E55E8745F68F2EBC9F78C68B373A6541AC9EFBE
Malicious:	true
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ProdSettings" type="System.Configuration.NameValueSectionHandler"/>.. <section name="StagingSettings" type="System.Configuration.NameValueSectionHandler"/>.. </configSections>.. <ProdSettings>.. <add key="Installer" value="https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe"/>.. <add key="WebProtectionZip" value="https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip"/>.. <add key="InstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip"/>.. <add key="WebInstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip"/>.. </ProdSettings>.. <StagingSettings>.. <add key="Installer" value="https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe"/>.. <add key="WebProtectionZip" va

C:\Users\user\AppData\Local\Temp\7zS053FCFED\de-DE\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.423116664692943
Encrypted:	false
SSDEEP:	96:5GfMjBmbsmYpthmv13DA+7ZaOrO2I72LYlty5dPolY:5GEjBmb/Ypthmd3k+7LBTUa5NolY
MD5:	A564D6AE745D289B599A010E570E609E
SHA1:	7A698D14CDAB971982B02AF5A9C49D8AEDA56A19
SHA-256:	E20A9695E1322491C57C8A0E61839E5AEEBA40F43AAB400C29F19531D18FA037
SHA-512:	2894F6832F6D20E97E18FF09780D34E7CC25074F0382742838C9A060AF7ADE3FFD3DA9F844E0475697E3854A97379F0961A7F65A1EB5F2ACBA2AF17E49D75B39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................1... ...@....... ....................................@..................................0..O....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......h-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS053FCFED\en-US\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.337584317889265
Encrypted:	false
SSDEEP:	96:tDXGBpbsiopCUoHve6v7ptEAT0VOGSxQ7F0ltEj8dPolY:trGBpbLopDoHm1MeGU8NolY
MD5:	88498F281D2BC857F09C3A0EFFE97A35
SHA1:	5560555DED4D2336EBAAC6AECBD80C2FC6F0AAE7
SHA-256:	2FBD9C10CEC246D5E6EE2F41635F283C3064773724253BAE598BFAEA735B702D
SHA-512:	2550C9C2E42E77A44520EC53418636721C3A56BE7B647C839B7A3063A9BDE4FFD304A6812F51A95DF19B1F04E05285FA9C23AF946472F07DE10F514DDB0DF9C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................N/... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0/......H........+..d...........P ..I...........................................E..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet.... .......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..............v.D\|-......."..&...'c$Q:#Uv=.9.W..Y`..[.F.^:1;jg.Jq........\.......i.......t...............z...O...L...<...5..........................E...........L...

C:\Users\user\AppData\Local\Temp\7zS053FCFED\es-ES\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.320496600456879
Encrypted:	false
SSDEEP:	96:wfMjBDbsPnpEaLv3lhC3E1Wb/xg/x9lt2EZdPolY:wEjBDbWnpEaLPlhC3fa9ZNolY
MD5:	A22C9231A5562DCA9F0BC186BDA3348D
SHA1:	D4D281A596E272A482C6917DC3CA67C150E72FCB
SHA-256:	AF899C47BDE2A325F3F9F22772F4E305F6B50EAF040670DE508226FEFBED649B
SHA-512:	C140934BF63AADB01F7C0A1A4A7E89FB7CC6DEAA5219BBCB64EB6FB9D29F8139DC4A17C990373BB008A891436BD60E8B21CF748DAB0FA263853663AD17BA9FB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@.................................<0..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p0......H........,..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS053FCFED\fr-CA\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.4162624308031155
Encrypted:	false
SSDEEP:	96:vfMjBwbssSpcuov88johXbk3LFXRq7hltE5dPolY:vEjBwbJSpcuo0aX07hM5NolY
MD5:	07759138B75C31E8E62E2DCB9E5B4121
SHA1:	C78CAC2D69DD3770256EA1D22FE62F8991AE1735
SHA-256:	460E0EA0F891B4A7D8FCF4D7C1DAF4034B1A8C01F35C55B87C4DE4D34F7E1119
SHA-512:	7089069EFBE9109ED034C9538B16F482573757A6DAED2D870CF1711F15B1F39FFFC6E5F9FF5E3380514EAFCEE49797F63DD0C9E472D37647EE3FCF34E086B189
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@..................................0..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......8-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS053FCFED\it-IT\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.05939038461759
Encrypted:	false
SSDEEP:	48:64WHsDO4eUqFAjpI1UhCvEWRCYVl6TxNLu6hxPFraKuhuXahZ439M/oKx8Welt4u:UFfAjpI1fvC6StPPtM+7tlth8tdPolY
MD5:	320A49D5E8C225BF7D8C8FC8F0FBA1FE
SHA1:	6986D89BABDB474B16E3074865EEDFFCCECC9337
SHA-256:	53F48BF5DEB5FB756EB61D5EE78BB72EF4509ADB396EB40BEF9671ECAA8D9819
SHA-512:	6EC2883F6542F8EA3966F367E11359B3702B8E8E01FAFA3D3828E16D216CC77CC71B92BB1BFBC0C7F146C79FB4DBEE5FAD84288DFE1C5979F0C59841B92F03D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................n,... ...@....... ....................................@..................................,..W....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P,......H........(..d...........P ..`...........................................\..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&#Uv=.9.W.F.^:1;j........a.......J...'...........(...............p.......E...........{...........b.......B...O............B.T.N._.C.L.O.S.E......

C:\Users\user\AppData\Local\Temp\7zS053FCFED\ja-JP\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.697358912630535
Encrypted:	false
SSDEEP:	96:KsC3ASpa3kvBYTnRDzIWI2dPRp0QltdHmdPolY:KsOASpa3kpXoR+Q1GNolY
MD5:	442654050F5E5EBFB286C75A6AD10485
SHA1:	7F9AB13C925DDDE3ADE1EBA334DD17F6BF341F7A
SHA-256:	B85CC7BA82B58AFD8FA00DFCCD820B5B34BC14A942EBDAB5380FCE8F7257C0AE
SHA-512:	E7F9F728603091728451127C02B1F8412C741C57C5ADFED91FECA37989C07570886ACA262ECBDB17A968474E05936C3485602115CBC26EDCEE65DD7764B76795
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................-... ...@....... ....................................@..................................-..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H....... *..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\7zS053FCFED\pt-BR\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.272201212454418
Encrypted:	false
SSDEEP:	96:afMjBsbswapvL6vu1667y4UNGaB3q4kUO6ltMNdPolY:aEjBsb9apvL6ms67yJ3hUNNolY
MD5:	01CCD85F0676258B5E4A223832E3258C
SHA1:	630CD9F369A81A7823905FD842FDDEEFAF23D3A1
SHA-256:	C482D074CFDA0B6921A6750F0CCC1279BA6FCFB9D2037CA6EAAF704D8DAF811F
SHA-512:	1BB2DB0ABF3E0BCA3B131D2DF5329006A56E3FAA4E540621E54AA98DBB0BF4E27093314B477AA66E4F10FE0AF5DF1887FF23CAD938C5B0F98E455433E14FAD01
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......\|,..d...........P ..,...........................................(..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS053FCFED\ru-RU\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.608207837862824
Encrypted:	false
SSDEEP:	96:41fMjBGbsSopXm7vGQdkxbdV2UCwbT+T/UA7+1styo36glt55odPolY:eEjBGbbopXm7eXxbWqExi1splHoNolY
MD5:	F2876EC061D1CC88E44104ED97FC36F8
SHA1:	68BFE2A32CA14B0C379EF725E426AB2FED09E075
SHA-256:	6071DAA27880FE3F6B9FB704890250CA655CAFE832A1B9A4E59F0CFFFB042E04
SHA-512:	E3DD2BAAB3C5AFB124DC9CC0BB2D9318D33707732B4F23C211C2E3BC5A8A8889FAF42003857DA98D43DD7F7368CAFB3A02591BE04DCA4E1343A00283CA071DB6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................3... ...@....... ....................................@..................................3..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H.......L0..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS053FCFED\tr-TR\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.204809000235561
Encrypted:	false
SSDEEP:	48:6teH9O4G6ULy3ABApQe1eBpQvu18JvLh4jK0YuPx4S8zqeelt4833PPbknI5Klfy:TsC3AWpt1eYvJgjKZSJltkFdPolY
MD5:	D0009577C38F3338B2A3DCCEE9DF5169
SHA1:	D567D95A61B57885B55D7D70B93BC839EF162436
SHA-256:	598BAD964E2BED4A4EDAFAC5E8838C7B922C6EBBFBA70EDA0D400E543B91E54B
SHA-512:	95F766F541CA5EFC74C3DCC9D5C299798B581F1B302A4EFFDCA9B7ED4177DAF4E8547B7729DB724EB0A8A28C9770FC470BF9BDF2C616F70782DC96056CF8410E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................,... ...@....... ....................................@.................................<,..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p,......H........(..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\7zS053FCFED\zh-CHS\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.582926268925439
Encrypted:	false
SSDEEP:	96:vsC3AjpTfYGvqLH+/WZGrlqlt9kdPolY:vsOAjpTfxyb+/gGJq1kNolY
MD5:	322549094C487E49ACEB9899419D8EC6
SHA1:	DD0E5FF6BC3E4590203829DA1BB8BD7B00CBD07E
SHA-256:	7824381C18E86E72C0D4A8BB0ED377DFDB6E3B5374984ED67AF119B14268E70D
SHA-512:	80747F72196406993110D0DB5B736BCA21975C26615D34F771042E69CA0D519ED80C0E9267A90517A5B9862AB44CF9F9D96C354E952CB9CB0C32EB4887F80A1C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................+... ...@....... ....................................@.................................t+..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........(..h...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\WcInstaller.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	ASCII text, with very long lines (881), with CRLF line terminators
Category:	dropped
Size (bytes):	4415
Entropy (8bit):	5.336254700026213
Encrypted:	false
SSDEEP:	96:D8tAPy4Cul++ztbDks8Vb8tAnSnWASC0ewMfq:DEAKKs+JbJ8VbEAtASCjVq
MD5:	F90D2B3852FF272104445B7F4C524906
SHA1:	8C40D834943F6DFC3C6A79F1F21341F8FF431E3D
SHA-256:	CF823712C4B93F9CF5F55C25CE9C053243D1B3E00B3B6998D11ADB332B37772F
SHA-512:	4F85818CB05AB7B4F4F3BCE2850DB594F4B5A52146CF132D271D861DED8F76A47C52A5788C99CB4783056116876E651044BC37946E6818A27FAE4C781583A463
Malicious:	false
Preview:	Detecting windows culture..Preparing request for featureflag: {"Geo":"GB","Partner":"IN240402","Campaign":"20541619131","InstallDate":"20240701","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}..Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\"}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklist\", \"WhiteList\": \"https://a

C:\Users\user\AppData\Local\Temp\WebCompanion.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	10494317
Entropy (8bit):	7.994463819622281
Encrypted:	true
SSDEEP:	196608:pKZsrAth9Vrdx45WtQbJtXWYxEwsOOXd/XUCv1uGJONYTr9udX6:U+rWVBx3WX7EJONION6f
MD5:	C0A2AAF917E6BC1D951EC481213D4138
SHA1:	56308BC1CF014F507E161B518736CD3D3666387D
SHA-256:	2F87DCD36A114502A3C80ECF8A8C5F5EF60475951F9C142A1A68BDEC6CAA3E23
SHA-512:	43EF07470F33BA0FF6A18E343C55ADAF0CDB2B88C3B37FA53F32608F1F78B6266BFACD2BB3BD92BF56EB0E28C4C20278212E06C1873DEA9098ECE5CDB117B9BC
Malicious:	false
Preview:	PK.........%.X....FF...$......Application/7za.exe.yxTE.8\|{I.YH'@CX.V[..%CP.4h_.MnCG@DQ..h..... .`'..\[...u..yg....QGY\........{..d.....S.......~.}y...N.:u..S.NU...`.......k....~.......e..o.`.......[`._..]U..g.s...?..~..J..:.~.s.t.}..q.>}2l.....u.....#.Y..Mt}.......6z......{.:.:.y^KW.]....ys."..Nu.........C.EB..$..P.k......s.(..zN..K.........iH..Z.....[..x.P.7.iB.6..Ta.,..I...#....g.r...<.wg.....zb......QUw..M.:...L...nHN..r...]#..TA.r...vO..5.'.:B]..p}<.lxU... ...6...........?i...o...g..7H...%E_..B...d.... .f.].&I..Q..G.S..x.o.K......../.~...g.Q_..^(..h^...Dq.J\Y2.....&...........Fo`...........}....98E'..Kne+c........._./..o.o.+g.z..M.6.....D.D.^I9..!..0HJ..?h.7..2"U.;...RY..=b..k.^y....0.l...m...h..9.........f....J-N..KU....HH."......Y...I)8..=s>.)MPH!.L....e...J..`bc(.:.-M=}...v...=..9.:..u.7.X.O...T..%e.)V...rS..s....o...[1.C... ...x7g)P..:............8. .u...lv-a..MB.TyW..D..p$..0.x>..'..K..l./g..U......b{.!_...,....<.....$#zh.e....+.

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\7za.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468120
Entropy (8bit):	6.230465006320667
Encrypted:	false
SSDEEP:	6144:6511bCALveDe7tEw0IN3q1If9wZfgomh8wuAf4CBxrzBOVzZNkcI1FPjTI6e36bo:811bCALveK7ddN3cEBfXBxBOVzwbyr
MD5:	7BE563AC01DDE847D6837D38575CEA85
SHA1:	DDE7F95BAAF3ADA2BBB56ABFEFB426CFE8012EC3
SHA-256:	6ACE813AAAE0D754B92C31178564623045B12A4F239BBC075270DB3D97F0FF2D
SHA-512:	39C5D7FD0D6B5AE29CD3CC9A572A1D4828883615E7A46383CF53EE3E10EB5BCF79E72467D687061AF6FB6929D7F116990FF66D2DA14F41617F4A5E0B96446FF1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........j.[...[...[...-.y.Z...-...P...[.......-.j.....-.i.T...@.Z...-.x.Z...-.\|.Z...Rich[...................PE..d...p.mZ..........#..........N................@..............................@.......K......................................................D...x....0..........X_.......2...........................................................................................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..X_.......`..................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUEngineS.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3327712
Entropy (8bit):	6.604048850412333
Encrypted:	false
SSDEEP:	49152:Ty9jC5327LeAyDW06K6mBzsITo59wpGlU+2StoJrtf5inkD:TyjO32fyDW0Gm5sIToTwYTghV
MD5:	AFCCE3F23C9C31DE19A91FC7D436A516
SHA1:	D97D9EADB7A4C76800BF651E768DDB6DACC52132
SHA-256:	4055E2A085F44DBCD464983F9316E5A33B5056AF8ABED05FD4DFEBFDE162DD77
SHA-512:	346B1CCBC8F517B310EEB439BC642916F1DB06B4719A3BA902321ED7DCEB9138C4A3AA652C757CA733492FC3DBDA9DEA4EF8E444142EAE3853DDA9DB1264855A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........M..#...#...#.......#..l..#.."..#.kD..#.kD...#.kD..#.......#..l..#...#...#.......#..."...#..l..b.#..l..#..l..#.......#..l..#.Rich..#.................PE..L....r.U...........!......&.........y.........&.............................. 3.......3...@.........................../.f.......T.... 0.............H.2..2...00.......&.8....................8,.....H8,.@.............&.`............................text...7.&.......&................. ..`.rdata..6=....&..>....&.............@..@.data...d.... /......./.............@....tls..........0......./.............@....rsrc........ 0......./.............@..@.reloc..,....00......./.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	727704
Entropy (8bit):	6.430104685419753
Encrypted:	false
SSDEEP:	12288:MOtZcbZXzrsk548VyK8SbMAfQBM6LDkzOZYv3JSGeizoyDB2:MOrcbZT8AYBpLMO8SGHoy92
MD5:	79AAF194177DC418CFB4D94AF29CDD2A
SHA1:	47F5A7BFF8939355F0614D510D1F7A86F90A384B
SHA-256:	6327ED564E521BB91791EEE54D7C18699BE1DE77DB2B9D6DCDD6FB7077CACB39
SHA-512:	3043E92830F890365F2A57D913AC21239DEF4CBA68B455C82C40214B90F480156258623988375DA03018A741F3DE11F2CF038D6F4F8020CD2785BCC95B5977E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........P...>...>...>.mG....>..!....>..!..t.>..!....>.......>...>...>.......>...?.*.>.1.....>.1.....>.1.....>......>.1.....>.Rich..>.........................PE..L.....U...........!.....J..........`........`...............................`.......(....@..........................:.......-..x....0...................2...@...f...b..8........................... z..@............`..,............................text...LI.......J.................. ..`.rdata.......`.......N..............@..@.data........@.......,..............@....rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\DotNetZip.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	470680
Entropy (8bit):	6.847590570660933
Encrypted:	false
SSDEEP:	6144:mRYYIiJaeEWfTXQyu8+yi4ZiwAEsFdnQ6uw2lQc2RGtSV41OJDsTDDr1LUe6GNxF:mF9agBr6ilLS4msT1oe6kf+8f
MD5:	31DF678850DC2B26BCE81EED9FA7462F
SHA1:	4A4BEB1D217876AF95A5C4254643AECB38302B83
SHA-256:	E813D2EE40FB1A403454A96592609E1250A6913F46E948DBAAD47F7760F99B07
SHA-512:	3E5CE2396779D3AFFAC5A64C173BA62D2611D85FEC1EC7AE13D7B1677503D3C9419FBBF378F8B2AC9BC64E36C664A64B913E4634A278CFEAE0412E5D818968C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q..Z.........." ..0.................. ... ....... .......................`.......m....@.....................................O.... ...................2...@......d................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......@.................../............................................{...."..}.......(......0..F.......s....%r...po.....{.........(<...o....r...po.....\|....( ...o....&o!......0...........s"......o#...(.....0.............{......E............,.......8...D...+Q..{..........+M..{.......+A..{..........+2..{.......+&..{.......+...{..........+.r...ps$...z.6..oh...(......(....*....0..a.......s....%.\|..........o!...o....r...po.....{.........(<...o....r...po.....\|....r#..p

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Esent.Interop.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	407704
Entropy (8bit):	5.969566547979302
Encrypted:	false
SSDEEP:	6144:s8ASBEKZNe2+6QfeFlrd+jkg3yX285iS/377gckFMW1zU72JlHwt8p30HK4:uqlR/xTim3IcI/74
MD5:	82DDB49786F2DFD246BCADDB37F333AF
SHA1:	2B8CC4ADFF7D432B9DDD10633F2801D0D77C7FB3
SHA-256:	8A1F31AF32246A7BAFBF80A6FF78DDD0403F2FFC575E36BFB57EC58407755898
SHA-512:	A53EBC2C1D420E2DC45FE8F0C541E2C464C20A97AEF13A4D272DAA5C7806578504E6CFB6C1DC362F937D9ADBA65B6327B9A861E64C093C3FF72C836081072BA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....RhW.........." ..0.................. ... ....... .......................`......@>....@.................................\...O.... ...................2...@......$................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........<6..........................................................&.(......*..( .........(!.....f..s".........sH...(.......0..'.......~.........(#...t............(...+...3...0..'.......~.........(%...t............(...+...3..~...........R.(......o....(....&Z.(........o....(....&N.(.....o....(....&...0...........(......o....(.....+..R.(......o....(....&N.(.....o....(....&N.(.....o....(....&N.(.....o....(....&R.(......o....(....&*....0.. ........(........s&

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Extension\@wcextensionff.xpi

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	59316
Entropy (8bit):	7.880293608811765
Encrypted:	false
SSDEEP:	1536:+HPkHMRS54xpdWi9qHkDcTYPkvPkMPkY6qh:GPksRgkdWi9q6cTYPkvPkMPkY6E
MD5:	8DA01C7329C1AF3202D93C8631E0DF35
SHA1:	38F1E5DD6CBB577249C676127BC9565B70F78760
SHA-256:	A30D0AA074214F7C6D8E82FE36E6EA4FC17C95F6C772C11D03667911C0475A03
SHA-512:	2103ECB37B02C74D51C6C85CBE05A073FFD5860F8644AD54ADB212C690EDF8FE732EA784BA7CECB93DA2022A93B135DDC9E2BBC8DF26AE798CB6F28E2AAE4F7C
Malicious:	false
Preview:	PK........hq'H.\|b.....K.......META-INF/mozilla.rsa.WgT.k.&..B3H/.Ho_.Mz..........A..A...H...R.H.D@P..).T...^.]..w..={....o..w...<s. .i.(..:.]j..8.@'...$. ........@...$..o.(.........$#.....0..'bc......:r.....b..!...hv...P"..x.g....:....n......c+.......!.;...sL@.;;.q.Hc{wog.=....;@.....D<~.D06.6vvx..(.W4Q..#Z...3E..#..P."xW.._._..xa.X....-....q......#(s.....74....;..\|.....1 CP..p.6.8.........~..L....x.#..h&...+2..`.}=............."%....$G.)..0.d.=.O?....%.....1@m.7.5...a..KX.z..s.}..g.......4.K..N.......%t.....'..-...._$....W.1X'.X.........OF.`]P.'._...S.t}G....kv.o...kEj.^.)gf.p.Dn9u ....M.>...x..u...`.P$xb}~)....k6..o:......j..k....Si.!.D.\.SF....<.d.'..,..Vf...<@M...M<.FEv...l......$U&\|YwF.'s1..\W..Il5+./.#.......Bk..&\|\|v~../.Jd..W1.j:c.:..s....-..V....?.?.q+.2...N......el.J.5.......='..C.@...W..>gX...k....6.w.4{.2<..W%.Zq-..f.?+d...3.}..#%L.{.P.\|.qXk..d.*...hf..Z.{.y=w..l..-.f..M...G.5..N.=m..Mb.....?..1......H@..G.qa(.........g..0.

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureComponent.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	153752
Entropy (8bit):	5.950777892934322
Encrypted:	false
SSDEEP:	3072:/dbds0zUe6StgUR9x719hVqVOT+tJZ67g5hNusMb50ftbeyMSXFHuRKxbJA:5zdYfZ6E523b2jhxbJA
MD5:	76F9FF88BFAB074CF3657E8CD007C858
SHA1:	06DA56379C0819CC2A46E7A60DE79C00F1CF2956
SHA-256:	42087B3045C86316D2B85FA23466A0BB84935B52D0537D9B2A6C857DEC4EDA38
SHA-512:	74A2EA1008318629A9E275360BDEDDF23AD375B8B1D0CFD8C9D064ACD0CBBF1A06F124AF1003ADF523F7CFE1D1B2944B6033E9287B86CECA7C3220A8801BEC4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...E..f.........." ..0..............=... ...@....... ...............................T....@..................................<..O....@...............&...2...`.......;............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H.......(...XP...........................................................0..w........(.......s....(......s....(......s....(......s....(......s....(......s....(......s....(......s....(......(......(.......0..A........~..........( .....~.........,.s.............,..(!.....~.....+.............#,........{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}.......0......

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38040
Entropy (8bit):	6.414082820659246
Encrypted:	false
SSDEEP:	768:EVZGowHeRqzHSyxdy9jjUmZnZAG9gKxnVbiY6XR2AMxkEh:8QHHby9HUm19gKxncVyx1
MD5:	70F3C5BB9046EDB9EE0BA0CDF63698DF
SHA1:	668FE7B271F7D214C5F43E11239542195C0BE42C
SHA-256:	8EB6D08CCDF88ACC4F7DE252779565A93BB57379591275EF3FA0C33303C60C0E
SHA-512:	21B661B45AE9FF914FDCAD4414647068F9CD7547E1FAF27B54577B6E9A61EC13F79F4CAA9E953AE7EE605C2DCDA3637928E3D12044F9D487324385388E2B4CF2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf.................X...........w... ........@.. ..............................g.....@..................................w..W....................b...2..........Lv............................................... ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............`..............@..B.................w......H........:..D<......D....................................................(.........0..L........~............-2...~....%...(......s..................-..(........~.....+...........0.......0..M........~....r...p.(....o......o.....o......o....s......rO..po.....~....r[..po.....~.....(....(.........s.............0...........~.....~......r...p..(.....r...p...........r...p...............{.....$......( ....r9..p.(!......(_...&......~....rY..p..(......o"..................\i......

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureInstaller.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1617
Entropy (8bit):	5.077080334485434
Encrypted:	false
SSDEEP:	24:Jdz9pjmhCroMF4nH6t0mTY1itwwAmTykmugP2q5BZCdbF/TECJs/B:35pCQroG4HzmTmv9mTM2qfZibFLvs/B
MD5:	64B56E0401F35D30E7E33D3FE11DB9EA
SHA1:	5044DF80FDEE343072FBCF3CE5479007934E86A6
SHA-256:	77348A27DB6505DCC962A97A60C8AFC4F3BBAA4D1C485616407700F6BA901379
SHA-512:	0A65D8D2BCDA66B524248C1641D9D7269FEBA30BA523F3EEEF4E0D95E9183CCB410580BD8F0C6FF7A0A836DE8596C2599E0E9C3979CA219EC093BF0EDE1C90CB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />.. </configSections>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/>.. </startup>.. Log4Net configuration settings-->.. <log4net>.. <appender name="InstallerLogger" type="log4net.Appender.RollingFileAppender">.. <param name="File" value="${PROGRAMDATA}\Lavasoft\Web Companion\Logs\Webcompanion\featureinstaller.log"/>.. WinXP path to webcompanion.log-->.. <param name="File" value="${allusersprofile}\Application Data\Lavasoft\Web Companion\Logs\Webcompanion\featureinstaller.log"/>.. <lockingModel type="log4net.Appender.FileAppender+MinimalLock" />.. <appendToFile value="true" />.. <rollingStyle value="Size" />.. <maxSizeRollBackups value="2" />.. <maximumFileSize value="10MB" />..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	128152
Entropy (8bit):	5.838957515264787
Encrypted:	false
SSDEEP:	1536:56curewfYgn8zop8SOjXCE9aWUDYv0+gDRU/WZ9jdNmri6XLQq8vX7gggKxncVhc:55cewfh63XCE96Dz+gi2ZdN4bQxkJKAK
MD5:	73C88C57F2F5B51E11870044FD31417F
SHA1:	F52D7D44B2E606F95717D126FC67AF61A0013DA7
SHA-256:	B762BA799CFCFB150B32EBC388008CF706F004344DF06C1BE94B2A25C8AAB706
SHA-512:	66F2C2CD4BEE1CE4D7A8248132C15F237FE8FDCE34E4AB589C074B6DDD6CC15B4D709649106489CD790E198971520FEA33DE7412227755EE9B8D23657DB9C966
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf............................^.... ........@.. ....................... ............@.....................................W........................2........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................@.......H........................................................................0...........{.....+.."..}....N..(........(.......0.............+....0...........r...p.+....0...........r...p.+....0...........{.....+.."..}.....0...........{.....+.."..}......#.....@.@s....}.....s....}.....(..........0..Z........#.....@.@s....}.....s....}.....(.........-,...(....(.......(....(.....~....r+..po..........0..0........{.........(....t......\|......(...+..........-.*.0..0........{..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\FeatureMainComponent.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1878
Entropy (8bit):	5.100849686967453
Encrypted:	false
SSDEEP:	48:c5pCQromkxHCm1L5xm1dOvF2qfZibFL4sxkA:xQrP4iAYo09bFbB
MD5:	568B93BE462E5660BDB8E9CFAE715B4D
SHA1:	8403F0F7C8E3C30E829C7D3AE5B4D8452B4BBDBC
SHA-256:	CF8F505544E172B3A91138D2FA71A8B3CAA2B5296B500275AC50406D2B116593
SHA-512:	20C550CE847C60EFB35A5CFE3EA0B49B983F7F16809B7734766B7083487B911911649DE2384E719D846D4E93D62CEE77120DF0DDD28DAD1E1DB4C9CEE3A5E398
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />.. </configSections>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0"/>.. </startup>.. Log4Net configuration settings-->.. <log4net>.. <appender name="SearchLogger" type="log4net.Appender.RollingFileAppender">.. <param name="File" value="${LOCALAPPDATA}\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log"/>.. -->.. WinXP path to webcompanion.log-->.. .. <param name="File" value="${userprofile}\Local Settings\Application Data\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log"/>-->.. <param name="File" value="${LOCALAPPDATA}\Lavasoft\Search\Logs\search.log" />.. WinXP path to webcompanion.log-->.. <param name="File" value="${allusersprofile}\Application Data\Lava

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	213656
Entropy (8bit):	5.759197415071508
Encrypted:	false
SSDEEP:	3072:6K1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4f:He9OAQsFtJrGPBnmIRZfR
MD5:	BEB11BF49E70F87B3DFC3B5A51266E48
SHA1:	927B448F4D02CDE7920B2EA2417C4D4784C00A91
SHA-256:	CB51D070C1E2BDE393F2A65DB17E872C395B55D0E3C47E5CCE49A8A1ED4D69FB
SHA-512:	9B70E5ACABBFFC58BFAC5C310DDF1BAED4290753859BA05B4386F71989E59A821A3341DDF6C1D3DF3D37D92D9A58CB37A306FD82996525140D0490B184356DD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......... ........... ........@.. .......................@.......i....@.................................d...W........................2... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.IWshRuntimeLibrary.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62104
Entropy (8bit):	5.454463973112162
Encrypted:	false
SSDEEP:	1536:TL9nVJEetVDUxSp1K2z9IDd3gNggKxncVExk:TRVJEMVDqMK2z9IDdQNJK2
MD5:	AAEBD8816C4A3FC26D5C4FA227EE565C
SHA1:	D8BE7A9A4A7A6E93115F9E59B06304C316725E3A
SHA-256:	10C6C4B9A94318C4244EC36A0F211D965B10661B0BC76339067AAFB866F115FD
SHA-512:	1E44E09B136EF0DC0BCF6E0CE0EB390D4F5A04C82772584F9A1E5F71A33AFE71DC0A8F4043696D1C8933DECD42C33F146C327AA28FFC3E2E05901F944889BCA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3%DY...........!......... ......>.... ........@.. ....................................@....................................O........................2........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.SHDocVw.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	168600
Entropy (8bit):	5.540872765142166
Encrypted:	false
SSDEEP:	3072:KadMZC3fkpOTItC3MhmLwF62I5IfO9cjSBgn2FUraJYv+NMzCRw3mVE7KZo/ud8T:KadMZC3fkpOTItC3MhmLwF6n5IfO9cjH
MD5:	13B7DF28C5A1AB4CE8A4F134536B199B
SHA1:	E68ED9BC5EDBD93DF887451997EC6A895223F278
SHA-256:	4FEE0445681126072E816607FB4CF351FBC61E85F02D543808F27A9D1B10F7A5
SHA-512:	48BA18744A80B125DFEF66573D3EE92290807FB882BDBD85421396727F1725983DB179B83D00417AC9A3E5FAEC906766ADDA6C6F02532800F8C301DB5148F267
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....`S...........!.....0... .......C... ...`....@.. ....................................@.................................dC..W....`..h............`...2........................................................... ............... ..H............text....#... ...0.................. ..`.rsrc...h....`.......@..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.Shell32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62104
Entropy (8bit):	5.379455142488048
Encrypted:	false
SSDEEP:	768:nexl81nX6ZxlvUAa7KoBv7epginbCe7AXjuw9tL0Duxj7tr+BrIxFSaKgKxnVbiS:nexl81nK34PJepgqcVzAaKgKxnchouxQ
MD5:	EE8EE543588B987699DC972027F7C86C
SHA1:	2EC907821BE8E74843D4BD8812BE06B7507044B1
SHA-256:	7443EC0A10F409C82FD578237E3D7588E9F9A66E8531A1A27822B7BDE5E8BEC8
SHA-512:	D2EF6BAF1AE008F8D920F70E0AE36875D260D8585A5F748876E5FE6C33A7E464911BDDFEF47BABC4C8F9F5C6BEA967945E252020ACB7A134B8F2FF5BDEEB5C8B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A.ST...........!......... ........... ........@.. ....................................@....................................O.......h................2........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Interop.WUApiLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	98968
Entropy (8bit):	5.704472845164016
Encrypted:	false
SSDEEP:	1536:afutksUQDy4qJgax0L4zP+YuqLSTL/SiEDx4l3Ow6OhtgKxnchax7:DQw3ax0L4D+YZLS3/SiEq+wjhKKx
MD5:	4215D01742208923F6E34DD7C9925146
SHA1:	2A8028355527F6B57A3244DC53BBE713272BF37B
SHA-256:	D30B1F5D425A96EB2E6597BA7EECD22D69D211D3BC7732520F3B5AF493D08883
SHA-512:	6DC3EED141B44CA8E3E7521C61FE26E331091E11CAD01D414947ADBDC1AAB6726ECDE31F7C91C602F236D8ACD940CE6C64E3E050959C69655E7D29CE5BEEAE41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..O...........!..... ... ......^7... ...@....@.. ..............................?.....@..................................7..K....@..p............P...2...`....................................................... ............... ..H............text...d.... ... .................. ..`.rsrc...p....@.......0..............@..@.reloc.......`.......@..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Ionic.Zip.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	475288
Entropy (8bit):	6.8391854074922325
Encrypted:	false
SSDEEP:	6144:GeSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IYp8:TJBdBS4msNUCe65frHMnz2R9b8
MD5:	AE643BD347EB6BF2E3AA05608924782B
SHA1:	C46380BB4C5DFEB71F36B57A59DFA51F672FC015
SHA-256:	2CB3DD4E6CD2BD6DC4AAEEB48CE47BB5CE3E2C67C040AFF388E9165E655B06A2
SHA-512:	4ADBC05558FC0D34AE30240699F63B7C15894D408D3F3B28F37072558BCAEDBBF4E8C61E2B42F3BFF3B610F9F4F2EBDFEFCCAAFB768733965E2C104ADB88E8A3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=N...........!................N#... ...@....@.. ....................................@.................................."..O....@..P................2...`......."............................................... ............... ..H............text...T.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................0#......H.......0U..l...........P%.../..P ......................................6..`N.?O...%.C.k_..d...I......5a.......9x......R...gg8...JM...`.[. .o..eE1$_.M.h.q.oz..1..........@....s.c/J..wk.D.....t..&...(.......0..2........r...p(....}.......}"....(........(.........(......r...p(....}.......}"....(........(......0..j.........o....-..s#...+..}......(......(......}.....(....s....}......}......}......(......%-.&r...p}......j(#...rr!..p.{.....{.....B...(....*..0..A........{..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\LZ4.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52376
Entropy (8bit):	6.313605075997683
Encrypted:	false
SSDEEP:	768:o4JxKxYIP7NGp4mbOLfjz+xEqDAXjIXamgKxnVbiY6XeWAMxkEZ:mxY67NYofjzr6QyamgKxncVXxt
MD5:	F287BD9842FAD68FF76401B8EBCEAAF9
SHA1:	B159A3B2BD59AF0B6E839F456576ECB91EDB82B2
SHA-256:	6847B8BDDA0921D065FE3AFD544C58326D3B1FF7A54F386A66B05A1EBB11D008
SHA-512:	438290C97E9A5E0E4503228F8E411DE7FE138B57D2AE7E6767478B0FDAD75A30E0FEE1B8C719CD4CC885D762E9B876CD9EC98C5CEC4EB27BD5201A5F840EB7FA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......V...........!..................... ........... ....................................@....................................S........................2........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........f...H..........................................................6.. ....[X..X...0..t........J./....i.YT.J-....T.-.r...ps....z..2...JX..i1.r...ps....z..J./.....i..YT.-.r}..ps....z...2.....JX..i1.r...ps....z..-..s....z>.......X..c.6......X..b`.z......X..b`...X...b`...X...b`....0..@.............X..b`...X...b`...X...b`.......X..b`...X...b`...X...b`...a.0.............n...X.n.b`...X.n..b`...X.n..b`...X.n. b`...X.n.(b`...X.n.0b`...X.n.8b`....n...X.n.b`...X.n..b`...

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.AppCore.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	121496
Entropy (8bit):	5.954904755326082
Encrypted:	false
SSDEEP:	3072:TFwKZCLT2UDvIYjfrtlFfyUSt29I9Thu4jtYxptHhGrKj:T2LICBbVo295/j
MD5:	CFECEE7A0DCFB3FA24CF1927562A6ACF
SHA1:	7FA9E9275EFEC1B7A139E612B916884C18B20CDC
SHA-256:	890F09A222B8A6E2F70035B8BEA140965C67B974D1ACE67252FE58518F6E587E
SHA-512:	97241F04D7811303E1F92728D3A191825818BC6EEC24AC095F627672EBCC16286E820041D40556D1D8EC1F9F3AF93E25A6A78049A2D0A373B799C4C9E9E3B724
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!..................... ........... ...................................@.................................H...S.......H................2........................................................... ............... ..H............text........ ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B........................H.......L....3...........................................................0..[.......r...p.....r+..p.....rY..p.....r...p.....r...p.....r...p.....r...p.....r/..p.....rC..p.......0..........re..p.....r...p.....r...p.....r...p.....r...p.....rE..p.....rq..p.....r...p.....r...p.....r...p.....r'..p.....rQ..p.....ry..p.....r...p.....r...p.....r...p.....r3..p.....rm..p.....r...p.....r...p.........0..........r...p.....r...p.....r3..p. ...rW..p.!...r...p."...r...p.#...r...p.$...r...p.

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24216
Entropy (8bit):	6.711341797319052
Encrypted:	false
SSDEEP:	384:rKTXEKq7Aa6WZS3l9q1vdv4p+LPv41OEFP27xWkVbiWgpQ6XWYr4gAM+o/8E9VFO:eTXEK8Aa6WZS3l4hbLPvGOgKxnVbiY64
MD5:	54363548D20A294E99DAF257775422B3
SHA1:	F1CD70D2DC3B6E402C4CFDB73FF255E50D544599
SHA-256:	8831E4B77776CCBBB917EB6BC8A24D52A842EB1E85B8522F888C6E0A0F994577
SHA-512:	2B42A89390CE062E86C68360E8BAC79582B3EEEBD1C4D79FA67E0A935E3E34328DBE12E4F3D6AB60790FEE2A2FC35987F766FEFF034E5825E2B43E44F1DE7F78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..0.."..........BA... ...`....... ....................................@..................................@..O....`..(............,...2...........?............................................... ............... ..H............text...H!... ...".................. ..`.rsrc...(....`.......$..............@..@.reloc.............................@..B................$A......H.......l..L............................................................0..r........r...p...o.....+?..(.......(.........,(..r...p(........,...(.......o....(.........(....-...........o.........+.............L[.......0..j........r...p...o.....+7..(.......r...p(......,...(.......-.r...p+.r...p(........(....-...........o.........+.............DS.......0..]........r...p......+A......(...........,(..r...p(........,...(.......o....(.........X....i2....+...*....0..w........r...p..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Events.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	140440
Entropy (8bit):	6.04633699081881
Encrypted:	false
SSDEEP:	3072:/6DoLrAcIAW4ifEUkgpbDmEJjLiQybZXMmpoKC:/XLrA4OJb0LC
MD5:	6BC835697A34037CF6AB77089EE5910A
SHA1:	7F97D93CB024507C03E13CDFABD2E61DADA6DFBB
SHA-256:	2CF1F139036C9160A2ACDFBE48A47A6D7B4BAAABE5EF66BA102402DDB066B0FB
SHA-512:	87C0AFED8A7BD2BBC91ABD915C5E2E83CA46E30FDAAC903E91201369AA4FEE50DD694A1628975DAC9D011855A7C13A655A2D0521B40F50414DC685FF79E3A560
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...6.`e...........!..0.................. ... ....... .......................`....... ....@.................................0...O.... ...................2...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................d.......H.......t....w...........................................................0..=........(....-..#(....r...p(....+...(....r...p(......rA..p(.....+......0...........(....rg..p(.....+......0..'.........(.......rq..p.(....(.......(.....+....0.............(.......(......(...........(...........+.....................0..5.........(....(......,.(....(....(...........o....(..................."#.......0..<.........(....(....-.(....(....+....,.(....(..........ru..p.s....z........,-..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38552
Entropy (8bit):	6.475600972363831
Encrypted:	false
SSDEEP:	768:is3+Ri5DCowECTXMdWmarOgKxnVbiY6XmgAMxkEo:/DwHXMdW1OgKxncVVx8
MD5:	D155DFD9F27E340FB3E47D28159E02F2
SHA1:	85AB8C8F2284F69378660F96E09F774A36AD4149
SHA-256:	BCCDA5DB0D6EF7B99533E209C7CE3FFE2706D96AFEE79EAEA957470AB77E8E84
SHA-512:	B337B685205AF08FF7F9E3D2A96A91095FE93CE6FADEABBE1309185CE1A59B229D3A48B59694CCE1558581340409B046512B40F311F7F6CE122524AA9F8C2163
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..0..\..........>z... ........... ...............................@....@..................................y..O....................d...2...........x............................................... ............... ..H............text...DZ... ...\.................. ..`.rsrc................^..............@..@.reloc...............b..............@..B................ z......H.......`6..TB.........................................................."..}......{...."..}......{...."..}......{....".(.......{...."..}......{...."..}......{...."..}......{...."..}......{...."..}........0..h..............%.r...p.(....s.........%.r...p.(....s.........%.r#..p.(....s.........%.r3..p.(....s..........+....{...."..}......{...."..}......{...."..}......0..Q..............%.rK..p.(....s.........%.rQ..p.(....s.........%.rg..p.(....s..........+..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22680
Entropy (8bit):	6.735595760443843
Encrypted:	false
SSDEEP:	384:pZy6clyR4MRpEFP27xWkVbiWgpQ6LWj5j8uV5AM+o/8E9VF0NyTd6l:zyZi4CpgKxnVbiY6Lyjl5AMxkE2
MD5:	889D4B9110F1071E52A6F4B8F2013CFF
SHA1:	C9C1A3FA499E584A3B5E82500A95FF71FC51927F
SHA-256:	C8D28B60DE8663606C96F845E487625CFA0B477E695F0B8D1A1D131F8FB1365F
SHA-512:	FC8B589C98C721AD94B0EA74AE1B61444F8F417D208F5C5724C1D45B2C3ED32CAB025855990759474C0CD7FC798610990392A2899BD4ACF590A6D537AD02FAB8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..0..............<... ...@....... ..............................\.....@.................................D<..O....@...............&...2...`.......;............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B................x<......H.......h(..............................................................~.~....}.....(.......r...p}......~....}.....(.......r...p.(....}......~....}.....(.........(....}.....0...........~....}.....(......re..p...o.....+)..(.......rg..p..(......(....(....(........(....-...........o.......o......o.....Yo.......}...........!.6W.......0..H..........{....s.......(.........,..o........ ..~....r{..p.o....(....o .......*....................&'. .....0...........s!......{....s.....

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	111256
Entropy (8bit):	6.0975365699819
Encrypted:	false
SSDEEP:	1536:c8xZ7Y57qcDoJPiFVInZz6bRNxPtgYxy2RWaiZBgKxnch5xP:cSqUdamnZ2bvxPtTxkJZeK6
MD5:	F25ADFA3039A29EDB5CB74189904F788
SHA1:	C23B88625C2615A15E08838FD74181A280CF786C
SHA-256:	927F01C4E87CE5398EAB9A16AFB46D0FFA4D7D3ECE446925C79C5CCA112CA7F9
SHA-512:	0AD529A688FFA6299C7A80F05C31CB31F330C707C2EBC06D9389F65787618606C1C919C84CC8508D2A355DC6DF017A6023A52D6673AB439910EBDDC348CA771B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Y.d...........!..0..x..........N.... ........... ...............................2....@.....................................O........................2.......................................................... ............... ..H............text...Tw... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B................0.......H........................................................................{&.....{'...V.((.....}&.....}'......0..C........u........6.,0()....{&....{&...o...,.(+....{'....{'...o,...+..+... .... )UU.Z()....{&...o-...X )UU.Z(+....{'...o....X.0..b........r...p......%..{&......%q.........-.&.+.......o/....%..{'......%q.........-.&.+.......o/....(0.....{1.....{2...V.((.....}1.....}2....0..C........u........6.,0()....{1....{1...o...,.(+....{2....{2...o,...+..+... .z0 )U

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.Service.Logger.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.998429326508991
Encrypted:	false
SSDEEP:	384:AHr7WMSXEQjEFP27xWkVbiWgpQ6LW4bI5AM+o/8E9VF0NyWnS:AHvWLHjgKxnVbiY6L25AMxkEn
MD5:	85334FA251984BF8873312E39BB68E62
SHA1:	1C8A9970C11688D4B6B62A60E6223E1F1214685F
SHA-256:	66FCD5153259C5716C5C958ABF0A4DAB9BA54F43DF0CD4FDA51AA41109CC682C
SHA-512:	CC34C4E764038946B39332CF4E8C609E9352C95BF113DA15886859BFBB3579F44DEA1BCD30C70C6E37E05A18AE8EB22536F190598B1974EBAAACDA99BD9A2DA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c.........." ..0..............-... ...@....... ....................................@.................................@-..O....@...................2...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................t-......H........!...............................................................0............#(....r...p(.....(....t.....s......r...po......o.....s.......o.......o.......o.......o......r...po.......o.......o......o......o.....o.....s........o......o......o......o....~ ...o!......o"....*.0............#(....r...p(.....(....t.....s......r...po......o.....s.......o.......o.......o.......o......r...po.......o.......o......o......o.....o.....s........o......o......o......o....~ ...o!.....

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WcfService.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51864
Entropy (8bit):	6.017774621384859
Encrypted:	false
SSDEEP:	768:4zTB3gIpk2sa3ahh4RWvuQLT7lyKEU2gKxnVbiY6X8fAMxkEXRq:hIWPaKzJuQLT7lyKT2gKxncVmx1q
MD5:	8147DAF75043B9A3BD64149393723D62
SHA1:	5B70613448E5A4785C64F79FB2B64EACBA1E6306
SHA-256:	C04E6F1E73AFE7E899BD07DA5B90E228613460C24CF46D3216284385383B8302
SHA-512:	0A3C7013A3731002E377F88663980FA93FDC434331E4D7439DF075E9C81DC3EA283D626A752753016471E7AC0660A62F41349DB1F282AC3764F2625331D9466E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c.........." ..0.............v.... ........... ...............................E....@.................................$...O........................2.......................................................... ............... ..H............text...\|.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................X.......H.......$P...]...........................................................0..@.......r...p.......(..........(....(..............~....ri..p.o.................).......0..b..........~.....{.....sT.......o]......@..~....r...p.o....(....o....... ..~....r...p.o....(....o.................. !. ........ A. .....0............sx...%.o'...od....%.o)...of....%.o+...oh....%.o-...oj....%.o/...ol....%.o1...on....%.o3...op....%.o5...or...........~....r...p.(....o..........+..*...........st..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27800
Entropy (8bit):	6.483968913488964
Encrypted:	false
SSDEEP:	768:VruIAfU0dOKwbfvXoCWgKxnVbiY6X4P/AMxkEX:BxZb3TWgKxncV4nxD
MD5:	C9C20C3BF61369B86CD3C573ADA5D2F5
SHA1:	8ABF0BE8A5D8FC55A26B79A95ED3DBC1BD2F54B4
SHA-256:	BA14CF85D8E7D1DF09ED0E3CF90E5DDF399DD5C320FA9F743AE4B8AC91EE81DA
SHA-512:	B3688E8D70D9A0F218FB0019D783F69B9A4BE442DD46B0337344D3AF6F9233C24E6B691E8B98C7836401B76DCEF09F687CF7B7DCCED803FE93D3082D421AA4BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......^.........."...0.............BL... ...`....@.. ....................................@..................................K..O....`..$............:...2...........J............................................... ............... ..H............text...H,... ...................... ..`.rsrc...$....`.......0..............@..@.reloc...............8..............@..B................$L......H........)..4 ...........J...............................................0..k.........}.....(.......~....r...po......(.....~....r?..po....... ..~....rw..p.o....(....o........~....r...po..............+:. ....r.(..........(....(.............0..v........~....r...po......~....%-.&~..........s....%.....s....(......{.........,5.~....rE..po......{....o.....~....rm..po.......}.......2...(..........s....}....~....r...po.....r...ps.....~....r...p.o....r)..p( ...o.....s!....~....r=..p

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2379
Entropy (8bit):	4.811294024220937
Encrypted:	false
SSDEEP:	48:cjkJnVUn1YNfN+QscuysXDXgFT05hh1A5Xw:7JVUn1YNfN+QscuFXDwFTa1ug
MD5:	AED25C4BB45D63F367AC309DA2D91716
SHA1:	295F9441CE64D87BC5489F2D5609E7704E302827
SHA-256:	534FF170605C383FA723B662E49DAF7683C560727FD71211B28799C5A6AF11AF
SHA-512:	AD144C6152BD8FABCC89FF502595281298C3857A8F2193F6B391ED7E137FA4B2A9E0FFCCD17C9C4FD5A691407D32339B4348B5FAF260DCDB5D2D0E6A63B5FDDD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <system.serviceModel>.. <services>.. <service behaviorConfiguration="SearchProtectServiceBehavior".. name="Lavasoft.SearchProtect.WcfService.SerchProtectSearvice1">.. <endpoint address="" binding="wsHttpBinding" contract="Lavasoft.SearchProtect.WcfService.IWCAssistantService" />.. <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />.. <host>.. <baseAddresses>.. <add baseAddress="http://localhost:8733/SPServiceLibrary" />.. </baseAddresses>.. </host>.. </service>.. </services>.. <behaviors>.. <serviceBehaviors>.. <behavior name="SearchProtectServiceBehavior">.. <serviceMetadata httpGetEnabled="true" httpsGetEnabled="True"/>.. <serviceDebug includeExceptionDetailInFaults="False"/>.. </behavior>.. </serviceBehaviors>.. </behaviors>.. <diagnostics wmiProviderEnabled="true">..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Microsoft.mshtml.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8020632
Entropy (8bit):	5.079590028245353
Encrypted:	false
SSDEEP:	98304:Kpkg8hn8KiyAB84gPjKVuH62NhND7BMe8Al2:Kpkg8hn8hStD7BMe8Al2
MD5:	44F7CC8195F6AF6FDDB80259B7B8E6A1
SHA1:	1B3D2ACD4AC727D38A43D037F85373B91CD017DF
SHA-256:	96470B2993C840B990280863A8252AAF98859B9D2787F7C6D502F7CAFBD147A8
SHA-512:	3386C82933EF043325CA20418B32DD026C94BF3EDF3597815F939721052E77F06FFCBEC07DF0CC05CDA5CDE258B28EF16D4B623802E9DE585EAD076EFB2988E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....OR...........!......z.. ........z.. ... z....@. .......................`z......O{...@...................................z.S.... z.x............0z..2...@z...................................................... ............... ..H............text...4.y.. ....z................. ..`.rsrc...x.... z.......z.............@..@.reloc.......@z...... z.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\MozCompressor.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67224
Entropy (8bit):	6.501240336592439
Encrypted:	false
SSDEEP:	768:NrBX7I72YM1scqDAntonP1ZlojsSQobxM9gKxnVbiY6LgLAMxkEO:Nrd7IkYd3on2gKxnchGxy
MD5:	E870DBF328208ACA0FED55F8B4FB1063
SHA1:	41957F491B48944995B4491404A086524552D122
SHA-256:	E41D0BF274D8DE7FB27F74F90EB64AC1D51F546077F2A0A88FCBCD1FDE3D2EA2
SHA-512:	FF16FB50BF44CE3A86FC12DF642E6F47E4F99B0AB9002F86EF26CE8235A71DB5F56FE9B5D82136E1D75D129E3B140D5FB1723C1CECB019435CB39BDACE04308E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,z..B)..B)..B)z.C(..B)...)..B)z.G(..B)z.F(..B)..B)..B).C(..B)..C)..B)O.G(..B)O.B(..B)O..)..B)O.@(..B)Rich..B)................PE..L...F.KZ...........!.....4..........{B.......P............................... .......n....@.........................0...d.......x........................2...........Q..T............................R..@............P...............Q..H............text....2.......4.................. ..`.rdata..$....P.......8..............@..@.data...$...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\NCalc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	207512
Entropy (8bit):	5.669275424210413
Encrypted:	false
SSDEEP:	3072:d2iAvFOaMDARsHHAgJo2MXfFPM5aLo9CRNxbOnDPAqKq:d2fgkRaHAgi2Cfu5aLo9CRNVxq
MD5:	E02C25D09249C0F78AFAE770C029FA35
SHA1:	355B632F2EDDD1DEC8C4F16DD50575341B1CC870
SHA-256:	155704F831D99316B0E23F3AE15E31C49BAEF2C4C8744C0F81DA67515ACEC264
SHA-512:	98E0470E91B644AE63B3A1C83B77FE742934325B8BBA110E78958BBF3372C05FC78AFA2070110D2C536A9CFF9E7D9132E3286A2D8763A3C0A54B5267E493D2D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....bxN........... ................j.... ... ....@.. .......................`.......q..........................................L.... ...................2...@......................................................x................ ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................H.......8....f............................................................(.....0../........(.......s....(......s......r...po......}...........0...........{.....8..........."..}.......2.r...ps....z....0..K..........o=...(......(....r]..po....&..o?...(......(....rc..po....&..oA...(.....*......0-............o....(......o......E....................s.......]...G...............1.......9...#...O...e...{...8.....(....ri..po....&8v....(....rs..po....&8`....(....r{..po....&8J....(....r...

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	438424
Entropy (8bit):	6.099063757183566
Encrypted:	false
SSDEEP:	6144:+HerwzLkqCG3uKWf4g6tUwoOkErUx5/Rsnaszr0tZDPEaN+YB5+GonXA0:+HerIacuKUtOkESbKQrvB5+J7
MD5:	6E5C9F66BA81FE1BBD9BC1F74EAC4C3F
SHA1:	A086B924140D48669EA4D68F9F71629795A4638D
SHA-256:	19EDF009DED32747460C806EC42CB3E04AFC24397C8FA6E9F8C26C0D03292C48
SHA-512:	A4023F8C61D08AAA01D61F0CA7B9646322712539B170FAB01036809D4E35B660C2793DC01F4861884C15ACE8B381EA9B3DAB07A42A21C928F9F46D5EF136A99E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.R...........!.....t............... ........... ..............................c.....@.....................................K.......8............~...2..........x................................................ ............... ..H............text....s... ...t.................. ..`.rsrc...8............v..............@..@.reloc...............\|..............@..B........................H.......h...................X...P ......................................yK.N...f....i5.#I..xV. ..%BR..^.....t0"..z.%./.G'.j....{...2...k)w...'>.c..P..X.......n...h....E...ex..X/H].R.e.{..;&.-.'....{...."..}....V.(x.....(......}....2.{....oy...2.{....oz...B..(....&..(.......0...........oo........YE....}...............}...n...............n.......I...I...I...I...3...I...X...8D....t......{.....or...o{....ow.....+U..o\|.....{.....o....oo...o}.....o....o....t.....o....o..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\System.Data.SQLite.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	291480
Entropy (8bit):	5.944129679767434
Encrypted:	false
SSDEEP:	6144:kjM6Mb15iJrFxrFPs2FNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFM:kj0h56rtFNFaFeFOFwcGF6cmFWc0FWcg
MD5:	B2736D639E98021B4B881A7B7DA8EB1B
SHA1:	4C8C87206CCFA086BFFC5BD667315CD895020705
SHA-256:	7CE90C260FE55275BC91B53A4C01F50CCD6A699C31D220CC83F6B02F92839F65
SHA-512:	2CB512CBF004830F05A474AC6A8DD9FCD7CE0B1BF63BCEAC9A155D7ADD689433A0FAF35A6B25C1F228D0A198F28655941D596A359D6BD5DD9051261A0BD77810
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....*S...........!......... ......~.... ...@....@.. ...................................@.................................0...K....@.. ............@...2...`.......-............................................... ............... ..H............text........ ...................... ..`.rsrc... ....@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20120
Entropy (8bit):	6.867536676562829
Encrypted:	false
SSDEEP:	384:99kPqoBU9pvGgEFP27xWkVbiWgpQ6XWup1TAM+o/8E9VF0Nyx79yH:mCvGggKxnVbiY6XtHTAMxkE9o
MD5:	CA7DF7439BB05F2D852763C8CB20D437
SHA1:	AD89C046334F4FED467B759AD1941C3B7345EF91
SHA-256:	FF30E447B72C73BE124C568D193FB2BA7B198BDBC6599CEA2D74E1FEF29F2C18
SHA-512:	C2332E0A70700F677146C079F8FBA491C035A449399B789AECB2F4B1BA79BD57A979C27C68495005B58C7ACBF60A9E80E7211D5789C7907AA05FB96504D37B0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf.............................0... ...@....@.. ..............................H.....@................................../..K....@..p................2...`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B.................0......H........"..............("..............................................b..}.....(.......(..........0..,.........,..{.......+.....-...{....o........(......0............s....}.....s....}.....{.....o......{.....o......{.....o......{....r...po......{....r)..po......{....rA..po......{.....o......(..............{........{......o.....b..}.....( ......(..............(!....."...s"...}.....{....o#....:..{....o$......0..,.........,..{.......+.....-...{....o........(%....*f..s&...

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceHost.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2177
Entropy (8bit):	4.77577567843961
Encrypted:	false
SSDEEP:	24:2djGDUh25l/NxHASwK+T092ABuAdvQZ6MrSjKzcbQc205HB7NFzcx5H3mF:cj4UUl/NfN+QscuyMrsgFT05hh1A5Xw
MD5:	CF5C8A12D79B486D540EE53E8DA1EEE5
SHA1:	0692CF2872874077EE0140ABEEF1FEF47A2D58EE
SHA-256:	7B6F09D3D9F858FC6C32F513C6C509AA6AE524EDB67F88AFAF4E0E3A32647211
SHA-512:	2E1A7E2D910E47BBD1CDCC64765256261398AD09A45A293685A05E5E6978E13A3215501CC0C9F22B381B05D6561880984BDDEA112E9491F04FA181435863EE96
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <system.serviceModel>.. <services>.. <service behaviorConfiguration="VPNServiceBehavior".. name="VPNService.WCF.VPNServiceWCF">.. <endpoint address="" binding="wsHttpBinding" contract="VPNService.WCF.IVPNServiceWCF" />.. <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />.. <host>.. <baseAddresses>.. <add baseAddress="http://localhost:8080/VPNServiceLibrary" />.. </baseAddresses>.. </host>.. </service>.. </services>.. <behaviors>.. <serviceBehaviors>.. <behavior name="VPNServiceBehavior">.. <serviceMetadata httpGetEnabled="true" httpsGetEnabled="True"/>.. <serviceDebug includeExceptionDetailInFaults="False"/>.. </behavior>.. </serviceBehaviors>.. </behaviors>.. <diagnostics wmiProviderEnabled="true">.. <messageLogging.. logEntireMessage="true".. logMal

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceWCF.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25240
Entropy (8bit):	6.721008504937299
Encrypted:	false
SSDEEP:	384:THUNSRmj4lKH2YiuV4jzFe+TNZ9VEW5PWpNYGEFP27xWkVbiWgpQ6LWH59q8uAMB:sbkl9X4HYGgKxnVbiY6LS1uAMxkEy0
MD5:	A4D1FAE5A89A07B67AE5A9BE1A023F63
SHA1:	92FAC1095796332B4E5B61889C5F5B8CFBF21042
SHA-256:	84645C23850CF91868E11495992A7E25A28A6983468CC7A0AAE8B8CE460CDA0F
SHA-512:	083E90FD3267DE400696E7354710027DA20D21258A53C7C447B6BC1AC6963D61238D63984F69F7552A407F3A36FF989AC03DA9BCFDE4836BF5B33DA815EA7FCF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!..0..(...........G... ...`....... ..............................r)....@..................................G..O....`...............0...2..........hF............................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc..............................@..B.................G......H........(...............................................................0...........~....}.....(........(....}.....{...........s....o......{...........s....o......{...........s....o......{...........s....o......{...........s....o......{...........s ...o!.....{...........s"...o#.....{...........s$...o%.....{...........s&...o'.....{...........s(...o).....{...........s...o+.....{...........s,...o-.....{...........s....o/.....s0...}.........r...p.o1...(2...(........*...A.......

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\VPNServiceWCF.dll.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	4.675475405551473
Encrypted:	false
SSDEEP:	48:cbxDr9elo9BrDAPU+QscuyMrsXET05th2FA5Zw:2Dr9elo9BDAPU+QscuJriETaSFua
MD5:	131DBF313C113D66099122EACDCBD509
SHA1:	40DE4B97E0D29445E929B90686B45DA684E9C831
SHA-256:	36783FFEAFB4D74DA7AA36D22EA13977A915E8A72138F6EA78799689C2C2E8C7
SHA-512:	FA8B3B9939AF5E17436FA2F2F8337808C9EC991B3B01C2F6B70B7FF29E3B1AC1D7C1FA46AFDB1550BF4985781DEDD5D50588F57E6D06DBDEF2C178062F775FD0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <system.serviceModel>.. <services>.. <service behaviorConfiguration="Metadata" name="VPNService.WCF.VPNServiceWCF">.. <endpoint address="" binding="wsHttpBinding" contract="VPNService.WCF.IVPNServiceWCF">.. <identity>.. <dns value="localhost" />.. </identity>.. </endpoint>.. <endpoint address="mex" binding="mexHttpBinding" name="mex" contract="IMetadataExchange" />.. <host>.. <baseAddresses>.. <add baseAddress="http://localhost:8080/VPNServiceLibrary" />.. </baseAddresses>.. </host>.. </service>.. </services>.. <behaviors>.. <serviceBehaviors>.. <behavior name="Metadata">.. To avoid disclosing metadata information, .. set the values below to false before deployment -->.. <serviceMetadata httpGetEnabled="True" httpsGetEnabled="True" />.. To receive exception de

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	438936
Entropy (8bit):	6.431072177972185
Encrypted:	false
SSDEEP:	6144:J0CMChRMg/ZytotgM7/J/NMFkl619WTRIlY57pMF9v2aiSVRlY/TQ:iGhGI1Wo/J1l619WQY57pMfiTQ
MD5:	4F1EB4C0E63D9694BE953730AD4845EF
SHA1:	8E1EA5AF4C32B7D4BD0C325DFF1EA19473B5E715
SHA-256:	E6A43148E49377C134FF7241F35E72F0ABA4FF1B163C6C263767A4890638B648
SHA-512:	51D8F0F398C4FB22A54D9E0FAAACA7237219C50EED715BD895FF26B921624C2C74D528BD0761A1C42DAA6A9B306CBDB13607189008F223961DB611BAD2114081
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf.....................t.......(... ...@....@.. ....................................@..................................(..K....@...q...............2..........X'............................................... ............... ..H............text........ ...................... ..`.rsrc....q...@...r..................@..@.reloc...............~..............@..B.................(......H..................{....i...9............................................~....}.....(......su...}......(....}.....r...pz.(....r'..p.{....(......(........0..j..........{....r...pov...,.(.....+.(......r...p(......(......r...p.{....o....o.......(........sG........o......z..........UU......N.(....r...p..(.....r...p.......{...."..}.....rA..p.rS..p.(....oV...f.~....}.....(......(.....ro..pN.(....r...p..(.....0..i.......~......(....(!...,.r...p.+..(.......(j.....(...+

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2273
Entropy (8bit):	5.064418012146103
Encrypted:	false
SSDEEP:	48:c5+qM3DzYnwAGvSy6ZYEcCUkmPlrAn6EVr6R841docr7S3tB:jV3f84CRvur+rAN3r7sz
MD5:	E3D3AA100B93504676414B9268DFBAD4
SHA1:	A7D1E59C9D8C48DFE259D2973C13B0E2965E67AA
SHA-256:	EA7747D876307B0022F055C311C4F8F8112FDDE380E0848FD35508C00EDF8E7A
SHA-512:	9470E0B4784CE3AA94248DDBD9C17BCA988B6A680754511CBE1F1C368270F6D18C75AD1EA0F3A438CA5BB1A12E55E8745F68F2EBC9F78C68B373A6541AC9EFBE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ProdSettings" type="System.Configuration.NameValueSectionHandler"/>.. <section name="StagingSettings" type="System.Configuration.NameValueSectionHandler"/>.. </configSections>.. <ProdSettings>.. <add key="Installer" value="https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe"/>.. <add key="WebProtectionZip" value="https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip"/>.. <add key="InstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip"/>.. <add key="WebInstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip"/>.. </ProdSettings>.. <StagingSettings>.. <add key="Installer" value="https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe"/>.. <add key="WebProtectionZip" va

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion-Installer.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	MSVC program database ver 7.00, 512*1555 bytes
Category:	dropped
Size (bytes):	796160
Entropy (8bit):	4.472739024336664
Encrypted:	false
SSDEEP:	6144:0AXkQJm7it4FJmAKygsqGkMRLIGy74dQyV1qyPo/Igq+a3VVcdrm:egKgq+aI
MD5:	0B5BA91226D6A36D32D908C30C704AC9
SHA1:	516FCA28866D9D0162AD1812A05550814DD7157B
SHA-256:	557582D4E75A8EEFBA8B25B6314586F7D0F8C187E4804A0F336FE5D8A889B51A
SHA-512:	D6FFF9B2A7EF224A157BB9FFF2881EAB34FEE86BB8C2D5490AE35A1E5047182FCF3A7F74F92F25F473F8F75FD61091278B0A1916105A3956B6A7F5D7ADA3D30B
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................8..................................?....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3429528
Entropy (8bit):	7.376686439720565
Encrypted:	false
SSDEEP:	98304:0pUEN0DGl8ItJvcdLDKEu5v365hiz2Jh33GS0:FEPl8kJkdPdI365hiz2Jh33GS0
MD5:	D5180525E08932A69DD1903AB30313EF
SHA1:	4A7981B66FE6185177DE6D001AD9CE77D2A437EC
SHA-256:	38B605A45B286C4827327BC6E10D08AFC71E5DD8D2C9B4F717B1D8039E0F92C8
SHA-512:	EE7324000ACAEF8C40E5F8D9397FE5A1CEAC5A4888808A33758A350FA9AB2783D8421164E8DE34E61C74CB1E013F0B3E0CD777B54BFA2E97877DEC9F3F1E5B4A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf..................3..l........3.. ....3...@.. ........................4.......4...@...................................3.W.....3.4i..........."4..2...`4...................................................... ............... ..H............text.....3.. ....3................. ..`.rsrc...4i....3..j....3.............@..@.reloc.......`4...... 4.............@..B..................3.....H.......P...X.......p...p....4)..........................................0.............-.&(A...+.&+.....0...........{.....-.&.+..+.....0.............-.&&+.}....+.....0...........{.....-.&.+..+.....0.............-.&&+.}....+.....0...........{.....-.&.+..+.....0.............-.&&+.}....+.....0.............,.&(A...+.&+.....0...........{.....-.&.+..+.....0.............-.&&+.}....+.....0...........{.....-.&.+..+.....0.............-.&&+.}....+.....0...........{.....-.&.+

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12157
Entropy (8bit):	4.849332911344261
Encrypted:	false
SSDEEP:	192:urBZ8HDg7wlXUjrFknBUrqPFUvurGMNpo:u9Z88loI
MD5:	CD4E494E258C7EB0585FE76EBE9E6233
SHA1:	E93EB57E6C38E496FDA92DBCB31021B34AE47CFE
SHA-256:	BF61730717F05B95C4F43D425B6D7D15DEAC39D53E28EB302E5723C7A9B7B0B2
SHA-512:	413B3727A71126E3F35551232607D95F8BD79342526C0144CBCA929E6DD3E65AAB56B2D1F37BAAFAD53EA23DCA4C55BDD363CD45D0C54792C3118726EA45C07C
Malicious:	true
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="WebCompanion.UI.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false"/>.. <section name="Companion.UI.Properties.Settings" type="System.Configuration.ClientSettingsSection, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false"/>.. </sectionGroup>.. <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net"/>.. </configSections>.. <userSettings>.. <WebCompanion.UI.Properties.Settings>.. <setting name="Culture" serializeAs="String">..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionIcon.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	24337
Entropy (8bit):	4.401590449138391
Encrypted:	false
SSDEEP:	384:Zw3ziy+PnXdyyyyyyTOh3axqTS1mH3dS4w:Zw3zeG3DSG3m
MD5:	1DD04466644E96E0AD308D1E637E9621
SHA1:	0C7F688CA482FCD1FC9AA7D7518A5BC844875CFF
SHA-256:	9733ED5E1E2CAEB0986F1D46A052B2D4BD8CD6B041B9F57216F12410605E8455
SHA-512:	A92FF0A1B92B5B689BFC36A807F02D79B8DC3DD99971B3528AAFCEB8C1FC2DBC67BD170990723B34B26AC4EE7516EFA6B218C2ED1D422A422EDE7CF5FB9A3DA1
Malicious:	false
Preview:	............ .h...V......... ......... .... .....F...00.... ..%............ .{....D..(....... ..... ..........................................................................................................................................................................q...q...p...p...............................................s...o...p.`.p...h.............P.................................r...u...p...p...n.9...A...............................................~.w...o...r.................k...............................0.........p...x.....................#.....................................}...~.............................................K...........................................:...............................................................................h...................................................V.......'...............................................................................................................................W...^...^...^...^...^...^...^...^...^..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionIcon_Pro.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel
Category:	dropped
Size (bytes):	25507
Entropy (8bit):	4.77281362097441
Encrypted:	false
SSDEEP:	384:1oj8TMvkKFye5lBIt3ZH6X5HT8hfbzuX98q1Kk:9MM0s3hGHqzueqMk
MD5:	BBD842A6E91D908141DE6FA59D3A9868
SHA1:	3F387A45C09CC3894A6475C711C943EA3F70ED6F
SHA-256:	D5A8246EF2075DAD3B3D582477CF757FE673A3A793EF3DE60DE82BF8581DA19F
SHA-512:	F130188D69710DEBB2BBFB122C0BBBCF21F7356820226B0D8A668BF965B909C8F24DCEB2E75FF98E70ED02115903AC461D10BD3835632BF9D7A325C9610F0A13
Malicious:	false
Preview:	............ .h...V......... ......... .... .....F...00.... ..%............ ......D..(....... ..... ................................................................................................................................................................................................................................................\.....\|.........\...5...................................................9...+.........................................T.....y...........................?...............................-...............................y...................................................................O.......................F...........................................!...............................................................`...............c...................................................0.......#.......................................................o...................................................................K...U...^...^...^...^...^...^...^...^...^..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WpfAnimatedGif.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	55448
Entropy (8bit):	6.378132102326271
Encrypted:	false
SSDEEP:	1536:NoT+q4mcxbjbFBvID66ycTZ9QK6KgKxnchFtxN:aS4cxXbO6kTR6nKgZ
MD5:	91381174E820AD6FB21809F793E6C3B1
SHA1:	289BF23E55769127999B76FDBF6241E74E14F3C9
SHA-256:	B4E332F2897D24706627E50638D51019200AB9DD1491C4FF5299555987F2276D
SHA-512:	00612D762078A5D6A72F0386625F4AFFB5834771462883389B14C58B8437340E62FAD35EF9DD84514F9CBF688AD55B0B33B1377A972A719FE22B556541D0724D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=..........." ..0.................. ........... ....................................@.................................j...O.......$................2..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B........................H........H...p............................................................{......{....V.(......}......}.......0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....... ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....( ......0..2..........(....~.......o!...-.~.....s"...%.o#.....o$...&*...0..A..........(....~.......o!...,)..o%..., .o&...-.~.....o'

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\acs17.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1155736
Entropy (8bit):	4.990603774465486
Encrypted:	false
SSDEEP:	12288:QcLFGWXuQlDlaMqzegia2lKF2Y52eDzl1DoDzmbPXJ:QOGWXu6oMqzeu2l452eDzl1DoDKLXJ
MD5:	56732B85F3168BA6852CD1EAC84164B0
SHA1:	D79F2928261AF58C123FF0D06102C8685EF2997E
SHA-256:	AAAF2F91C0F5172AFBCF15D9F06A706BB23FBBEA40361F64E8552A7D7C96F62D
SHA-512:	469A9049296AF662491BFB659FCBE176C8CF8BA20D1F8F961CAC9B2F260E33B5BB12FE6489CCA9DCFF292EA624323A49BC5F3901BCC0D6A5FB2288083BEDDB99
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v...%...%...%...$...%...$...%...$...%...$...%...$...%...%D..%...$...%...$...%..d%...%...$...%Rich...%........PE..d...{.p].........." ................X................................................U....`....................................................d.......<.......D....p...2..........0...8...........................p................................................textbssMH...............................text...1....`...................... ..`.rdata.............................@..@.data................D..............@....pdata...............R..............@..@.idata.../.......0..................@..@.msvcjmcr............N..............@....00cfg...............P..............@..@.rsrc...<............R..............@..@.reloc..W............X..............@..B................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	6.957794693806253
Encrypted:	false
SSDEEP:	384:GEjBmDYnhmN30IREFP27xWkVbiWgpQ6XWsY+glAM+o/8E9VF0Ny5z:RjBmDYnMN30IRgKxnVbiY6XqlAMxkEz
MD5:	6DBBB2A0C6222BAB74E1F52EC15C3F99
SHA1:	FABCF88E65B1561474C8955A41CABCD869E6C36D
SHA-256:	9883F5D9372B4690C80B341CEE226DC659C117275FD7743D38160211100F2CB4
SHA-512:	67E5D17DF894C82A46569EC0CEEBEFF40378BB5C5A90772FB8A4F9EDC5A460B311760BF6C2777C24FFA78D97D0B135448C781E97A361787B760686DA85B4C0C2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................1... ...@....... ...............................&....@..................................0..O....@...................2...`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......h-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\de-DE\WebCompanion.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38040
Entropy (8bit):	6.438766694974508
Encrypted:	false
SSDEEP:	768:N2KY1jNy0nJWam99DqDc/eaNxwjGZgpU3lX37Wasi8HMmrG6iOe0qZPOgKxnVbim:N2Ewq7WamHl+xhOgKxnchGixI
MD5:	B96A395E6BC64D4EF8A6CBA31A3572E9
SHA1:	83BF4BA87D70E4708FC03A91D5EA09623ED933D8
SHA-256:	8C6B95B5BD3C22EBA6477D7D2606D1893611D65053987FBBC39ABC0EBC07FF24
SHA-512:	38762BBA33D28D98F513A0BF5285339E5B5D5F84F624F2CAB066469B139994F314A4F8916DA0A8388F50B548EC681656AE30FEF30CD2D8572BFA4A6D6713C9C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.....Z..........ny... ........@.. ..............................eo....@..................................y..S....................b...2...........y............................................... ............... ..H............text...tY... ...Z.................. ..`.rsrc................\..............@..@.reloc...............`..............@..B................Py......H.......P ..............8$...T..........................................BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3..................................................................h.................5.....P.0...........................1..............).........9....!....A....................#...#.1...+.C...3.Z...;.l...C.............8.......................................P......<Module

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19096
Entropy (8bit):	6.98331230121635
Encrypted:	false
SSDEEP:	384:sCBpHoBoHveLb8EFP27xWkVbiWgpQ6XWaprsAM+o/8E9VF0NyCN:zBpHoBUWLb8gKxnVbiY6XRrsAMxkE2
MD5:	D1E4959C3F775726A58F6E2BCEFD1E4D
SHA1:	A1E5F2E003602A3DEAFD54934325A1F4BAE18EA3
SHA-256:	5FF96A4E1A751C8A7F3946620E2DA9DA39AE4488D52B24005EAAD3252C0345B3
SHA-512:	8F4E85D21B829442B8D54D57B4C3A941F6B93980AB336897427BEE99C00214E36216F9F3BA37F53A3229EDFAAEC06805C4C9B057FE4AEDC6991B45B2C00FFC45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................N/... ...@....... ..............................^.....@................................../..K....@...................2...`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0/......H........+..d...........P ..I...........................................E..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet.... .......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..............v.D\|-......."..&...'c$Q:#Uv=.9.W..Y`..[.F.^:1;jg.Jq........\.......i.......t...............z...O...L...<...5..........................E...........L...

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\en-US\WebCompanion.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37528
Entropy (8bit):	6.47747706671224
Encrypted:	false
SSDEEP:	768:ybKe8FNh8ZMgKBq9VYlqmriDnCimBtpW/RnW+e2f/292tgKxnVbiY6XeoAMxkEA:ybZmoCSRnW+egO92tgKxncVFxM
MD5:	1BEAC1AC18586D4B65FD22EA620BC272
SHA1:	BC2B9F26C1DC6AC21FB0A9D4D7EE46EED8DABCF9
SHA-256:	F6EBAEACC4FF1EC5AFC6ACEAF8D0C9A5E83926C003C87172076A80AC0A0B2DB8
SHA-512:	211248B3C42A4D4BB2B33B7BC316BE350C6FC333BC024D99A4783565E4F53F1B5416DAE439C9584B86E2F222DA4B74038EBB99FA61456E402F11D6FAC3C1AFE7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.....X...........w... ........@.. ..............................w.....@..................................w..K....................`...2...........w............................................... ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................w......H.......P ..............8$..hS..........................................BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3..................................................................h.................5.....P.0...........................1..............).........9....!....A....................#...#.1...+.C...3.Z...;.l...C.............8.......................................P......<Module

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	6.928513863961498
Encrypted:	false
SSDEEP:	384:nEjBD6naaLu3fOUgEFP27xWkVbiWgpQ6LWvXoAM+o/8E9VF0NyddtZ:EjBD6naCuWUggKxnVbiY6LeoAMxkE5tZ
MD5:	A7A345273E3B888A8D56787D59B198FD
SHA1:	6527DD9F988663A26829F2669D1282A2774C5F0E
SHA-256:	3D02E242DDDBA1989FCCE2C818BA4781BD673D3D6F0727C7C3143B875663EB6C
SHA-512:	E385B34C3973642D44D286CA55A45835527FD754EDA8E110FB9D3E5B62A096ACD7FF6CFB30A149422C38303181EB61A58FE9D5DC32B82F25DC5A47889CF22ECD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ..............................f.....@.................................<0..O....@...................2...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p0......H........,..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\es-ES\WebCompanion.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37528
Entropy (8bit):	6.4163635600629325
Encrypted:	false
SSDEEP:	768:xdK/CPhnPMO7BVXhvIRCET4+YMdKMvgW/xlHeRQXgKxnVbiY6X4oAMxkEsJ:xd7+YZW/xl+RQXgKxncVLxAJ
MD5:	75A2028D0BA8FFC93B7373CBED93C705
SHA1:	2C530B99220F964250DF8E196D73B98C509A7F0E
SHA-256:	FD56470DC4650C494A1A5D2BB51ED82CEE9AA84290A5D92B3C3ED172477C0EA9
SHA-512:	195A0E1C14523C0405BFAA92CD8107B74FF07F3A292DD409BE7DDBD9395A065158C0F4F383C9B8B66CC86AF805761AD7BDD6A435580A6A4826F5460B107FD936
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.....X...........v... ........@.. ...................................@..................................v..K....................`...2...........v............................................... ............... ..H............text....V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H.......P ..............8$..XR..........................................BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3..................................................................h.................5.....P.0...........................1..............).........9....!....A....................#...#.1...+.C...3.Z...;.l...C.............8.......................................P......<Module

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	6.956603752456477
Encrypted:	false
SSDEEP:	384:vEjBwdSCuoTXU20BEFP27xWkVbiWgpQ6LW46JZiAM+o/8E9VF0NyD9PP:cjBwdSC9TE20BgKxnVbiY6L9SZiAMxkS
MD5:	A3711DC2C74D9963C39097C81908C2CC
SHA1:	FB13F76489FC3637110BFEB2C4D3367FE87A30C4
SHA-256:	E41F8D8391BF8675DD23E544304E00A0C808BCD602C503E108473DF2EC65C184
SHA-512:	FF85E8736FAAB48D62054310E0CB898046FF001C8A98B19B4F32A12EA03DEE17B5FBE04C145329ED658BF6C01B80BD4E6C5070528C7DDD28F022D96783D429B5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@..................................0..O....@...................2...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......8-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\fr-CA\WebCompanion.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38040
Entropy (8bit):	6.45034907639586
Encrypted:	false
SSDEEP:	768:KnKm0dChnaGFvQXVuTV6/N+vdHZvisyW6QCCLYNIOR9ffgKxnVbiY6XvDiAMxkEp:KnpdAW6Q9UNISpfgKxncVExYe
MD5:	BE119CE7853ADB9B0FA22E6217C0B30A
SHA1:	E7DDB75EF7249E1510CAE4BF46D4937D6B1B3C45
SHA-256:	F1A2FAD94E7A475FA61997136717B2DF0EB6F0D03863F6DB0191006357E882BC
SHA-512:	0811D916957871705A91CED015BF2AAFF0695FD5FAECBBC518D372680D8778DFE4C7528F5CD8728F76E8885DBB3613F62A08D8D453554246918C617C187A3BD6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.....Z...........y... ........@.. ...............................n....@..................................y..K....................b...2...........y............................................... ............... ..H............text....Y... ...Z.................. ..`.rsrc................\..............@..@.reloc...............`..............@..B.................y......H.......P ..............8$..hU..........................................BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3..................................................................h.................5.....P.0...........................1..............).........9....!....A....................#...#.1...+.C...3.Z...;.l...C.............8.......................................P......<Module

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	6.969717102935461
Encrypted:	false
SSDEEP:	384:zBAjW1ffS5POYUEFP27xWkVbiWgpQ6LWumGAM+o/8E9VF0Ny01:NAjWta5POYUgKxnVbiY6L2GAMxkEC
MD5:	0E383747B3819CA9027F3F02C15AF263
SHA1:	CCD6DDEAB49E5B157EA60BC3C3510561FA615A5A
SHA-256:	C21B0F4E11F8691B947DDFAD153EF4E8D490BFBD150AEFAEA5244DA6BDAA2EA4
SHA-512:	D8A01848C04D6D676F652DCBF365A494799E6425B9B1D5AC7CC783A702AF5F7ADA81C369610DAFF131876C09CF96D0494694A0E6CB9638F3ADCCC6489182677B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................n,... ...@....... ....................................@..................................,..W....@...................2...`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P,......H........(..d...........P ..`...........................................\..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&#Uv=.9.W.F.^:1;j........a.......J...'...........(...............p.......E...........{...........b.......B...O............B.T.N._.C.L.O.S.E......

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\it-IT\WebCompanion.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25752
Entropy (8bit):	6.756460146157479
Encrypted:	false
SSDEEP:	768:YUKLlR6PEkybkI51/e8I1vPwUW/gKxnVbiY6XmoGAMxkEab4g:YUMv/Xr/gKxncVmNxeb4g
MD5:	5FC90BF9F7E802F710C11E510AEEDC50
SHA1:	464E6EF0C8282F7A1F7766CF24B72F7E933DF4FC
SHA-256:	56ABFC2DBFECB59C8B4FEC6A1BF7A4C4384359F40ADBBF3E24F0C3AA84DC4931
SHA-512:	AC1106BC0F62FDEF4AB51FDF91A570F7331132296CAEA3F97E4149E76CD027E6FC05DE7F6C0A85D9E44A8E0023E24140B4DAC06972F76CC016FEFEE0B99D60CC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................I... ...`....@.. ...................................@.................................@I..K....`...............2...2..........@I............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B................pI......H.......P ..............8$...%..........................................BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3..................................................................h.................5.....P.0...........................1..............).........9....!....A....................#...#.1...+.C...3.Z...;.l...C.............8.......................................P......<Module

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	7.122264536843945
Encrypted:	false
SSDEEP:	384:6dASE3kmb5bAEFP27xWkVbiWgpQ6XWi3SGAM+o/8E9VF0NypBRd:mASE0mb5bAgKxnVbiY6X7SGAMxkE5Rd
MD5:	DB9F751587107C12212BEDA46E72AFF1
SHA1:	F3A311518FF829E165EB38EDBE225870DA1387D7
SHA-256:	6A8E97031D428DCF030B2966ED384307635001D7DDEF3497C11D30510BDB9BD6
SHA-512:	0138A608473451753AD1583C16A4F0E3C1A7331AEC8EED4D16406586622CFB32B79E9270799E042A8A6E41B9BA16DC4D6C3CAC62BF6C32FD6301EDF5434AAB30
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................-... ...@....... ...............................k....@..................................-..W....@...................2...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H....... *..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ja-JP\WebCompanion.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22680
Entropy (8bit):	7.045202355097814
Encrypted:	false
SSDEEP:	384:gEwKK/R4+rs6Aqiz/iHw9wjHsTefBgbynODREEFP27xWkVbiWgpQ6LWha3PAM+oM:gAKp4+rs6AqlHw9wjHZgqOtEgKxnVbiq
MD5:	A2E5DFEF02D389635A2A7EA8D06AF2E5
SHA1:	5583B3476756BDAD3568F05AE5A3CAE62671C10A
SHA-256:	5E9B740D153495679CD695F8FB03545E90761E88F7FB91894F09C4E1D76DD1D9
SHA-512:	63FD9480E02769C8CFB9EF48F2D3EDCE46246EC104ED71726DF27D124BAE9CCC94D0188E90E4066D7A9CE00E0693B2FFDB28767DA310A2B2BB91470F53CA133E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................<... ...@....@.. ..............................L.....@..................................<..K....@...............&...2...`.......<............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H.......P ..............8$..x...........................................BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3..................................................................h.................5.....P.0...........................1..............).........9....!....A....................#...#.1...+.C...3.Z...;.l...C.............8.......................................P......<Module

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\liblz4.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	136864
Entropy (8bit):	6.441081013093142
Encrypted:	false
SSDEEP:	3072:fcAPIq7L/iB8HVC4Gom8luKyldZsKI4jZKS:UAPIq7Lc8By88HfjMS
MD5:	C19AD979210347AF77E81F1143ED202D
SHA1:	F98D00FE7568A70B8F9BF418CA9E61DC02A696F8
SHA-256:	77762787949DAB142218C7B6848991AC04DDAE42C0D24C0497E9A13209494F1F
SHA-512:	CC54CDBCDE5124004719314D242B43B57FF89A329E6F52B3BD67FA19B56819AA79DA115F732773ADB6B0C18222B91EC71908773634BA452F80E9B5E17A37332E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../.Y...........#.....l..........`..............f......................... .......0........ ..........................................................2..............................................................l............................text....k.......l..................`.P`.data................p..............@.0..rdata..D............r..............@.`@.eh_fram<........ ...x..............@.0@.bss....t.............................0..edata..............................@.0@.idata..............................@.0..CRT................................@.0..tls.... ...........................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\log4net.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	324248
Entropy (8bit):	5.630499276334177
Encrypted:	false
SSDEEP:	3072:/qc3k4mtsi40XigRvjAIg8J911rTJZq4+wYxEwKbEAfKQPL5ds6vOn7GGkXnEcGh:B3CX1AIg8JRfJYmYxEwna5dY5u+
MD5:	4181E0070F4D57EF36DFA1970FF79BCC
SHA1:	5F74E8F9AF08C73D40FE83615EC0B47F100CE6D0
SHA-256:	3CEB7C1AE8DFC9892CB671F98F775EBBC14A94F8C77BDF64CC232AA86D789B72
SHA-512:	88EAFC0ED5C2DE287D4DF445616C3B93664ADD5A2A8A3D40EFF35B179BD7AC9DD32CC98374B5F7E7CFF84674E6BE85166F4BE60FAC9EF7CDB4606611F7BE9200
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....R...........!......... ......>.... ........@.. ....................................@....................................W........................2........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19608
Entropy (8bit):	6.915585375493954
Encrypted:	false
SSDEEP:	384:gEjBspalL62723+4uEFP27xWkVbiWgpQ6LW64txcyAM+o/8E9VF0Ny+HZK:rjBspalmx3+4ugKxnVbiY6LLyAMxkEko
MD5:	74F7DA5765D80E4231FAEB5074D01B74
SHA1:	F629A4C93DC0C518EA601AF9D6FB4F602ABA55E1
SHA-256:	4D02A809C6F37FBEC24F0422EFEC1B6D7AA2D100F45320F85324D5BA452E4FA9
SHA-512:	8075968563F9FF34E9CAFF6C98635C131856AFFBD372480169B13AE4723467B20929DF3519321C5980AB34ADEB5EE97E4EDFD5EC7FCE119B6A4022E4458D5307
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ...................................@................................../..K....@...................2...`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......\|,..d...........P ..,...........................................(..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\pt-BR\WebCompanion.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35992
Entropy (8bit):	6.461189918497351
Encrypted:	false
SSDEEP:	768:CEK0fPhnkKTTETVyLkHbshFKkiIILJWj0UkxiVgKxnVbiY6L0dxAMxkEEl:CEhFwWj0nxiVgKxnchexQl
MD5:	7D3E85B4A4E244601AC3F54B552FB090
SHA1:	4D0CD5CC81AE3EDB4FBA1EC43B2F15E0364F01F1
SHA-256:	24613DBCBC1C1A03A93A6ADAD1BACD06552D1B23574031B60DDB6EF5628E4F76
SHA-512:	AB64E09281344E5CC42177B2F56B01ABC2E29D3D7340758E0FDC150BEEAA9E219F5C23001F1D9689A51CC27652BC2A5F087DD977EFCAA2498950EE5F6725D98B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.....R...........p... ........@.. ....................................@..................................p..K....................Z...2...........p............................................... ............... ..H............text....Q... ...R.................. ..`.rsrc................T..............@..@.reloc...............X..............@..B.................p......H.......P ..............8$..xL..........................................BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3..................................................................h.................5.....P.0...........................1..............).........9....!....A....................#...#.1...+.C...3.Z...;.l...C.............8.......................................P......<Module

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20632
Entropy (8bit):	6.954001570786576
Encrypted:	false
SSDEEP:	384:yEjBGXo9m7QXEE105XLEFP27xWkVbiWgpQ6XWJeBSxAM+o/8E9VF0Ny02:1jBGXo9a0EE1QXLgKxnVbiY6XvSxAMxn
MD5:	062707986A38EC257A51120B0E748B07
SHA1:	794B117D017BEACAEFAFDC2D454BBF11A103326C
SHA-256:	14F46EC6A2926798F855046A7A1449B16D1D49D1CB247C5E9229E317013F91D3
SHA-512:	62816EF9D031CED4015258E30426EF25641849B754EAE781DBAAFDCA33881D5821D8B51A0D8D88E1EEADF47A2096F85164EA9218C538DBE6E201802DCE8914F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................3... ...@....... ....................................@..................................3..K....@...................2...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H.......L0..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ru-RU\WebCompanion.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41112
Entropy (8bit):	6.401415061448644
Encrypted:	false
SSDEEP:	768:kw7Kf+4K+DDEz8SOHOX+DCLVfWGYZVrWVq942UApWOBgKxnVbiY6LpY4AMxkE3GK:k4HZ8rWVq22UAIOBgKxnchpzxSK
MD5:	10AE7DCF0E09E73C239CCFD025044252
SHA1:	75E43702CCB071AB5C6184B6A55F6344426B90FA
SHA-256:	D183072A45578A8A7D306C167F32E08B8C2B7BC724E23A04CC3E90BB7A83BB89
SHA-512:	632FE3C70EE0E252BB64882BCF19F843C9E6BD6F02CD214E2925BEF533456CA5283486606CD01B2793F3521AA423E3F08883DA55479A1405BD88C3CBEC2816CE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.....f..........N.... ........@.. ...............................6....@.....................................K....................n...2........................................................... ............... ..H............text...Td... ...f.................. ..`.rsrc................h..............@..@.reloc...............l..............@..B................0.......H.......P ..............8$..._..........................................BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3..................................................................h.................5.....P.0...........................1..............).........9....!....A....................#...#.1...+.C...3.Z...;.l...C.............8.......................................P......<Module

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18584
Entropy (8bit):	7.005419936721575
Encrypted:	false
SSDEEP:	384:edAWn1v9AJEFP27xWkVbiWgpQ6XW23Du4AM+o/8E9VF0NyK9:CAWnd9AJgKxnVbiY6X+4AMxkE+
MD5:	9106096AA79E5D425DF3E696C3627108
SHA1:	85125422512C7C72B68821E7A6978EE8B4ECAED5
SHA-256:	6A1ADC4E00F693A5BD47C6942DD2E5BFD74BC62D60C58CF77156F0ED25E24320
SHA-512:	F505A17AED4F818BA2005062010FC2CA60D0BD990661856E8CD8E04075BFF9C0B1F97D9035C684A14A15677F89C36BE5D9AF9506042B3C2E3B482621884DE562
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................,... ...@....... ...............................P....@.................................<,..O....@...................2...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p,......H........(..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\tr-TR\WebCompanion.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22680
Entropy (8bit):	6.898657488723419
Encrypted:	false
SSDEEP:	384:HbKKuE2+IR2Dac+kGQNeCykQBe6qVdEFP27xWkVbiWgpQ6XWXXoo3AM+o/8E9VFz:HeKN2+IR2DokGQNeCykpVdgKxnVbiY6w
MD5:	2C5B47EE3D08CD568E231231D150EDAA
SHA1:	A5D311CA0CDC4EFFB6742591B0C4F773E74FFFEB
SHA-256:	62CA56B44911D3C2A633E7EA0C3F7EF4ED9521D5709D17992F548BDC3C51A08F
SHA-512:	F1F6634A81B94B9A65F6F9829099A5BA637CBDACFD8743245B7DFA9B1213A05419315BE7326289827477D9B4E20657B8E952421C79F4B70C32D27FE9B2D8A0D5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................><... ...@....@.. ....................................@..................................;..S....@...............&...2...`.......;............................................... ............... ..H............text...D.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B................ <......H.......P ..............8$..............................................BSJB............v4.0.30319......l...$...#~..........#Strings....0.......#US.4.......#GUID...D.......#Blob......................3..................................................................h.................5.....P.0...........................1..............).........9....!....A....................#...#.1...+.C...3.Z...;.l...C.............8.......................................P......<Module

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\ucrtbased.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1660056
Entropy (8bit):	6.561961820418532
Encrypted:	false
SSDEEP:	24576:3oYsYW6Fixna2BNy4ra7hsXZPa1P0i6Q6335lL3BhdJXmNZqByzYZ4Km:IYWxla5P0i6DHXLv7Z4x
MD5:	0ECEDCB3EB14EB6CE8194338BBCD3628
SHA1:	05C2E0F4C368B12F467735A9256CFF7275F47C95
SHA-256:	D2D54155DE04A91248841E32AC0BB04B3753277F1E3FC896C43DECAE666233EF
SHA-512:	ABD876E099CFFBAA2D459E5A7ECDD495B526FE1ADDD5717405DB922AEEA080A92D2921DFEA8ADE9667BAC431CACF67C0A1892D7E5F9E702B13537E173AF12C50
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k.N.............r-.........y...C.P.....C.O.....C.M.....C.I.....C.L.....C.S.....C.N.....Rich............PE..L...P.!U...........!......... ...............@............................................@A......................................................."...2......<...p...................................@............................................text....,.......................... ..`.data....P...@..."...2..............@....idata..d............T..............@..@.rsrc................j..............@..@.reloc..<............p..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\vcruntime140d.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108696
Entropy (8bit):	6.60874410029536
Encrypted:	false
SSDEEP:	3072:tCLsZSFMEPCl5ikSF+GbTib1iecberxMKP:tDEPCl55E+GbTib1iecbeLP
MD5:	6EFE34E639C8204DCFD47C901C845CB6
SHA1:	05336741D8A6068E6739985E08476D2DEE18CA8A
SHA-256:	648EA8B46DB5EDA404B6D8006AB3A731F27528CE9F8EB9969D3B3531A26EC809
SHA-512:	4F0222DC3E06047A3E613328F83BD3E809BC66B3A8CB4400A421FA34F0AC19BCACD6C65D79A31662917138A9E731C6C2EF6E59D95DE4DFCDD4D7FE20183F7E2C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................+.....tm.........................................................Rich............PE..L...qKZW.........."!.....R...&.......K.......p............................................@A........................@X..........<....................v...2......d....$..T...........................h$..@............................................text...UQ.......R.................. ..`.data...<....p.......V..............@....idata...............X..............@..@_RDATA...............^..............@..@.rsrc................`..............@..@.reloc..d............f..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x64\SQLite.Interop.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1137816
Entropy (8bit):	6.585916719332403
Encrypted:	false
SSDEEP:	24576:f1smp+W5MPcaLeaO0PWRgBidFqXlNFwffr:9siaBO0PWOg
MD5:	D38E92DD86EFFF9F78C8A40E006CDB46
SHA1:	F49124930D296EF05FD1A4175B0996F8F31F3E65
SHA-256:	825552F263ECB499FC593A28BE379274B92E11D447BB72FEFF7C6C76BD7F82EF
SHA-512:	28014FDA391BA8530A733442B85A542C3402A55FFF8792AD1276A77E217EC4A0D744A6E1E2377FA23E32CB995A531517780D58191EFB3C3C2CD7258CEC151E33
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................m.....j.8...\|............0...`.....{.....}.....x....Rich...................PE..d...G.S.........." .....l..........h'....................................................@..............................................#..$...<....p.......P..........2......X...p................................................................................text....j.......l.................. ..`.rdata...Q.......R...p..............@..@.data...Xe.......@..................@....pdata.......P......................@..@text................................@.. data.....;...0...<..................@..@.rsrc........p......................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\x86\SQLite.Interop.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	844440
Entropy (8bit):	6.862329524570665
Encrypted:	false
SSDEEP:	12288:gr9shsglMJF15Yj43MNB2Yldq3+ZeW45+6/rcxJ9RmlJDs9GtL:49VRJF15Yc3SgN+4z/UYkYL
MD5:	5214D9FF559FC297C8E30F63DEF15FE7
SHA1:	B69DC38127EFD00E8155B6D3C1F5E0D31D834340
SHA-256:	A501A8C2C5C42D02064B220DEE8D440B2F67FE66C352063F8142425C1FE82CA5
SHA-512:	B4B4798B70123B2E3D3745880A01B69F583CCA86A0C5A41094D2BFA6838A3D45C895D26CCCCB3368E62F95E644517D5B63C6D147EF5DA932117B9B588848DAD9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C..=..~n..~n..~n...n&.~n...n;.~n...ny.~n U.n..~n...n..~n...n..~n...n..~n...n..~n...n..~nRich..~n................PE..L.....*S...........!.....j...B.......%..............................................m`....@..............................#..D...<........................2.......E..@...................................@............................................text.../h.......j.................. ..`.rdata..i............n..............@..@.data....G...P...(...0..............@....rsrc................X..............@..@.reloc...L.......N...b..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-CHS\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18072
Entropy (8bit):	7.125842558285622
Encrypted:	false
SSDEEP:	384:PdAjxfx+egGJmT8EFP27xWkVbiWgpQ6XW3SNBXbd4AM+o/8E9VF0NyTsjw:VAjx5MGQT8gKxnVbiY6XsMBLd4AMxkE/
MD5:	A10D635B90813C0A9A340D341332F19A
SHA1:	D2EED3F69CCF9D6F4C1E41ED9F49A63A56F5D56C
SHA-256:	634C1852612914CD6C21FF1AF92DA0F1CC397D474CCE86F8AB1415DC37514134
SHA-512:	BE5497238E5623A1948982569EA6000BBE021D047B3C7FB9A95257DE6EB25FD89B3D1EFC7EC4E4569D260377B9AB4E03909D3F9F48BC858A9D2A26CC71D75D50
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................+... ...@....... ...............................#....@.................................t+..W....@...................2...`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........(..h...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\zh-Hans\WebCompanion.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21656
Entropy (8bit):	7.044876904282889
Encrypted:	false
SSDEEP:	384:kCKKlFoI+uAmPpUEzrVrTithvGqespbcKEFP27xWkVbiWgpQ6LWUKUr4AM+o/8EH:aKQI+uAmPpxvVrTithvP4KgKxnVbiY64
MD5:	986F64A7ACCC09F3EBCE5361C8CF8F6F
SHA1:	E38E500F7360D89908E8A0C98C2FCFB22E9D96FE
SHA-256:	3313F64B498A79BEDF3DE3164394FD54DB9B7CEF135F192F073DB642723B2B14
SHA-512:	C4628F422F7EA5FEE3D6FF0B6A23B3A0DBD6DE8707EB0162D75FC0D39F677179DB2E2CBB4A334F4A2089E5E6C3DB45DC7A708B3679B6BCE1E5D60AB2A44CFA31
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................n8... ...@....@.. ..............................n.....@..................................8..W....@..............."...2...`.......8............................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B................P8......H.......P ..............<$..............................................BSJB............v4.0.30319......l...$...#~..........#Strings....4.......#US.8.......#GUID...H.......#Blob......................3..................................................................b................./.....J.*...........................1.$.....$.....$...).$.....$...9.$...!.$...A.$...................#...#.1...+.C...3.Z...;.l...C.............8.......J...............................a......<Module

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\ActiveFeatures.zip (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	405
Entropy (8bit):	6.490440990685713
Encrypted:	false
SSDEEP:	12:5jsT4r8xH8Kyy5+YzkA7QyUY/smtsr8xXag:9sVxcy5+YXrUqptdxZ
MD5:	4E657E64ECAB99F1C569607D44CCC87B
SHA1:	29CE41EE547D0EBFC2387EC9B6DA06C8CA96F570
SHA-256:	27D5B564280B213782E958F7FCE2CFC2CF9EE931CAB62917E97FD9E51AB2EAE4
SHA-512:	7EFB4BD442951793BB165B09DA20F3BD6DFB1764A25FEB75AC635E8F7291CA6269735A2324D393FC5531F91A9EEA52F245568F2D69D72B4879C5079D7CE26DFA
Malicious:	false
Preview:	PK.........J.X........G.....$.ActiveFeatures.txt.. ...........~......~......~....3/...r.j....j./.}..&g.~...%t....C.L\......iXm....5.{d.u.o./U\|.I.S...(H#.....r..=l.M..}p/.a.S'/a..Qd[,.-....sP..J%._.k..;._FK^...V..W......2.#...k}............U...lN.x.s.P...n' M./Q.{.._...d...=PK..-........J.X........G.....$...............ActiveFeatures.txt.. ...........~......~......~....PK..........d.........

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\ActiveFeatures.zip.etmewqmt.xiz (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	405
Entropy (8bit):	6.490440990685713
Encrypted:	false
SSDEEP:	12:5jsT4r8xH8Kyy5+YzkA7QyUY/smtsr8xXag:9sVxcy5+YXrUqptdxZ
MD5:	4E657E64ECAB99F1C569607D44CCC87B
SHA1:	29CE41EE547D0EBFC2387EC9B6DA06C8CA96F570
SHA-256:	27D5B564280B213782E958F7FCE2CFC2CF9EE931CAB62917E97FD9E51AB2EAE4
SHA-512:	7EFB4BD442951793BB165B09DA20F3BD6DFB1764A25FEB75AC635E8F7291CA6269735A2324D393FC5531F91A9EEA52F245568F2D69D72B4879C5079D7CE26DFA
Malicious:	false
Preview:	PK.........J.X........G.....$.ActiveFeatures.txt.. ...........~......~......~....3/...r.j....j./.}..&g.~...%t....C.L\......iXm....5.{d.u.o./U\|.I.S...(H#.....r..=l.M..}p/.a.S'/a..Qd[,.-....sP..J%._.k..;._FK^...V..W......2.#...k}............U...lN.x.s.P...n' M./Q.{.._...d...=PK..-........J.X........G.....$...............ActiveFeatures.txt.. ...........~......~......~....PK..........d.........

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\ActiveFeatures.zip.mr0emtxu.1ef (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	405
Entropy (8bit):	6.490440990685713
Encrypted:	false
SSDEEP:	12:5jsT4r8xH8Kyy5+YzkA7QyUY/smtsr8xXag:9sVxcy5+YXrUqptdxZ
MD5:	4E657E64ECAB99F1C569607D44CCC87B
SHA1:	29CE41EE547D0EBFC2387EC9B6DA06C8CA96F570
SHA-256:	27D5B564280B213782E958F7FCE2CFC2CF9EE931CAB62917E97FD9E51AB2EAE4
SHA-512:	7EFB4BD442951793BB165B09DA20F3BD6DFB1764A25FEB75AC635E8F7291CA6269735A2324D393FC5531F91A9EEA52F245568F2D69D72B4879C5079D7CE26DFA
Malicious:	false
Preview:	PK.........J.X........G.....$.ActiveFeatures.txt.. ...........~......~......~....3/...r.j....j./.}..&g.~...%t....C.L\......iXm....5.{d.u.o./U\|.I.S...(H#.....r..=l.M..}p/.a.S'/a..Qd[,.-....sP..J%._.k..;._FK^...V..W......2.#...k}............U...lN.x.s.P...n' M./Q.{.._...d...=PK..-........J.X........G.....$...............ActiveFeatures.txt.. ...........~......~......~....PK..........d.........

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\AppSettings.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.863260103191357
Encrypted:	false
SSDEEP:	6:Ysxg+XQTwLMzCGrolq9mTGL6Wp0Xkjdl+PzWYAAliJHoLL1c:Y2gJu7lq9mTu6WM8r+7mPJHeL1c
MD5:	590FD86AD024F2B655DEEC8333E240A9
SHA1:	F1946050248DD1AEA834F139063AC8EB3E41677E
SHA-256:	7AFE6A8C5BF14CACE6E9BB2D40DF2ADB5F31325FC024F448138106CF7B63F7C1
SHA-512:	C19BF730552E548B6CAAA27F5FF2C5B34D34AC9408B3B6E388361635DDFD4F619B9205FAD76B9141F2804B8DD364CD843DCBABD4D9D7B7B712F320F6729D87EC
Malicious:	false
Preview:	{"Icon":"https://webcompanion.com/images/favicon.ico","AppName":"Web Companion","Settings":["WCAutoUpdate","EnableGranularity","PostRunV2Action","PostRunTimerAction","EnableTelemetryScan","EnableWebProtection","EnableDynamicNotification"],"CompanyName":"Lavasoft","ActiveEventUrl":null,"ConfigVersion":"v1","CurrentVersion":"9.3.0"}

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\CData.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	4.48486887319322
Encrypted:	false
SSDEEP:	6:N5XW4HJOpWFg39M8AY7PY9RRwu1AE7Tl5:N5DHgpWqa8AUsRRt1AE7Tl5
MD5:	AA3A20ABC328DFC5EFA84EF44ACB538F
SHA1:	4AAFDC33A2BFDDE88092828E3A03D2C2F7532868
SHA-256:	FCB1525D0FEA0756A435A6DEB6A447CC0308E2E795E24133456BCE1C74507702
SHA-512:	3C5A646ACA849A74D75D24B1D632FFC72DA22AED0375F9B1F7BC4FF97342F988EF58E13DDDC250C77AC75740A0627725A86296CDEF53948A28F9AD8C6EB5280D
Malicious:	false
Preview:	[.. {.. "Search": "Google",.. "Homepage": "about:blank",.. "IsOur": false,.. "SetDate": "07/01/2024",.. "Trigger": "User",.. "RemoveDate": null,.. "Age": 0,.. "IsCurrent": true.. }..]

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\DotNetZip-diohid0u.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	982
Entropy (8bit):	7.483641660223072
Encrypted:	false
SSDEEP:	24:9J1c1PetCxIU3Sa9MQohEl0kb96ESo3XsQqAa1c:9Xc1ZCa9DohEJJOWAc
MD5:	216DDECDA010E08C76B71315867DD364
SHA1:	17EBA060F31476F5274410943EF75DC23502E8D4
SHA-256:	85AAA1593DCDC5938916A7F8D9C2850E7DDE5921C72D8B7237E7A896DF71AF5D
SHA-512:	5FAE1E1349F6CEBC1706D091C20A28340F816F04F1C408182DC2177F0413A53E63311B0A42397F170E4E4BA8969F0B0F92F783A1C81A13528E1952F779B0D5CD
Malicious:	false
Preview:	PK.........J.X..,....a.....$.FeatureActions.txt.. ................................K.lr.:. k..`H.T...x...t.F....%....Nw5.I..Q.m.o..).hAVD<7...q.6.BY..S..........@...,.....-..7...q.g..P..2..o.N".,..a2.xtz.(f.A...Rn.....V:).!....e...:t.I.........9.[.8.I.AO......D....w^0.g...y............v).LC.9.....'`...[.>]tp.HV..W..I..Q.k.u~.o..5...+.g.7.....Z.Si..n:.>.....)...Z.....X....S".."t.s....P{....I...R....{ry........+q....W.T......ZYE..;<....'=.9.b...._...8.J..'[...P......f.`%..8......2..$<..y....$...)KW...S.FK..:m.C...Q'L..u..k#).....djp.4..Y.s<..O.....H5C.'..p...9....;...N5Q..%Q...j...=.@..4.o.....s$..6~.).u.WS.6..)..{0...yB.Y.uB...^+...Vy;k..NA.A.{...o...o.D....n.........A....7....V.(.._].g..Ci.C)YY.sIr......Y.k...m".<.>..sn(N.=.w:.?.k#...V7...E..mv~...A.m.;~q..79c.#..\.........%F...X.{O<.i...rJ..Z...dY.P.,...2..PK..-........J.X..,....a.....$...............FeatureActions.txt.. ..............................PK..........d...\.....

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\DotNetZip-evgrx1dp.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	460
Entropy (8bit):	6.776954162624566
Encrypted:	false
SSDEEP:	12:5j60nv37xwpWKzNSoCN7aVHAGE4nn0Pa9X:960vFwxEnN2tBEqn08X
MD5:	91F2E34C6EF5D68D984F6F492465F4D1
SHA1:	032EFD3F333145411BA5E61CFAF578F53434DD2B
SHA-256:	D411DA30001B38DDE56C263156937249D0492FA7841D10409475CC3A697EB528
SHA-512:	5D7C240BFC8BFF83D0072CD0207832683DFDAF6BA866C778AEEFE27C81BB1782455782CC3286DDA269EAC8023F95D3AAE8999C4F36CECDDBE7CDD7430D8604AC
Malicious:	false
Preview:	PK.........J.X..6,..........$.bData.txt.. ..............................1Sg...T........{.(....7 ..].....{$j.<.o'..\|....R3...kN.....$(......]..~._.s.r+2m..w\.......Zz0A^..U..s.H.lI.-:..EG.\.I4..v\|Q!u..OF...Y^a.q......[..=.P~.d.#.rq2v<..bn4..1.....Z+.N.......s.\...........C.@.....].~2....)..#....Z}...]UU..A.....s.G#Pi.m.~.J.b5.y...PK..-........J.X..6,..........$...............bData.txt.. ..............................PK..........[...[.....

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\DotNetZip-k4g1mffa.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	982
Entropy (8bit):	7.553576028653119
Encrypted:	false
SSDEEP:	24:96j1bAzLPwKN3vjhJsWh0Joz7nhtWqW86rJWWJQ7j1zA4:96hyFpvjhJv77NQwhd
MD5:	0B74647F34CFF7C962D7EBC4A53E9C8D
SHA1:	8625E7995E71E14DECE81EA8ED41A182A5399D85
SHA-256:	4487571B713E2B65C0ACE55219F98B40DEB9FE68BC0CD5282BA12C1118AE64D4
SHA-512:	33C772EC37019F10D79E397157C80841A5D868913A36BCEE83CB4290C6E8920A8A813951293CD9710AB31FEAB94D48A44514ADC64637C907621EA3E256504077
Malicious:	false
Preview:	PK.........J.X..,....a.....$.FeatureActions.txt.. ..........F......F......F.....c!:..=w..V...o N.6.-...&\.j`..F.4\&(O....xs....W6w1.....V.4!....0..j>...q..k..h;..........%8........i?N..[t.Q].G..6P.f......u3Kb......k4.:0F...e.q.1w_?5/..Y.A.'a.0.2.92ML\.m...`7.....X.............pF.)..R.d.s....'...k....!...e.M...\..%S.Td.":.b.};..8R..dL..Y;H...<5...MP....K..b..X...%....4..w....:\..+.f...._..........b.............!RR....bL:.0a .F.C.v.3..fi..A..u.&<j..."..^.B..7Y...m.f....\|.Dg....O.s2..{.p...\.....:}so...d.D..<..&.........NJ.;?^*7S....@8.OT8X.DfP.x.=x.M..?.~..0..LX..`3..:}.....1I.R.:...?.yB.....Id.b..X..]......8.A..k.m5........pn..0d..:...J+.qA....j.....6R;.....[...(.gY..]Wkl....3.......'o..0...+.....<......L.R#'.......Uk..a.;8...r.N._.Y..Dw....4....o/V..:..Q).X...q..b..%.~vE8..pF[..'\|.....y?:..X..+.....PK..-........J.X..,....a.....$...............FeatureActions.txt.. ..........F......F......F.....PK..........d...\.....

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\DotNetZip-ktug2y31.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	405
Entropy (8bit):	6.424667428122836
Encrypted:	false
SSDEEP:	6:5jwUFlL4rRXEXIILhHOjFR5txshFjzZ0i9F7LAzMVaoS/UFl0rRXEXIIq+l7stn:5jwy4rShHO5R5KjzZh7LAzG25r1ag
MD5:	3F8D8239A6200123BC7EFB17E2A6FCDB
SHA1:	12A9E8E484C61F2C6D4906BB3E2A2D84B41A80D1
SHA-256:	1DDD97C4CED26BC610C9DD296FCFF59609487ED94D27023BDB60FB8CDCD7D009
SHA-512:	01D1E9B53CB298BB7D432C94365BBE7DA5CB15DAC32A7130422430767E534841917271521C6758101440A6EC81D32226E76E1EAD3C388D594455DB191D460C7A
Malicious:	false
Preview:	PK.........J.X........G.....$.ActiveFeatures.txt.. ................................g..e.-KY...UN.8.."q.!.vC.8...q.b..=....G...m.a.0....2..P9..&.b.e.b.......\&.?aIW.'}..PPI..Y....\_;...\|1+.N............v<..0.\|.'Z......>...8eh..'...;K...o.6.$ea.c..E..9.......rf..0...:}PK..-........J.X........G.....$...............ActiveFeatures.txt.. ..............................PK..........d.........

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\DotNetZip-miopr425.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.175146541957768
Encrypted:	false
SSDEEP:	12:5jj0zOROR0/6Z/TLd+k4HTrCIkUxGBEEImBi6wQMkxrlrp8zOROR1JaA:92qqZkk22IdQBn/6p0hrMqq1z
MD5:	17E7396C8B31B6B060A3D39B3168C891
SHA1:	55FF1C740801F17AD7225216C5D9CF30392092B2
SHA-256:	9B607A5D102B236411CE11A091E6A8ABB3A1E97F246C380620A616C12AD4B04B
SHA-512:	4351F7DF1E191328C4F3C025D32B8187F07F8326665D03CAEDF4D322208803EBA8829D28E1A0BEB462D83667A3D5A3DB32095B9DE85BCEC477E814703E0ED077
Malicious:	false
Preview:	PK.........J.X<.......F.....$.FeatureActions.txt.. ................................PP...=.E.:V.-e...N^O...\|.;'a./.o.}".9.\|...s...v..8..a....VB.<..4I.z..w....ZL.....22.>&....\..d..j....xY..X.u<...i:.N..q...hd)&.......y....r......6.....{.... R......inz..3'......}.l.....}....b......M.....9.N...@o..=....?{.#"..8.. .PM..#<5.q.D..I.....zE.&&7.xx4.2...%..`.....O\|.zj.?....9UQU...E.... .......NB.......$.............(...r...j..........C.X.......l......C..r.&@7..x..^.O..kX.O.x......_.E)..?."......k...hOtNS...PK..-........J.X<.......F.....$...............FeatureActions.txt.. ...........................PK..........d.........

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\DotNetZip-oj1ihiyo.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	460
Entropy (8bit):	6.768419453757491
Encrypted:	false
SSDEEP:	12:5jw9nF8WP+sy9Pah78v4M0MDk6YlkvL1Fi9F8WGJa9X:9CF8WmsKPr096Yqz1+F8WG6X
MD5:	62FA94D42F4A46787EE854A9BAD9F3F0
SHA1:	1F3D5088AC6DC150991175708FB1DE061469E3E5
SHA-256:	649A2EFB6D7DB8298588A61BBE27F472A6BD4D0E638F886AD79674D5052C8DE8
SHA-512:	9E0A9E7C6257B08B69147F28D4EDF2463A6DE6156A48DD1F5F99C1E1B965EF7087AFF0ECB3A6759DA4776F4DF8CABB8D8E46505DF0C62BC4E4EAD53277388FB6
Malicious:	false
Preview:	PK.........J.X..6,..........$.bData.txt.. .............................1.".q.{.H._.#:{z.........Q.?&O._i.[.m!..\V..~..._...>w...#/.P..0....T...#.3m(.5...Y...G.Gl..j..s..n..]-..B.Lo.-H6....<hg..e/..^...^g}....b..+%.$l>.....`..;W..f...[~.@O.....\|]..^.Q..K...?...l;#....w...<%/.'v-..O.kNlT.=t....1..5...5E.'.......s._..P.PK..-........J.X..6,..........$...............bData.txt.. ...........................PK..........[...[.....

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\DotNetZip-ou3zdy5h.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	405
Entropy (8bit):	6.490440990685713
Encrypted:	false
SSDEEP:	12:5jsT4r8xH8Kyy5+YzkA7QyUY/smtsr8xXag:9sVxcy5+YXrUqptdxZ
MD5:	4E657E64ECAB99F1C569607D44CCC87B
SHA1:	29CE41EE547D0EBFC2387EC9B6DA06C8CA96F570
SHA-256:	27D5B564280B213782E958F7FCE2CFC2CF9EE931CAB62917E97FD9E51AB2EAE4
SHA-512:	7EFB4BD442951793BB165B09DA20F3BD6DFB1764A25FEB75AC635E8F7291CA6269735A2324D393FC5531F91A9EEA52F245568F2D69D72B4879C5079D7CE26DFA
Malicious:	false
Preview:	PK.........J.X........G.....$.ActiveFeatures.txt.. ...........~......~......~....3/...r.j....j./.}..&g.~...%t....C.L\......iXm....5.{d.u.o./U\|.I.S...(H#.....r..=l.M..}p/.a.S'/a..Qd[,.-....sP..J%._.k..;._FK^...V..W......2.#...k}............U...lN.x.s.P...n' M./Q.{.._...d...=PK..-........J.X........G.....$...............ActiveFeatures.txt.. ...........~......~......~....PK..........d.........

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\DotNetZip-xl5oqjbo.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	460
Entropy (8bit):	6.674306276418138
Encrypted:	false
SSDEEP:	12:5jnnhUME+FuaHRDBxP8gqsv5ZGSctth+a9X:9nTEenHh7P8gpv51otZX
MD5:	884FBEAAAA50FE37E0CDC81EDEA0AB3C
SHA1:	2CBED1F5B0AC777559764D2FC6A9AB823FAE00AC
SHA-256:	DA8CB63CA5DC4E5BDEAA4232E39C3F65A4670BF3C0779B1B7F2B7D8F3E3DEF7D
SHA-512:	A81EEF191EC2C741B991B89C69A51A77F1E0150EC029A32593A89CAA48DB9D88A2D6F926C488928EA37CFF8EA6FED64FBEE57393B605414DA78273C02CC1FD90
Malicious:	false
Preview:	PK.........J.X..6,..........$.bData.txt.. .........}.....}.....}.......^t.6.R.P.kDk....".%'.^.[.`I..PbOf.C,:...n.ap.m.....&.N.$.._..4.'j.B~.\I...{,Q.V6[.M.:...tL...V....m....s#...E.,/.-V..L..'.;.F.&.M%.B.B.cW..^..;..O.s./.....(.7.b...e.... ..L.....M..$.Rn.~....M.9aF.P.'.Z\|u.E...3-.Y._..90m8..<.,.....{QN,A..=..7\|..@....bGg...^p8.PK..-........J.X..6,..........$...............bData.txt.. .........}.....}.....}.....PK..........[...[.....

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\DotNetZip-xm2jw3zs.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	405
Entropy (8bit):	6.491921841314279
Encrypted:	false
SSDEEP:	12:5j6p4rFR/R/wu6dmciMo8SgjZWa5XH0fo1uyrFR/R/8Jag:96opYu6dViOSgdWa5OoYwpO
MD5:	1F868C813DC3A707498D666729DEF501
SHA1:	92AFF43AA3561066034782772A153E1DAD05BC66
SHA-256:	13F1FEB31873734E28A7D3A0AAEC58D5DF5B521EC7320ADE9CC03F30B6D3EAD7
SHA-512:	5B907FF25F1B548B6A85A6464C254EF93436E86A14D33F651F614D3E6B2B64ECBF878B694C079EA796FF30D78DF84A55A8C4CC1C7C0F1887A8281C006A6BE8A5
Malicious:	false
Preview:	PK.........J.X........G.....$.ActiveFeatures.txt.. .........%.~....%.~....%.~......2L...w,.B..#\i..G)N.<c......q..u......)".-..P-L......WKgm.{k..=.\|.;..E..?,..A.K...5.._.}.d..!..d...na..6.`wkE..w.#....Zs...C..C..R.F>........n5...?.#]5a.m......T...9.......I..j.q...[..\|..PK..-........J.X........G.....$...............ActiveFeatures.txt.. .........%.~....%.~....%.~....PK..........d.........

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\EventSafeguard.bkp (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:y:y
MD5:	81051BCC2CF1BEDF378224B0A93E2877
SHA1:	BA8AB5A0280B953AA97435FF8946CBCBB2755A27
SHA-256:	7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
SHA-512:	1B302A2F1E624A5FB5AD94DDC4E5F8BFD74D26FA37512D0E5FACE303D8C40EEE0D0FFA3649F5DA43F439914D128166CB6C4774A7CAA3B174D7535451EB697B5D
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\EventSafeguard.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:y:y
MD5:	81051BCC2CF1BEDF378224B0A93E2877
SHA1:	BA8AB5A0280B953AA97435FF8946CBCBB2755A27
SHA-256:	7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
SHA-512:	1B302A2F1E624A5FB5AD94DDC4E5F8BFD74D26FA37512D0E5FACE303D8C40EEE0D0FFA3649F5DA43F439914D128166CB6C4774A7CAA3B174D7535451EB697B5D
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\FData.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.455026786512382
Encrypted:	false
SSDEEP:	6:N5XW4HJOpWFg333UAY7PY9RRwu1AE7Tl5:N5DHgpWqHkAUsRRt1AE7Tl5
MD5:	4403BB7A8D2D6255854BD00DF1F2B93D
SHA1:	FF0D4DA83671037292BBA57392B054F2D8954FD7
SHA-256:	D768CD593EF212BB7F48E6DB55C384D435923BE164F76FFF04356675E7EDACBD
SHA-512:	B06DE1DC9C68AD409E51BE0D7C72AA7CEF4DE83CE833CC054D8133E8102807B9803481CB77FA18741D5EF90DC509D2EEFEFBB9D7459B6444700555B31037AF03
Malicious:	false
Preview:	[.. {.. "Search": "Google",.. "Homepage": "about:home",.. "IsOur": false,.. "SetDate": "07/01/2024",.. "Trigger": "User",.. "RemoveDate": null,.. "Age": 0,.. "IsCurrent": true.. }..]

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\FeatureActions.zip (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.175146541957768
Encrypted:	false
SSDEEP:	12:5jj0zOROR0/6Z/TLd+k4HTrCIkUxGBEEImBi6wQMkxrlrp8zOROR1JaA:92qqZkk22IdQBn/6p0hrMqq1z
MD5:	17E7396C8B31B6B060A3D39B3168C891
SHA1:	55FF1C740801F17AD7225216C5D9CF30392092B2
SHA-256:	9B607A5D102B236411CE11A091E6A8ABB3A1E97F246C380620A616C12AD4B04B
SHA-512:	4351F7DF1E191328C4F3C025D32B8187F07F8326665D03CAEDF4D322208803EBA8829D28E1A0BEB462D83667A3D5A3DB32095B9DE85BCEC477E814703E0ED077
Malicious:	false
Preview:	PK.........J.X<.......F.....$.FeatureActions.txt.. ................................PP...=.E.:V.-e...N^O...\|.;'a./.o.}".9.\|...s...v..8..a....VB.<..4I.z..w....ZL.....22.>&....\..d..j....xY..X.u<...i:.N..q...hd)&.......y....r......6.....{.... R......inz..3'......}.l.....}....b......M.....9.N...@o..=....?{.#"..8.. .PM..#<5.q.D..I.....zE.&&7.xx4.2...%..`.....O\|.zj.?....9UQU...E.... .......NB.......$.............(...r...j..........C.X.......l......C..r.&@7..x..^.O..kX.O.x......_.E)..?."......k...hOtNS...PK..-........J.X<.......F.....$...............FeatureActions.txt.. ...........................PK..........d.........

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\FeatureActions.zip.4nzjydmw.ktm (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.175146541957768
Encrypted:	false
SSDEEP:	12:5jj0zOROR0/6Z/TLd+k4HTrCIkUxGBEEImBi6wQMkxrlrp8zOROR1JaA:92qqZkk22IdQBn/6p0hrMqq1z
MD5:	17E7396C8B31B6B060A3D39B3168C891
SHA1:	55FF1C740801F17AD7225216C5D9CF30392092B2
SHA-256:	9B607A5D102B236411CE11A091E6A8ABB3A1E97F246C380620A616C12AD4B04B
SHA-512:	4351F7DF1E191328C4F3C025D32B8187F07F8326665D03CAEDF4D322208803EBA8829D28E1A0BEB462D83667A3D5A3DB32095B9DE85BCEC477E814703E0ED077
Malicious:	false
Preview:	PK.........J.X<.......F.....$.FeatureActions.txt.. ................................PP...=.E.:V.-e...N^O...\|.;'a./.o.}".9.\|...s...v..8..a....VB.<..4I.z..w....ZL.....22.>&....\..d..j....xY..X.u<...i:.N..q...hd)&.......y....r......6.....{.... R......inz..3'......}.l.....}....b......M.....9.N...@o..=....?{.#"..8.. .PM..#<5.q.D..I.....zE.&&7.xx4.2...%..`.....O\|.zj.?....9UQU...E.... .......NB.......$.............(...r...j..........C.X.......l......C..r.&@7..x..^.O..kX.O.x......_.E)..?."......k...hOtNS...PK..-........J.X<.......F.....$...............FeatureActions.txt.. ...........................PK..........d.........

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\FeatureActions.zip.fr34fysd.fh0 (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.175146541957768
Encrypted:	false
SSDEEP:	12:5jj0zOROR0/6Z/TLd+k4HTrCIkUxGBEEImBi6wQMkxrlrp8zOROR1JaA:92qqZkk22IdQBn/6p0hrMqq1z
MD5:	17E7396C8B31B6B060A3D39B3168C891
SHA1:	55FF1C740801F17AD7225216C5D9CF30392092B2
SHA-256:	9B607A5D102B236411CE11A091E6A8ABB3A1E97F246C380620A616C12AD4B04B
SHA-512:	4351F7DF1E191328C4F3C025D32B8187F07F8326665D03CAEDF4D322208803EBA8829D28E1A0BEB462D83667A3D5A3DB32095B9DE85BCEC477E814703E0ED077
Malicious:	false
Preview:	PK.........J.X<.......F.....$.FeatureActions.txt.. ................................PP...=.E.:V.-e...N^O...\|.;'a./.o.}".9.\|...s...v..8..a....VB.<..4I.z..w....ZL.....22.>&....\..d..j....xY..X.u<...i:.N..q...hd)&.......y....r......6.....{.... R......inz..3'......}.l.....}....b......M.....9.N...@o..=....?{.#"..8.. .PM..#<5.q.D..I.....zE.&&7.xx4.2...%..`.....O\|.zj.?....9UQU...E.... .......NB.......$.............(...r...j..........C.X.......l......C..r.&@7..x..^.O..kX.O.x......_.E)..?."......k...hOtNS...PK..-........J.X<.......F.....$...............FeatureActions.txt.. ...........................PK..........d.........

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\Language.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.5219280948873624
Encrypted:	false
SSDEEP:	3:GRFf9ur:GZur
MD5:	3E682EB51BAEE9F27B0775287510AC6E
SHA1:	0C62C14B2D05AF414CDC225DB43B60E79EC7B280
SHA-256:	05A960000C74CA2F31FAC1800E5156E2E4D04A78873F005218AEEB8FBACBBFF6
SHA-512:	885FFE4359BF0FD7793B304312C7C6C3E36E767490D0EE542BE5B41A74E8C4A2567C4929BB0C4BF8021A3F07ED97CF05F3FEAC224B79BD76A0AAC9F3B1BD3A06
Malicious:	false
Preview:	{..."lang" : "en"..}

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\Partner.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.551637540667249
Encrypted:	false
SSDEEP:	3:a+R2HARVWJmFFHqPkY:a+R2UkJmFFKPkY
MD5:	A2EEDDB1917362FC0AE7A80A95C9500B
SHA1:	E48BBBAB0B6982CDEE9963BDE80439DE17B6F878
SHA-256:	4DA5C40CE3FEE4F3F02499C032BD12A4F5E529F63BC5F46BEEDF1DEC7AD7005C
SHA-512:	FA44E0AE534D17D9F1E70C275B3ACEE21933AF2E55AC2FBD3A15B9E5F78603C0D6C0302819B459105500274FA4893B51F3E153FE13FA4BDA9AE587D6A403188D
Malicious:	false
Preview:	{..."partner" : "IN240402",..."campaign" : "20541619131"..}

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\PerformedActions.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	3.9869173574878163
Encrypted:	false
SSDEEP:	3:N5XBE+VRR4wD/zBX7WACXI1AtLGayJ90XOFtq:N5XyWRRHBXrCXIKsaC0XOFtq
MD5:	E132D190CD9284A65B1DBD9C49CF644F
SHA1:	BC1DC3D81247C2B427AC253C3C47311AE0EB0787
SHA-256:	5BAD4759E7D64B8F7BAE2B4CB25DEA58D0E88500451FF7FB4FDD7466E1F0653F
SHA-512:	F1323AE7C9CA5A764EEB081E5102B04AB6B6594B9C823512CB9EB67BBBE013A6EA974C907D208383C01B1DB749DF4F4DE0D6B0358275D4674FADC596B16F3E4D
Malicious:	false
Preview:	[.. {.. "Date": "07/01/2024",.. "Features": [.. {.. "Name": "TelemetryShield",.. "Performed": [.. "EnableFFTelemetryShield".. ].. }.. ].. }..]

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.825928150017314
Encrypted:	false
SSDEEP:	3:YRES0Hv8LzC/EKyAJcxWWWQNpSAhJmEtPgDWiqm8sCVXRNANvU5GJM3AEViUrQfd:Y4Paz2x9JAWW9cMIEtPgFCVX8UFwEV7a
MD5:	A263C69AC67884D1ACFC5DA777FE077B
SHA1:	A6C1192A00D0AB20555F76A3FEBD9A75C6BF204D
SHA-256:	1E4CDEE611306ABA848B3B493C19398F965D0E5A4081B59EE481E47324931D6A
SHA-512:	594E20E68D2B933D836B63A6EB262861F605A8A6BCEB7448F798B9685EA2A6CAD74E773BD945C496F7661A550B735B40BEB1C517C6D6FF4D1FF081CA29DB1F43
Malicious:	false
Preview:	{"target":"partner","ptag":"A160B16F083","ctid":"CT3335358","date":"7/1/2024 1:23:12 PM","campaign":"20541619131","wcyid":"WCYID10249","clidhp":2173312,"clidds":1000871,"default":false}

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.324862957617358
Encrypted:	false
SSDEEP:	3:asLGYUdEk98SQI03eHY:aqGYULoIZ4
MD5:	30075F5A078672F2DD11D680B32E151E
SHA1:	02F82D203420E23A90B4D0C9750A99EADC68C04B
SHA-256:	F76E9C371C8386E3160C9BAB7DABA4321E8DFD65005586F0508EAA6D1F2E6888
SHA-512:	53B8BDFD94B3E98161ECF06F8BFA1B3E4CCCD7781389B803E3B254A7BCD4FE2FE52EE4901AF67E1A0E7B8FD96A50F066F2D83AF9B02B1F4B24F42BC1D18EB95B
Malicious:	false
Preview:	{ "install_id" : "a88aeddf-b18a-44a3-adb5-a827b688973a"}

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\UpdateServer.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.9312089489103226
Encrypted:	false
SSDEEP:	3:anqFfauvY:a/gY
MD5:	CF85989B75515FF6CBAAA6DD23D3882A
SHA1:	3FBBECBCC28E2D4DE5764388BC544DB47AE9957D
SHA-256:	50E3BD90035CA49B3C57050681449C20953F4EFE5711BF4E02E23F2B63968388
SHA-512:	77AC3FA88B08C136C29B907CB1C9B096EE7F97BDE3EC8D6C9382CA9E74060A065EF9AEFC488A5319E9D1570522056584250BE7ABD5ED582E8B4D16F4143E7527
Malicious:	false
Preview:	{..."platform" : "prod"..}

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\WebProtectionConfig.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	308
Entropy (8bit):	4.726273380036389
Encrypted:	false
SSDEEP:	6:Y16ieg7+mkASiBGDrjmrQQZ4YKZtjmrQQZ+u1Cj6wD1j:Y16ieiwAi4QQZ584QQZRCf5
MD5:	0CB1CC6EBD3113FFA4D08CB8E611B0C1
SHA1:	C084178A890875D41C400E8950537E1F8A58A50F
SHA-256:	B578EC7CFE4CDF6690C83DAA66B068FC585A8B35FC3A8722E29F2DC0FABB26E2
SHA-512:	C86F4C9A16249313E1A4E0561DC6241E931C5D382A830B64E3AA9D1447734716417BC2F08E4860EDC0D2945CC5091170B90039194C90985395D33A36662FFFEC
Malicious:	false
Preview:	{"Version":"3.0.2.12","FilePath":"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip","BlackList":"https://acs.lavasoft.com/api/v2/url/blacklist","WhiteList":"https://acs.lavasoft.com/api/v2/url/permanentwhitelist","DisplayName":"Web Protection","FeatureName":"WebProtection"}

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\bData.zip (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	460
Entropy (8bit):	6.674306276418138
Encrypted:	false
SSDEEP:	12:5jnnhUME+FuaHRDBxP8gqsv5ZGSctth+a9X:9nTEenHh7P8gpv51otZX
MD5:	884FBEAAAA50FE37E0CDC81EDEA0AB3C
SHA1:	2CBED1F5B0AC777559764D2FC6A9AB823FAE00AC
SHA-256:	DA8CB63CA5DC4E5BDEAA4232E39C3F65A4670BF3C0779B1B7F2B7D8F3E3DEF7D
SHA-512:	A81EEF191EC2C741B991B89C69A51A77F1E0150EC029A32593A89CAA48DB9D88A2D6F926C488928EA37CFF8EA6FED64FBEE57393B605414DA78273C02CC1FD90
Malicious:	false
Preview:	PK.........J.X..6,..........$.bData.txt.. .........}.....}.....}.......^t.6.R.P.kDk....".%'.^.[.`I..PbOf.C,:...n.ap.m.....&.N.$.._..4.'j.B~.\I...{,Q.V6[.M.:...tL...V....m....s#...E.,/.-V..L..'.;.F.&.M%.B.B.cW..^..;..O.s./.....(.7.b...e.... ..L.....M..$.Rn.~....M.9aF.P.'.Z\|u.E...3-.Y._..90m8..<.,.....{QN,A..=..7\|..@....bGg...^p8.PK..-........J.X..6,..........$...............bData.txt.. .........}.....}.....}.....PK..........[...[.....

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\bData.zip.heu3x3oy.iej (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	460
Entropy (8bit):	6.674306276418138
Encrypted:	false
SSDEEP:	12:5jnnhUME+FuaHRDBxP8gqsv5ZGSctth+a9X:9nTEenHh7P8gpv51otZX
MD5:	884FBEAAAA50FE37E0CDC81EDEA0AB3C
SHA1:	2CBED1F5B0AC777559764D2FC6A9AB823FAE00AC
SHA-256:	DA8CB63CA5DC4E5BDEAA4232E39C3F65A4670BF3C0779B1B7F2B7D8F3E3DEF7D
SHA-512:	A81EEF191EC2C741B991B89C69A51A77F1E0150EC029A32593A89CAA48DB9D88A2D6F926C488928EA37CFF8EA6FED64FBEE57393B605414DA78273C02CC1FD90
Malicious:	false
Preview:	PK.........J.X..6,..........$.bData.txt.. .........}.....}.....}.......^t.6.R.P.kDk....".%'.^.[.`I..PbOf.C,:...n.ap.m.....&.N.$.._..4.'j.B~.\I...{,Q.V6[.M.:...tL...V....m....s#...E.,/.-V..L..'.;.F.&.M%.B.B.cW..^..;..O.s./.....(.7.b...e.... ..L.....M..$.Rn.~....M.9aF.P.'.Z\|u.E...3-.Y._..90m8..<.,.....{QN,A..=..7\|..@....bGg...^p8.PK..-........J.X..6,..........$...............bData.txt.. .........}.....}.....}.....PK..........[...[.....

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\bData.zip.ksqpu2m2.wwu (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	460
Entropy (8bit):	6.674306276418138
Encrypted:	false
SSDEEP:	12:5jnnhUME+FuaHRDBxP8gqsv5ZGSctth+a9X:9nTEenHh7P8gpv51otZX
MD5:	884FBEAAAA50FE37E0CDC81EDEA0AB3C
SHA1:	2CBED1F5B0AC777559764D2FC6A9AB823FAE00AC
SHA-256:	DA8CB63CA5DC4E5BDEAA4232E39C3F65A4670BF3C0779B1B7F2B7D8F3E3DEF7D
SHA-512:	A81EEF191EC2C741B991B89C69A51A77F1E0150EC029A32593A89CAA48DB9D88A2D6F926C488928EA37CFF8EA6FED64FBEE57393B605414DA78273C02CC1FD90
Malicious:	false
Preview:	PK.........J.X..6,..........$.bData.txt.. .........}.....}.....}.......^t.6.R.P.kDk....".%'.^.[.`I..PbOf.C,:...n.ap.m.....&.N.$.._..4.'j.B~.\I...{,Q.V6[.M.:...tL...V....m....s#...E.,/.-V..L..'.;.F.&.M%.B.B.cW..^..;..O.s./.....(.7.b...e.... ..L.....M..$.Rn.~....M.9aF.P.'.Z\|u.E...3-.Y._..90m8..<.,.....{QN,A..=..7\|..@....bGg...^p8.PK..-........J.X..6,..........$...............bData.txt.. .........}.....}.....}.....PK..........[...[.....

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\statistic.db

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	SQLite 3.x database, last written using SQLite version 3008004, page size 1024, file counter 26, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	3.0314804931404296
Encrypted:	false
SSDEEP:	24:r+brygUKvlQwBjZ+themhEhe6M7DwfqhKTgfhWfhecum8o3/6ox7oU:ybxBjwth3EhUYyigfhWfhN8w6U7T
MD5:	84A08D07991413C109A4B5F87199F56E
SHA1:	8C8BAFB05A96857F2A03D6ECD4C3B73E8DFADA8B
SHA-256:	C2948EFC1334DD17E87A91B465041E27192201F647E9400AC5A1CF32FAD5394A
SHA-512:	7B50B421B124567F69118BAC94C777031668F70B02F788F068C5035560FBD37D1F83D07D7606D5EEBB50805F5698A691198F0BEF477C0BC1A0AA77B5B5BF8870
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................-........`..`.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................''..ytableDataCollectorDataCollector.CREATE TABLE DataCollector(Id INTEGER PRIMARY KEY NOT NULL, Key TEXT NULL, Value INTEGER NULL,

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\statistic.db-journal

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	2576
Entropy (8bit):	2.6206964373906874
Encrypted:	false
SSDEEP:	24:7+t48jZ+themhEhe6M7DwfqhKTgfhWfhecum8o3/6o617oI8KutkrygUKvlQE:7M1jwth3EhUYyigfhWfhN8w6575/uC5
MD5:	34ED10FEBE025A3A039811484F20571D
SHA1:	2EA14BDE9CFE48AC0297850911AAFB9D8BEC2F9C
SHA-256:	195FE468934BF012F66631233ECFF809329911725CF2C61AF6023B6B2FE2A4EC
SHA-512:	B4AF174EC5F1D101D77058796259475E16A4ED9A1D88154A0BF1DFFC7A330B4FA07F53D036EA5E1BED734C4EDD14F1FDA745A003527DDA46CC27750D6A80994A
Malicious:	false
Preview:	.... .c......6C......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$............A.....n.M............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Frequently Asked Questions.url

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://webcompanion.com/faq>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	163
Entropy (8bit):	4.922939566705661
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0AmgDKYKCLJ4ovstwWDXp4EaKC5TfT8ZEWVjkRMQ5TdeLHD:HRYFVm/5mg+DCLJlvstwWDPaZ5TLk2d+
MD5:	8F6C4B150ECBD3B334D759CBF2789155
SHA1:	FE7F0D07CDAF2B468E0D7164F87AEC705F15791F
SHA-256:	8659A1B18B608C4AFDF32E2CB9825C10FC33A31D8A07A145D0CC2077826F9806
SHA-512:	C6278A8B5B9F9DE1BEF4B30C17585A3C4E3DAFC486AB987C4CD7E845CD4D4C2B39C61472D901947B92DE9130EE1759D19D11D124A026F7A02B7320B34474F2FF
Malicious:	false
Preview:	[InternetShortcut]..URL=http://webcompanion.com/faq..IconIndex=0..IconFile=C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanionIcon.ico..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion\Web Companion.lnk

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Mon Jul 1 12:22:46 2024, mtime=Mon Jul 1 12:22:46 2024, atime=Mon Jul 1 12:22:46 2024, length=3429528, window=hide
Category:	dropped
Size (bytes):	2222
Entropy (8bit):	3.6972793966826636
Encrypted:	false
SSDEEP:	48:82z3iCW8B3WclJv818ZlfUfY8ZlqkWR8Zlq50FiN:82zm8hzztU/ke8OiN
MD5:	851BD0AB5F34A060299EF4AE7553FE88
SHA1:	CDFD0471D764111F068B7745BB30C2EC1E80BF43
SHA-256:	D9C30CF6725D1336134919311F6BEDEFA44130D1BEAA5F74A4775C38B97DD63F
SHA-512:	616B37BF1279D3FA85468DF871839B4C86C0EE1470822EFCD3018B29424083C8362CB34DC4D55713D0FD36DCBA070DF4763CF6118CA3AB173E2DCF7638A710A5
Malicious:	false
Preview:	L..................F.@.. ................}.......T4.....................b....DG..Yr?.D..U..k0.~.t...CFSF..1.....QK.X. AppData...t.Y^...H.g.3..(.....gVA.G..k...<......QK.XQK.X....=....,...............A.p.p.D.a.t.a...B.R.1......X.j. Roaming.<......QK.X.X.j....=....6...............R.o.a.m.i.n.g.....V.1......X.j. Lavasoft..>.......X.j.X.j.........................L.a.v.a.s.o.f.t.....`.1......X.j. WEBCOM~1..H.......X.j.X.j.........................W.e.b. .C.o.m.p.a.n.i.o.n.....\.1......X.j. APPLIC~1..D.......X.j.X.j....>....................A.p.p.l.i.c.a.t.i.o.n.....j.2..T4..X.j WEBCOM~2.EXE..N.......X.j.X.j.........................W.e.b.C.o.m.p.a.n.i.o.n...e.x.e.......................-...8...[.............wV.....C:\Users\..#...................\\172892\Users.user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe...W.e.b. .C.o.m.p.a.n.i.o.n.E.....\.....\.....\.....\.....\.....\.L.a.v.a.s.o.f.t.\.W.e.b. .C.o.m.p.a.n.i.o.n.\.A.p.p.l.i.c.a.t.i.o.n.\.W.e.b.C.o.m

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\prefs.js

Download File

Process:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
File Type:	ASCII text, with very long lines (1567)
Category:	dropped
Size (bytes):	10078
Entropy (8bit):	5.1687135828565545
Encrypted:	false
SSDEEP:	192:Zmq0C8xPLvdI9MSfQCf6A842RXpaXhD+ueMXopEPS2Cq95:Zi2/FfNz2RXQ
MD5:	3CA13D2D9D1E83CE3A23606EB7AA9C89
SHA1:	80F047C892698FDCD4C4E4A857FA5B5A384EAA93
SHA-256:	ACC8A9FC405CD9B520CD0224FEE35FF59D8C3389C44BBE52715D4FD8575CB14F
SHA-512:	317B02B5302D40B002AD546C9285E61E4DE805B304E7162A38FB1EF331A53582110D252F056E229416A46FC892DE58A8759AE77C5F4F010A230429A5EEDC5D16
Malicious:	true
Preview:	# Mozilla User Preferences../* Do not edit this file.. . If you make changes to this file while the application is running,. * the changes will be overwritten when the application exits.. . To make a manual change to preferences, you can visit the URL about:config. */..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);.user_pref("app.update.lastUpdateTime.xpi-signature-verification", 0);.user_pref("browser.bookmarks.restore_default_bookmarks", false);.user_pref("browser.cache.disk.capacity", 1048576);.user_pref("browser.cache.disk.filesystem_reported", 1);.user_pref("browser.cache.disk.smart_size.first_run", false);.user_pref("browser.cache.frecency_experiment", 3);.user_pref("browser.download.importedFromSqlite", true);.user_pref("browser.laterrun.bookkeeping.profileCreationTime", 1508238357);.user_pref("browser.laterrun.bookkeeping.sessionCount", 1);.user_pref("browser.laterrun.enabled", true);.user_pref("browser.migration.version", 42);.user_pref("browser.ne

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.653640389792838
TrID:	Win32 Executable (generic) a (10002005/4) 99.40% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Setup.exe
File size:	545'352 bytes
MD5:	a081cff1d93f1bcc478835dcb98e7c47
SHA1:	00e6cb7c41860aeb346958192c68eb86b4015fb2
SHA256:	c0db81c7d38819926df96d6fb3adda34fb8783acede83d5f9bc0b681f2287845
SHA512:	c95a0db92a5a40189a515aa109e3af25570156f1b25845f21ced7f855de21dfd7e212453b075ceb54f78916573a0194a25a85a4f7282c7293b49a8743895c5ea
SSDEEP:	12288:PG5knZfFKeT4OydwORmV42Y5RBHtf8WS8sejGxUeRx7/1F:PG50ZfFKM4RCa0gDS8geepF
TLSH:	82C4F1127DE089B5D5820431CC745FA6A2B6FE560A21887773987E3E7F7F642C232A1D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s..c}...s..Yy...s..w,...s...r./.s..w....s..Yx...s.......s.......s.Zyu...s.Rich..s.................PE..L......M...

File Icon


Icon Hash:	8011090b07071616

Static PE Info

General

Entrypoint:	0x4148d4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4DAC88CE [Mon Apr 18 18:54:06 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e00de6e48b9b06aceb12a81e7bf494c9

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Entrust Extended Validation Code Signing CA - EVCS2, O="Entrust, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	5/1/2024 10:39:26 AM 5/1/2025 10:39:25 AM
Subject Chain	CN=7270356 Canada Inc., SERIALNUMBER=1417258-2, OID.2.5.4.15=Private Organization, O=7270356 Canada Inc., OID.1.3.6.1.4.1.311.60.2.1.3=CA, L=Saint-Laurent, S=Quebec, C=CA
Version:	3
Thumbprint MD5:	0E3940FCE9D8B244F0D82DDEEBE28F5E
Thumbprint SHA-1:	EA06433E6F12D2AADA040F4A6EF7C927404A4CBA
Thumbprint SHA-256:	EB0A666D9DFD790059DF788FBA544ABC93E1690F1425147BA0A6E784AFC6F5B5
Serial:	25D0CB9D7B0D6C700CDAE43D243AB1C6

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0041B9E8h
push 004147FCh
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [0041B078h]
xor edx, edx
mov dl, ah
mov dword ptr [004233F0h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [004233ECh], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [004233E8h], ecx
shr eax, 10h
mov dword ptr [004233E4h], eax
push 00000001h
call 00007FD67CEABA9Bh
pop ecx
test eax, eax
jne 00007FD67CEAAC0Ah
push 0000001Ch
call 00007FD67CEAACC8h
pop ecx
call 00007FD67CEAB54Dh
test eax, eax
jne 00007FD67CEAAC0Ah
push 00000010h
call 00007FD67CEAACB7h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007FD67CEAD6BCh
call dword ptr [0041B07Ch]
mov dword ptr [00425A5Ch], eax
call 00007FD67CEAD57Ah
mov dword ptr [00423360h], eax
call 00007FD67CEAD323h
call 00007FD67CEAD265h
call 00007FD67CEACCC0h
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [0041B080h]
call 00007FD67CEAD1F6h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007FD67CEAAC08h
movzx eax, word ptr [ebp+00h]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[ C ] VS2010 build 30319
[ASM] VS2010 build 30319
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e9ac	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0x71d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x81fb0	0x3298
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x200	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x197c0	0x19800	206b62d600beb166f8bf863ad5301f8c	False	0.5831609987745098	DOS executable (COM)	6.60822715389085	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x4490	0x4600	b0314f39355cab7d4674a0928d3b15f2	False	0.312109375	data	4.383775518811042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x5a68	0x3200	8d44c03d32e0c923339cda9fae15827a	False	0.123828125	data	1.3793356235333818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sxdata	0x26000	0x4	0x200	35925cfdc1176bd9ffc634a58b40ec17	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27000	0x71d4	0x7200	cd606fe2fe8a9aaa6244d6a44a46010a	False	0.3919613486842105	data	4.655199945289653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27354	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.37231182795698925
RT_ICON	0x2763c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5472972972972973
RT_ICON	0x27764	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2833 x 2833 px/m			0.3200354609929078
RT_ICON	0x27bcc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2833 x 2833 px/m			0.23688524590163934
RT_ICON	0x28554	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2833 x 2833 px/m			0.1721388367729831
RT_ICON	0x295fc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2833 x 2833 px/m			0.1241701244813278
RT_ICON	0x2bba4	0x1a7b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9648915769287506
RT_DIALOG	0x2d620	0xb8	data	English	United States	0.6684782608695652
RT_STRING	0x2d6d8	0x94	data	English	United States	0.668918918918919
RT_STRING	0x2d76c	0x34	data	English	United States	0.6538461538461539
RT_GROUP_ICON	0x2d7a0	0x4c	data			0.8289473684210527
RT_GROUP_ICON	0x2d7ec	0x22	data	English	United States	1.0
RT_VERSION	0x2d810	0x344	data	English	United States	0.4318181818181818
RT_MANIFEST	0x2db54	0x67f	exported SGML document, ASCII text, with CRLF line terminators	English	United States	0.3692122669873722

Imports

DLL	Import
OLEAUT32.dll	VariantClear, SysAllocString
USER32.dll	SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, GetWindowLongA, SetWindowTextW, LoadIconA, LoadStringW, LoadStringA, CharUpperW, CharUpperA, DestroyWindow, EndDialog, PostMessageA, ShowWindow, MessageBoxW, GetDlgItem, KillTimer, SetWindowTextA
SHELL32.dll	ShellExecuteExA
KERNEL32.dll	GetCurrentDirectoryA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, InterlockedDecrement, GetProcAddress, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, GetFileType, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, HeapSize, GetCurrentProcess, TerminateProcess, IsBadWritePtr, HeapCreate, HeapDestroy, GetEnvironmentVariableA, SetUnhandledExceptionFilter, TlsAlloc, ExitProcess, GetVersion, GetCommandLineA, GetStartupInfoA, GetModuleHandleA, WaitForSingleObject, CloseHandle, CreateProcessA, GetCommandLineW, GetVersionExA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, GetLastError, LoadLibraryA, GetModuleFileNameW, GetModuleFileNameA, LocalFree, FormatMessageW, FormatMessageA, SetFileTime, CreateFileW, SetLastError, SetFileAttributesW, SetFileAttributesA, RemoveDirectoryW, RemoveDirectoryA, CreateDirectoryW, CreateDirectoryA, DeleteFileW, DeleteFileA, GetFullPathNameW, GetFullPathNameA, SetCurrentDirectoryW, SetCurrentDirectoryA, GetCurrentDirectoryW, GetTempPathW, GetTempPathA, GetCurrentProcessId, GetTickCount, GetCurrentThreadId, FindClose, FindFirstFileW, FindFirstFileA, FindNextFileW, FindNextFileA, CreateFileA, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, GetStdHandle, WaitForMultipleObjects, Sleep, VirtualAlloc, VirtualFree, CreateEventA, SetEvent, ResetEvent, InitializeCriticalSection, RtlUnwind, RaiseException, HeapAlloc, HeapFree, HeapReAlloc, CreateThread, TlsSetValue, TlsGetValue, ExitThread

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 15:22:16.790103912 CEST	49168	80	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:16.795170069 CEST	80	49168	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:16.795316935 CEST	49168	80	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:16.795782089 CEST	49168	80	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:16.800707102 CEST	80	49168	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:17.284307003 CEST	80	49168	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:17.494416952 CEST	80	49168	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:17.494518995 CEST	49168	80	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:17.558648109 CEST	49169	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:17.558690071 CEST	443	49169	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:17.558763027 CEST	49169	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:17.560363054 CEST	49169	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:17.560373068 CEST	443	49169	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:18.158276081 CEST	443	49169	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:18.158418894 CEST	49169	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:18.163522959 CEST	49169	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:18.163544893 CEST	443	49169	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:18.163937092 CEST	443	49169	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:18.222780943 CEST	49169	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:18.268492937 CEST	443	49169	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:18.269295931 CEST	49169	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:18.269303083 CEST	443	49169	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:18.424441099 CEST	443	49169	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:18.424529076 CEST	443	49169	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:18.424756050 CEST	49169	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:18.425592899 CEST	49169	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:18.506441116 CEST	49170	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:18.506547928 CEST	443	49170	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:18.506633997 CEST	49170	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:18.507093906 CEST	49170	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:18.507132053 CEST	443	49170	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:19.072292089 CEST	443	49170	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:19.072433949 CEST	49170	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:19.316796064 CEST	49170	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:19.316828966 CEST	443	49170	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:19.318465948 CEST	443	49170	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:19.324335098 CEST	49170	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:19.368511915 CEST	443	49170	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:19.368781090 CEST	49170	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:19.368794918 CEST	443	49170	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:19.667562008 CEST	443	49170	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:19.667685986 CEST	443	49170	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:19.667759895 CEST	49170	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:19.669167995 CEST	49170	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:19.677122116 CEST	49171	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:19.677170038 CEST	443	49171	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:19.677244902 CEST	49171	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:19.677536011 CEST	49171	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:19.677555084 CEST	443	49171	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.147130013 CEST	443	49171	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.150108099 CEST	49171	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.150141001 CEST	443	49171	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.150208950 CEST	49171	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.150218964 CEST	443	49171	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.323411942 CEST	443	49171	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.323564053 CEST	443	49171	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.323653936 CEST	49171	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.327826023 CEST	49171	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.344594002 CEST	49172	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.344717026 CEST	443	49172	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.344805002 CEST	49172	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.345145941 CEST	49172	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.345182896 CEST	443	49172	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.814512968 CEST	443	49172	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.817475080 CEST	49172	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.817512035 CEST	443	49172	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.817645073 CEST	49172	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.817651033 CEST	443	49172	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.970647097 CEST	443	49172	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.970777988 CEST	443	49172	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.970854998 CEST	49172	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.971369028 CEST	49172	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.982286930 CEST	49173	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.982325077 CEST	443	49173	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:20.982481956 CEST	49173	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.982832909 CEST	49173	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:20.982847929 CEST	443	49173	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:21.470676899 CEST	443	49173	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:21.473892927 CEST	49173	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:21.473916054 CEST	443	49173	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:21.473968029 CEST	49173	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:21.473975897 CEST	443	49173	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:21.668862104 CEST	443	49173	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:21.668991089 CEST	443	49173	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:21.669114113 CEST	49173	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:21.670016050 CEST	49173	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:22.167881966 CEST	49174	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:22.167932987 CEST	443	49174	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:22.168004990 CEST	49174	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:22.168272018 CEST	49174	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:22.168286085 CEST	443	49174	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:22.827152014 CEST	443	49174	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:22.829936028 CEST	49174	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:22.829960108 CEST	443	49174	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:22.830024004 CEST	49174	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:22.830033064 CEST	443	49174	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.021261930 CEST	443	49174	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.021372080 CEST	443	49174	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.021420956 CEST	49174	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.021948099 CEST	49174	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.026876926 CEST	49175	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.026937962 CEST	443	49175	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.027013063 CEST	49175	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.027426958 CEST	49175	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.027437925 CEST	443	49175	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.513288021 CEST	443	49175	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.529011011 CEST	49175	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.529047012 CEST	443	49175	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.529093027 CEST	49175	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.529100895 CEST	443	49175	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.695535898 CEST	443	49175	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.695673943 CEST	443	49175	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.695825100 CEST	49175	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.696347952 CEST	49175	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.705018044 CEST	49176	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.705046892 CEST	443	49176	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:23.705111027 CEST	49176	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.705449104 CEST	49176	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:23.705462933 CEST	443	49176	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:24.202647924 CEST	443	49176	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:24.222841024 CEST	49176	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:24.222867966 CEST	443	49176	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:24.222956896 CEST	49176	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:24.222965002 CEST	443	49176	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:24.392385960 CEST	443	49176	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:24.392509937 CEST	443	49176	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:24.392605066 CEST	49176	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:24.394701004 CEST	49176	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:24.410026073 CEST	49177	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:24.410079002 CEST	443	49177	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:24.410208941 CEST	49177	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:24.410547972 CEST	49177	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:24.410559893 CEST	443	49177	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:24.888166904 CEST	443	49177	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:24.891690016 CEST	49177	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:24.891715050 CEST	443	49177	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:24.891899109 CEST	49177	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:24.891905069 CEST	443	49177	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.089564085 CEST	443	49177	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.089689016 CEST	443	49177	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.089770079 CEST	49177	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.090379953 CEST	49177	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.102289915 CEST	49178	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.102319002 CEST	443	49178	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.102399111 CEST	49178	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.103065968 CEST	49178	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.103085041 CEST	443	49178	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.605490923 CEST	443	49178	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.608611107 CEST	49178	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.608643055 CEST	443	49178	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.608700037 CEST	49178	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.608707905 CEST	443	49178	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.837439060 CEST	443	49178	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.837553978 CEST	443	49178	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.837629080 CEST	49178	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.838370085 CEST	49178	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.843611956 CEST	49179	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.843663931 CEST	443	49179	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:25.843730927 CEST	49179	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.844059944 CEST	49179	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:25.844074965 CEST	443	49179	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:26.309557915 CEST	443	49179	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:26.331614971 CEST	49179	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:26.331654072 CEST	443	49179	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:26.331717968 CEST	49179	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:26.331728935 CEST	443	49179	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:26.520050049 CEST	443	49179	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:26.520162106 CEST	443	49179	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:26.520224094 CEST	49179	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:26.520904064 CEST	49179	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:26.530957937 CEST	49180	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:26.530997992 CEST	443	49180	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:26.531088114 CEST	49180	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:26.531404018 CEST	49180	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:26.531416893 CEST	443	49180	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:26.996546984 CEST	443	49180	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:26.999790907 CEST	49180	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:26.999830008 CEST	443	49180	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:26.999903917 CEST	49180	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:26.999912977 CEST	443	49180	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.163465023 CEST	443	49180	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.163631916 CEST	443	49180	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.163711071 CEST	49180	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.164393902 CEST	49180	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.169435024 CEST	49181	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.169488907 CEST	443	49181	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.169575930 CEST	49181	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.169878006 CEST	49181	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.169893026 CEST	443	49181	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.660123110 CEST	443	49181	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.663600922 CEST	49181	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.663640022 CEST	443	49181	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.663800001 CEST	49181	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.663805962 CEST	443	49181	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.870327950 CEST	443	49181	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.870449066 CEST	443	49181	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.870513916 CEST	49181	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.871157885 CEST	49181	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.876816034 CEST	49182	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.876847029 CEST	443	49182	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:27.876908064 CEST	49182	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.877204895 CEST	49182	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:27.877218962 CEST	443	49182	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:28.365546942 CEST	443	49182	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:28.368671894 CEST	49182	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:28.368705988 CEST	443	49182	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:28.368768930 CEST	49182	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:28.368778944 CEST	443	49182	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:28.552901030 CEST	443	49182	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:28.553219080 CEST	443	49182	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:28.553289890 CEST	49182	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:28.553713083 CEST	49182	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:28.558784962 CEST	49183	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:28.558830976 CEST	443	49183	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:28.558907986 CEST	49183	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:28.559202909 CEST	49183	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:28.559220076 CEST	443	49183	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.034199953 CEST	443	49183	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.037180901 CEST	49183	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.037214994 CEST	443	49183	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.037265062 CEST	49183	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.037272930 CEST	443	49183	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.193614006 CEST	443	49183	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.193747997 CEST	443	49183	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.193824053 CEST	49183	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.194391012 CEST	49183	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.199305058 CEST	49184	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.199337959 CEST	443	49184	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.199481964 CEST	49184	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.199670076 CEST	49184	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.199683905 CEST	443	49184	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.678869009 CEST	443	49184	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.681885004 CEST	49184	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.681900978 CEST	443	49184	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.681972980 CEST	49184	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.681977987 CEST	443	49184	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.872438908 CEST	443	49184	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.872634888 CEST	443	49184	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.872730017 CEST	49184	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.873281956 CEST	49184	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.877896070 CEST	49185	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.877934933 CEST	443	49185	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:29.878009081 CEST	49185	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.878300905 CEST	49185	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:29.878314972 CEST	443	49185	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:30.358537912 CEST	443	49185	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:30.361680031 CEST	49185	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:30.361701965 CEST	443	49185	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:30.361769915 CEST	49185	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:30.361778975 CEST	443	49185	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:30.536032915 CEST	443	49185	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:30.536211967 CEST	443	49185	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:30.536259890 CEST	49185	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:30.536561966 CEST	49185	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:30.546581984 CEST	49186	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:30.546613932 CEST	443	49186	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:30.546669960 CEST	49186	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:30.546993017 CEST	49186	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:30.547003984 CEST	443	49186	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.032710075 CEST	443	49186	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.040512085 CEST	49186	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.040530920 CEST	443	49186	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.040625095 CEST	49186	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.040631056 CEST	443	49186	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.197580099 CEST	443	49186	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.197742939 CEST	443	49186	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.197895050 CEST	49186	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.198262930 CEST	49186	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.202574015 CEST	49187	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.202606916 CEST	443	49187	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.202668905 CEST	49187	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.202933073 CEST	49187	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.202944040 CEST	443	49187	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.744977951 CEST	443	49187	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.748501062 CEST	49187	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.748521090 CEST	443	49187	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.748583078 CEST	49187	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.748589993 CEST	443	49187	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.909859896 CEST	443	49187	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.909966946 CEST	443	49187	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:31.910036087 CEST	49187	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.910494089 CEST	49187	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:31.914199114 CEST	49168	80	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:31.919946909 CEST	80	49168	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:32.052702904 CEST	80	49168	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:32.053563118 CEST	49188	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:32.053599119 CEST	443	49188	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:32.053656101 CEST	49188	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:32.054034948 CEST	49188	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:32.054048061 CEST	443	49188	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:32.262634993 CEST	80	49168	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:32.262739897 CEST	49168	80	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:32.623950005 CEST	443	49188	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:32.626904011 CEST	49188	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:32.626924992 CEST	443	49188	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:32.626976013 CEST	49188	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:32.626985073 CEST	443	49188	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:32.812693119 CEST	443	49188	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:32.812941074 CEST	443	49188	104.16.148.130	192.168.2.22
Jul 1, 2024 15:22:32.813007116 CEST	49188	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:32.813386917 CEST	49188	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:22:32.819632053 CEST	49189	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:32.819662094 CEST	443	49189	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:32.819735050 CEST	49189	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:32.819992065 CEST	49189	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:32.820004940 CEST	443	49189	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:33.315808058 CEST	443	49189	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:33.327254057 CEST	49189	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:33.327277899 CEST	443	49189	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:33.327351093 CEST	49189	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:33.327359915 CEST	443	49189	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:33.484945059 CEST	443	49189	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:33.485119104 CEST	443	49189	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:33.485171080 CEST	49189	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:33.487554073 CEST	49189	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:33.494298935 CEST	49190	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:33.494335890 CEST	443	49190	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:33.494395971 CEST	49190	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:33.494673967 CEST	49190	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:33.494692087 CEST	443	49190	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:33.960716009 CEST	443	49190	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:33.964097023 CEST	49190	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:33.964118004 CEST	443	49190	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:33.964171886 CEST	49190	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:33.964180946 CEST	443	49190	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:34.151886940 CEST	443	49190	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:34.152038097 CEST	443	49190	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:34.152095079 CEST	49190	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:34.152582884 CEST	49190	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:34.177881956 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.177923918 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.177968025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.178405046 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.178420067 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.750291109 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.750446081 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.755130053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.755148888 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.755410910 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.757919073 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.804497957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.893949986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.894015074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.894054890 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.894066095 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.894092083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.894222975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.894329071 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.894754887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.894789934 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.894803047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.894812107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.894925117 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.895003080 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.895591974 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.895636082 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.895642996 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.895653963 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.895699024 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.895875931 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.984235048 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.984283924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.984399080 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.984415054 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.984504938 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.984519005 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.984982967 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.985035896 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.985044956 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.985342026 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.985387087 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.985399961 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.985532045 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.985584021 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.985591888 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.985770941 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.985835075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.985842943 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.986287117 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.986325979 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.986360073 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.986370087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.986440897 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.986709118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.986772060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.986829996 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.986841917 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.987685919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.987725019 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.987741947 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.988310099 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.988348961 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.988349915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.988362074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.988406897 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.988589048 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.989013910 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.989049911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.989056110 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:34.989063978 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:34.989137888 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.074189901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.074465036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.074539900 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.074552059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.074927092 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.074980974 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.074990988 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.075464964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.075512886 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.075527906 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.076234102 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.076297045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.076306105 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.077039003 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.077088118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.077126026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.077126026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.077137947 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.078037977 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.078098059 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.078108072 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.078561068 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.078603029 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.078634977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.078644037 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.078669071 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.079511881 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.079569101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.079575062 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.079874039 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.079925060 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.079932928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.080696106 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.080751896 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.080759048 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.080766916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.080796957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.080811024 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.080817938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.080857038 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.164313078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.164421082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.164433956 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.164459944 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.164518118 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.164531946 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.165107965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.165155888 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.165162086 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.165164948 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.165185928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.165208101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.166002035 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.166053057 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.166261911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.166270971 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.166795015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.166842937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.166884899 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.166884899 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.166893959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.167531967 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.167579889 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.167586088 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.167597055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.167623043 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.168354988 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.168402910 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.168425083 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.168431997 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.168442965 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.169152975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.169194937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.169236898 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.169236898 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.169245005 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.173223019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.173274994 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.173295975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.173304081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.173321009 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.173795938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.173837900 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.173867941 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.173875093 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.173897028 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.174838066 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.174886942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.174899101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.174905062 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.174928904 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.174930096 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.175020933 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.175028086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.175657034 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.175707102 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.175735950 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.175744057 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.175770044 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.176745892 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.176805973 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.176809072 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.176852942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.176928997 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.177620888 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.177658081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.177679062 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.177689075 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.177737951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.177737951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.256393909 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.256453037 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.256521940 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.256540060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.256577015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.256670952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.258430004 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.258482933 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.258498907 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.258507013 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.258543015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.258557081 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.259928942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.259973049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.260004997 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.260021925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.260031939 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.260153055 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.261862040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.261905909 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.261919975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.261955976 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.261974096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.261974096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.263421059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.263468981 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.263478994 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.263500929 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.263515949 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.264235973 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.264277935 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.264295101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.264305115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.264326096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.264345884 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.266050100 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.266087055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.266113043 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.266127110 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.266139984 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.266169071 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.345175982 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.345252991 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.345257998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.345289946 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.345324039 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.345386982 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.346067905 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.346127033 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.346132040 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.346147060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.346182108 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.347479105 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.347547054 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.347587109 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.347598076 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.347609997 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.348428965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.348494053 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.348505974 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.348526955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.348589897 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.350112915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.350174904 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.350229025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.350229025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.350264072 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.351854086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.351907969 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.351957083 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.351957083 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.351980925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.351995945 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.353728056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.353789091 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.353795052 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.353811979 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.353844881 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.354526043 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.354581118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.354588032 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.354602098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.354739904 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.436534882 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.436602116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.436647892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.436671019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.436734915 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.436734915 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.437946081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.438004017 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.438028097 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.438036919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.438067913 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.439321995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.439374924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.439392090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.439400911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.439430952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.440536976 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.440594912 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.440603971 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.440618038 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.440654993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.442249060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.442310095 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.442317009 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.442327023 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.442370892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.443521023 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.443578959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.443583012 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.443593979 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.443643093 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.444783926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.444837093 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.444855928 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.444864988 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.444910049 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.445641041 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.445699930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.445710897 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.445718050 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.445775986 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.525217056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.525283098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.525343895 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.525343895 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.525366068 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.525482893 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.525782108 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.525840044 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.525840044 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.525856018 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.525909901 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.527127028 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.527182102 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.527188063 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.527199030 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.527234077 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.529218912 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.529268026 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.529272079 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.529292107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.529313087 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.530142069 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.530195951 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.530221939 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.530231953 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.530245066 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.532783985 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.532839060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.532860994 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.532874107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.532902956 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.533821106 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.533873081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.533874989 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.533894062 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.533967972 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.534938097 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.534998894 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.535005093 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.535020113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.535079002 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.535245895 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.535298109 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.535304070 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.535315990 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.535352945 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.535409927 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.614788055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.614851952 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.615130901 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.615154982 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.615196943 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.616087914 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.616146088 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.616149902 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.616173029 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.616223097 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.617683887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.617746115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.617768049 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.617775917 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.617824078 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.618720055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.618778944 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.618813992 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.618822098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.618835926 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.619714975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.619769096 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.619786978 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.619795084 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.619826078 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.620752096 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.620810986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.620835066 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.620845079 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.620898008 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.622618914 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.622683048 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.622693062 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.622701883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.622745037 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.623395920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.623457909 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.623467922 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.623507023 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.623574972 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.704346895 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.704410076 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.704451084 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.704451084 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.704464912 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.704500914 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.704535961 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.705554008 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.705611944 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.705615997 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.705626965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.705667973 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.705677986 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.706912041 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.706970930 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.706981897 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.707073927 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.708009958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.708070040 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.708079100 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.708092928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.708142042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.709001064 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.709055901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.709064007 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.709073067 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.709117889 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.709175110 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.710870981 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.710926056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.710941076 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.710948944 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.711004019 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.711019993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.711770058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.711827040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.711831093 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.711842060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.711874962 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.800270081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.800348043 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.800363064 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.800389051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.800406933 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.800504923 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.800873041 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.800936937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.801140070 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.801150084 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.801201105 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.801985979 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.802048922 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.802102089 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.802110910 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.802124977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.802730083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.802784920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.802803993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.802810907 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.802860022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.803421974 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.803481102 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.803504944 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.803512096 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.803600073 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.804428101 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.804497004 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.804505110 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.804522038 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.804588079 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.805408955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.805464029 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.805483103 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.805490017 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.805517912 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.806552887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.806612968 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.806644917 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.806653023 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.806816101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.975786924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.975857973 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.975946903 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.975946903 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.975972891 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.976006031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.976428032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.976438999 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.976464033 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.976506948 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.976507902 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.976525068 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.976541042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.976552010 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.976583958 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.976583958 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.977168083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.977178097 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.977237940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.977241993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.977250099 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.977267981 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.977282047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.978533983 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.978594065 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.978600979 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.978610992 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.978630066 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.978647947 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.978702068 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.978986979 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.980053902 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.980112076 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.980160952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.980160952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.980170012 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.982853889 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.982914925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.982917070 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.982929945 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.982973099 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.983870983 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.983926058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.983967066 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.983967066 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.983975887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.985352039 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.985410929 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.985467911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.985467911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:35.985477924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:35.988655090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.152587891 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.152656078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.152791023 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.152817011 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.152894974 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.153772116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.153836012 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.153856039 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.153863907 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.153906107 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.154643059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.154706001 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.154726982 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.154735088 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.154793024 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.155899048 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.155953884 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.155987024 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.155994892 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.156012058 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.156759024 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.156819105 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.156831026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.156838894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.156877995 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.163363934 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.163424969 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.163454056 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.163461924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.163474083 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.164627075 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.164686918 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.164690971 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.164704084 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.164757967 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.164757967 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.165637016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.165690899 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.165713072 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.165720940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.165811062 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.255135059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.255198002 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.255250931 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.255250931 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.255268097 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.255320072 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.257220984 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.257262945 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.257282019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.257292986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.257301092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.257312059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.257376909 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.258089066 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.258147955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.258164883 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.258166075 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.258187056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.258259058 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.259321928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.259377956 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.259409904 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.259418964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.259434938 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.260159969 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.260220051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.260253906 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.260262966 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.260272980 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.261955976 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.262017965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.262022018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.262037039 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.262077093 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.262937069 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.262995005 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.263006926 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.263016939 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.263041973 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.263900995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.263968945 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.263974905 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.263984919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.264020920 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.344435930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.344510078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.344543934 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.344558001 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.344568014 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.346910000 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.346956968 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.346966028 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.346981049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.346992970 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.347007036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.347027063 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.347048998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.347867012 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.347923994 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.347924948 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.347940922 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.347975969 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.348292112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.348347902 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.348349094 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.348361015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.348400116 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.350109100 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.350166082 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.350181103 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.350188971 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.350208998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.351092100 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.351150990 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.351161003 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.351170063 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.351205111 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.351990938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.352052927 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.352058887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.352075100 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.352108002 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.352737904 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.352792978 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.352801085 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.352814913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.352849960 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.363384008 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.433132887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.433196068 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.433278084 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.433290958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.433301926 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.433429956 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.435909033 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.435964108 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.435976982 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.435986042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.436012983 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.436037064 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.436846972 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.436904907 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.436911106 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.436918974 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.436956882 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.438244104 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.438297987 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.438316107 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.438323021 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.438338041 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.438749075 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.438807964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.438808918 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.438823938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.438867092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.439749956 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.439804077 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.439816952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.439826965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.439850092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.440455914 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.440522909 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.440531015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.440546989 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.440597057 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.441071987 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.441129923 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.441132069 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.441144943 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.441178083 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.522160053 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.522228003 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.522274017 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.522308111 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.522325039 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.522341967 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.524678946 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.524739027 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.524774075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.524782896 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.524794102 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.525466919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.525517941 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.525525093 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.525541067 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.525578022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.526350021 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.526406050 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.526416063 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.526422977 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.526448965 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.526796103 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.526848078 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.526858091 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.526873112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.526910067 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.528168917 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.528222084 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.528238058 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.528245926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.528263092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.528820038 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.528870106 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.528877974 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.528889894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.528924942 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.529005051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.529057026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.529057026 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.529073000 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.529107094 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.555535078 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.611402988 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.611468077 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.611494064 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.611510038 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.611530066 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.611622095 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.613626957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.613698959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.613698959 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.613713980 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.613759995 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.613809109 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.614682913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.614742041 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.614752054 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.614761114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.614794970 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.614855051 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.615535975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.615592957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.615614891 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.615622044 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.615647078 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.615706921 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.616389990 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.616445065 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.616455078 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.616461992 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.616503954 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.616559029 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.617149115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.617211103 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.617211103 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.617225885 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.617269993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.618213892 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.618271112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.618285894 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.618309975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.618323088 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.618372917 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.618388891 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.618453979 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.618457079 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.618468046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.618524075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.618731022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.700452089 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.700522900 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.700547934 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.700562000 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.700572968 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.700700045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.702635050 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.702689886 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.702702045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.702708960 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.702745914 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.702800035 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.703615904 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.703677893 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.703694105 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.703701973 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.703767061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.703809023 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.704308033 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.704369068 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.704375029 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.704381943 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.704458952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.704458952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.705420971 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.705488920 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.705490112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.705506086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.705549955 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.705566883 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.706163883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.706217051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.706223965 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.706232071 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.706269026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.706319094 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.706872940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.706928968 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.706938028 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.706945896 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.706993103 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.707032919 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.707041025 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.707098007 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.707098007 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.707113028 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.707154036 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.707335949 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.789635897 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.789700031 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.789716005 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.789729118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.789752007 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.789844990 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.793704033 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.793760061 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.793776989 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.793785095 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.793812990 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.793869019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.793883085 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.793889046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.793905020 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.793935061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.793936968 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.793957949 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.793994904 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.794070959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.794125080 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.794131994 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.794141054 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.794183016 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.794317007 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.794620037 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.794682026 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.794687033 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.794697046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.794735909 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.795332909 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.795377016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.795438051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.795439959 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.795450926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.795501947 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.795874119 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.796097040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.796152115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.796163082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.796169996 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.796211004 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.796432018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.796804905 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.796861887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.796868086 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.796878099 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.796911001 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.796978951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.880758047 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.880834103 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.880867004 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.880881071 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.880892038 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.881027937 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.882513046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.882577896 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.882584095 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.882594109 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.882642031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.882666111 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.883259058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.883331060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.883332014 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.883347988 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.883383036 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.883413076 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.884011984 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.884069920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.884073019 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.884084940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.884126902 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.884155989 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.884764910 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.884823084 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.884829998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.884838104 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.884876013 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.884919882 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.885462046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.885524035 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.885535955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.885598898 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.886179924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.886238098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.886245012 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.886251926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.886292934 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.886997938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.887057066 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.887063026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.887073040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.887130022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.887209892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.969798088 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.969861984 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.969877958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.969919920 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.970496893 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.970555067 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.970566988 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.970585108 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.970601082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.970635891 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.971366882 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.971411943 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.971425056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.971483946 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.971923113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.971983910 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.971985102 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.972001076 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.972031116 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.972795010 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.972843885 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.972860098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.972883940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.972935915 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.972944021 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.973218918 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.973417044 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.973465919 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.973474026 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.973489046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.973516941 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.973557949 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.974306107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.974368095 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.974383116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.974435091 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.974880934 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.974946022 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.974953890 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:36.974971056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:36.975006104 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.059519053 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.059601068 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.059676886 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.059693098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.059700966 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.059803009 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.060094118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.060106993 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.060144901 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.060161114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.060230017 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.060641050 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.060692072 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.060698032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.060722113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.060739040 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.061451912 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.061506033 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.061513901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.061530113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.061568975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.062119007 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.062174082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.062175035 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.062191010 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.062223911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.067296982 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.067363977 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.067392111 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.067399979 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.067409992 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.067677021 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.067732096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.067738056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.067754984 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.067785025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.067862034 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.067913055 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.067917109 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.067933083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.067967892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.068015099 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.148190022 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.148261070 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.148319960 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.148334026 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.148499966 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.148499966 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.149153948 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.149211884 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.149214983 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.149231911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.149260998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.149713993 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.149774075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.149781942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.149796963 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.149827957 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.150675058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.150731087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.150732040 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.150748014 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.150775909 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.151504993 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.151555061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.151561975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.151578903 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.151624918 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.151629925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.152163029 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.152211905 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.152215958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.152232885 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.152261019 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.152726889 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.152776957 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.152790070 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.152805090 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.152848959 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.153285027 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.153337955 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.153341055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.153353930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.153386116 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.239002943 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.239079952 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.239243984 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.239264965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.239293098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.239335060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.239343882 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.239352942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.239365101 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.239382982 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.239391088 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.239428997 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.239527941 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.240073919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.240133047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.240139008 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.240154982 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.240186930 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.240849972 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.240909100 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.240917921 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.240942955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.240982056 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.242824078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.242889881 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.242889881 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.242907047 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.242935896 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.243221045 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.243273973 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.243278980 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.243294001 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.243324041 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.244281054 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.244343042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.244343042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.244362116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.244390011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.244507074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.244554043 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.244570017 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.244590998 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.244635105 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.244645119 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.244740963 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.326782942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.326849937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.326947927 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.326947927 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.326977968 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.327214003 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.327343941 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.327409029 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.327454090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.327454090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.327469110 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.327487946 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.328167915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.328229904 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.328275919 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.328275919 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.328293085 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.328764915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.328819036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.328845024 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.328860044 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.328886032 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.329907894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.329968929 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.330013990 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.330024958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.330051899 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.330843925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.330904007 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.330950975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.330962896 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.330981970 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.331273079 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.331326008 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.331334114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.331348896 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.331439972 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.332107067 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.332163095 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.332189083 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.332196951 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.332226992 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.417969942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.418047905 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.418111086 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.418143988 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.418160915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.418168068 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.418179989 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.418234110 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.418255091 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.418262959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.418281078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.418348074 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.418348074 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.418935061 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.418997049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.419024944 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.419039965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.419054031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.419625998 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.419681072 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.419725895 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.419739962 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.419792891 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.421855927 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.421916008 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.421941042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.421957016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.422019958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.422063112 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.422063112 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.422075987 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.422091961 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.422121048 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.422214031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.422992945 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.423048019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.423055887 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.423072100 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.423116922 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.423276901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.423336029 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.423387051 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.423387051 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.423398972 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.423465967 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.505317926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.505384922 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.505393982 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.505409956 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.505461931 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.505500078 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.506253958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.506309986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.506335974 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.506346941 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.506356955 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.506378889 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.507540941 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.507606030 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.507642984 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.507656097 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.507683992 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.508382082 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.508435965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.508467913 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.508479118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.508505106 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.511643887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.511706114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.511723042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.511732101 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.511780977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.511794090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.512183905 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.512242079 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.512249947 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.512257099 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.512341022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.512631893 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.512689114 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.512696981 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.512717962 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.512773991 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.513237953 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.513293028 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.513324976 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.513330936 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.513354063 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.594258070 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.594329119 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.594398975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.594398975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.594415903 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.594433069 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.595444918 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.595499992 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.595530987 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.595542908 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.595570087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.595582962 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.595608950 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.596414089 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.596472025 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.596503019 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.596515894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.596530914 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.597203016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.597258091 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.597265959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.597280979 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.597321033 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.600188971 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.600241899 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.600270987 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.600281954 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.600296974 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.601175070 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.601234913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.601285934 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.601285934 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.601299047 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.601350069 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.601397991 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.601403952 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.601421118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.601440907 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.601475954 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.601603031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.601756096 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.601807117 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.601816893 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.601830006 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.601895094 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.684210062 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.684278965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.684391022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.684406996 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.684441090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.684961081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.685020924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.685045958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.685045958 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.685060978 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.685075998 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.685110092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.688713074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.688776016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.688811064 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.688822031 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.688832998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.689135075 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.689188957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.689213037 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.689223051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.689254999 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.689549923 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.689593077 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.689604044 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.689620972 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.689668894 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.689677954 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.690274954 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.690331936 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.690367937 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.690382957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.690409899 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.690601110 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.690658092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.690661907 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.690677881 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.690720081 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.691055059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.691111088 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.691137075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.691145897 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.691181898 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.703742027 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.772659063 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.772727966 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.772779942 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.772779942 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.772806883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.772860050 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.773638964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.773703098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.773746014 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.773746967 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.773756027 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.778784990 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.778857946 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.778873920 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.778896093 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.778969049 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.779333115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.779390097 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.779426098 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.779442072 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.779455900 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.779850006 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.779915094 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.779936075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.779943943 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.779978991 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.780437946 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.780499935 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.780509949 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.780520916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.780591965 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.780599117 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.780635118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.780702114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.780740976 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.780740976 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.780750036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.780760050 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.780844927 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.781162977 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.781220913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.781259060 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.781266928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.781301975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.862457991 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.862530947 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.862601042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.862616062 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.862641096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.862678051 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.863940001 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.863961935 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.864025116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.864069939 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.864069939 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.864080906 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.868268967 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.868351936 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.868397951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.868397951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.868418932 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.868479013 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.868552923 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.868561983 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.868572950 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.868585110 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.868685007 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.868690014 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.868737936 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.869119883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.869179010 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.869220972 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.869220972 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.869232893 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.869330883 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.869724989 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.869782925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.869822979 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.869822979 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.869833946 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.870277882 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.870332003 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.870341063 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.870357037 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.870403051 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.870886087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.870942116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.870995998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.870995998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.871007919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.951884031 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.951968908 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.952027082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.952027082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.952063084 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.952083111 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.952271938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.952286959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.952341080 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.952353954 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.952385902 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.952385902 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.952399969 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.952436924 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.952534914 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.957655907 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.957722902 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.957750082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.957777977 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.957792044 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.957849026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.958461046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.958528996 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.958576918 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.958576918 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.958591938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.958640099 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.958694935 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.958745003 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.958745003 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.958754063 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.958865881 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.959908009 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.959974051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.960017920 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.960017920 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.960031033 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.960191965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.960254908 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.960300922 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.960300922 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.960309982 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.960417986 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.960562944 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.960633039 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.960674047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.960674047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:37.960680962 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:37.960865974 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.040842056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.040915012 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.040926933 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.040946960 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.040988922 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.041105032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.041152000 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.041158915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.041182041 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.041251898 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.041259050 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.046506882 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.046574116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.046627045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.046627045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.046650887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.047074080 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.047125101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.047137976 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.047162056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.047219992 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.047641039 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.047694921 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.047707081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.047796965 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.048052073 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.048101902 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.048109055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.048120975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.048211098 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.048980951 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.049036980 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.049038887 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.049050093 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.049114943 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.049427032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.049483061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.049489975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.049505949 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.049582958 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.049884081 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.130517960 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.130590916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.130743027 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.130743027 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.130772114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.130788088 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.132030964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.132091045 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.132128954 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.132138014 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.132220030 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.135907888 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.135968924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.136007071 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.136018991 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.136028051 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.136670113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.136737108 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.136759043 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.136786938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.136850119 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.137245893 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.137305975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.137315035 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.137324095 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.137386084 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.137583017 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.137640953 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.137670994 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.137677908 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.137780905 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.138662100 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.138721943 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.138737917 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.138745070 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.138844967 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.139195919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.139250040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.139280081 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.139287949 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.139319897 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.219659090 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.219734907 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.220056057 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.220082045 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.220107079 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.220681906 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.220738888 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.220751047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.220761061 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.220767975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.220791101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.220870018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.224035978 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.224692106 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.224750042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.224793911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.224793911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.224807978 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.225148916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.225209951 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.225275040 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.225281954 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.225311041 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.225895882 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.225949049 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.225950003 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.225971937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.226002932 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.226871967 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.226932049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.226982117 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.226982117 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.226994038 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.227543116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.227603912 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.227653027 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.227653027 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.227662086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.227812052 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.227873087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.227925062 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.227925062 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.227932930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.228197098 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.310635090 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.310684919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.310776949 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.310800076 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.310971975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.311702013 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.311744928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.311783075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.311793089 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.311816931 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.311816931 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.313891888 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.313936949 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.313951015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.313961029 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.314047098 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.314574003 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.314619064 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.314639091 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.314646959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.314665079 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.314717054 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.315267086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.315309048 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.315340996 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.315347910 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.315402031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.316135883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.316190958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.316241026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.316241026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.316251040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.316279888 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.317136049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.317179918 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.317202091 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.317214012 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.317245960 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.317245960 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.318167925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.318212986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.318252087 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.318263054 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.318294048 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.399671078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.399724960 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.399910927 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.399912119 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.399941921 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.400826931 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.400866985 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.400890112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.400899887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.400907040 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.400921106 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.400963068 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.400963068 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.402936935 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.402981043 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.403016090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.403033972 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.403054953 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.403054953 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.403687000 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.403736115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.403781891 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.403781891 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.403796911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.404144049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.404181957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.404227018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.404227018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.404237986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.404324055 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.405076027 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.405124903 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.405164003 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.405179024 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.405193090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.405519962 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.405567884 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.405571938 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.405586004 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.406045914 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.406074047 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.406114101 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.406131029 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.406141996 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.406193018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.488332987 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.488385916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.488430977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.488446951 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.488456011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.488734961 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.489856958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.489871025 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.489907980 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.489944935 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.489944935 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.489953995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.490340948 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.491940022 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.492001057 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.492016077 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.492024899 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.492057085 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.493040085 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.493087053 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.493127108 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.493139982 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.493156910 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.493156910 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.493629932 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.493674994 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.493701935 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.493709087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.493801117 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.494247913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.494288921 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.494338036 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.494338036 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.494347095 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.494363070 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.494546890 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.494592905 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.494636059 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.494643927 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.494653940 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.494776011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.497642994 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.497694016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.497737885 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.497737885 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.497750044 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.498017073 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.578718901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.578768969 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.578789949 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.578807116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.578840017 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.579169035 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.579771996 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.579783916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.579818964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.579828978 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.579835892 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.579890013 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.579890013 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.580852985 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.580895901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.580945015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.580945015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.580957890 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.581027031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.581638098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.581682920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.581939936 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.581947088 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.581974030 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.581974030 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.582257032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.582303047 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.582353115 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.582353115 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.582360983 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.583024025 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.583067894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.583120108 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.583120108 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.583128929 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.583568096 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.583607912 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.583659887 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.583659887 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.583667040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.584110975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.586668015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.586709976 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.586760044 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.586760044 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.586767912 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.586869955 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.667337894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.667397022 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.667519093 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.667541027 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.667613029 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.668571949 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.668591022 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.668628931 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.668642044 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.668649912 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.668658018 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.668693066 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.668693066 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.668761015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.670229912 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.670280933 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.670311928 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.670311928 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.670321941 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.670614958 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.670861006 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.670908928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.670958042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.670958042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.670967102 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.671371937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.671415091 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.671466112 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.671466112 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.671474934 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.672192097 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.672240973 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.672292948 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.672292948 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.672301054 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.672657967 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.672698975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.672739029 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.672746897 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.672759056 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.672759056 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.675312042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.675364971 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.675394058 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.675401926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.675421953 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.759563923 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.759618998 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.759691954 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.759691954 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.759711981 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.759854078 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.759910107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.759919882 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.759968042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.760006905 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.760015965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.760032892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.760133028 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.760925055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.760970116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.760983944 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.760998011 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.761019945 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.761044025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.761399031 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.761442900 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.761467934 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.761476040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.761493921 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.761586905 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.761879921 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.761929035 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.761956930 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.761965990 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.761990070 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.762526989 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.762569904 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.762619019 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.762619019 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.762629986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.763403893 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.763457060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.763516903 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.763516903 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.763528109 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.764941931 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.764987946 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.764995098 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.765002966 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.765073061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.848242044 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.848298073 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.848351002 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.848351002 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.848381042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.848706961 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.848952055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.848995924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.849024057 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.849031925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.849045038 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.849144936 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.849443913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.849486113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.849493980 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.849502087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.849555016 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.849761009 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.850311995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.850358963 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.850395918 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.850404024 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.850423098 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.850492954 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.850862980 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.850905895 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.850954056 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.850954056 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.850963116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.850990057 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.851366043 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.851413965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.851421118 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.851428986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.851479053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.852096081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.852134943 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.852164984 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.852173090 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.852199078 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.852452993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.854031086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.854077101 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.854104042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.854111910 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.854129076 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.854182959 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.958926916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.958981037 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.959053993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.959069967 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.959125042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.959162951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.959564924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.959614038 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.959660053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.959660053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.959667921 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.959685087 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.960186958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.960232019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.960280895 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.960280895 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.960289955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.960937977 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.960982084 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.960994005 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.961002111 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.961031914 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.961699009 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.961747885 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.961781025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.961787939 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.961827993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.961832047 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.961880922 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.961890936 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.961904049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.961945057 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.962030888 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.962694883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.962747097 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.962773085 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.962783098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.962793112 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.962872028 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.963675022 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.963721037 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.963758945 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.963766098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:38.963776112 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:38.964010954 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.047991037 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.048044920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.048186064 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.048186064 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.048202038 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.048221111 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.048573971 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.048615932 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.048631907 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.048640966 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.048665047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.048706055 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.049103022 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.049146891 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.049158096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.049165964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.049223900 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.049223900 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.049793959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.049832106 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.049866915 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.049875021 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.049932957 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.050265074 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.050487041 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.050523043 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.050551891 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.050551891 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.050559998 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.050571918 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.050648928 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.051348925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.051398039 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.051445961 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.051445961 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.051456928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.051469088 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.051491976 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.051539898 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.051559925 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.051567078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.051599026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.051704884 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.052514076 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.052556038 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.052607059 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.052607059 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.052615881 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.052653074 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.136940002 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.136995077 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.137041092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.137041092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.137057066 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.137167931 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.137857914 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.137867928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.137902021 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.137934923 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.137942076 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.137967110 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.137979031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.138824940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.138873100 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.138916016 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.138916016 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.138925076 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.138938904 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.139662027 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.139700890 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.139717102 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.139728069 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.139780045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.139780045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.140661001 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.140703917 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.140713930 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.140727997 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.140737057 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.140765905 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.140774965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.140791893 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.140798092 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.140814066 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.140815973 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.140863895 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.140872955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.141057968 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.142735958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.142779112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.142826080 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.142826080 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.142842054 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.142877102 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.144846916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.144892931 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.144912004 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.144922972 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.144942045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.144942045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.145030022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.234138966 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.234193087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.234333038 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.234345913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.234431982 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.234793901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.234838009 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.234858036 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.234868050 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.234898090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.234951019 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.235563993 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.235609055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.235620022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.235630989 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.235677004 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.235677004 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.235682964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.235698938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.235738993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.235743999 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.235757113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.235826969 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.235923052 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.240691900 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.240739107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.240761042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.240768909 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.240782976 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.240832090 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.240850925 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.240860939 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.240883112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.240883112 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.240957022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.240963936 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.241046906 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.241059065 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.241069078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.241090059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.241132021 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.241132021 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.241142035 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.241169930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.241214991 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.241238117 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.241245985 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:39.241303921 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:39.241496086 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.349562883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.349582911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.349631071 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.349673986 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.349690914 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.349701881 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.349731922 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.349775076 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.351135015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.351183891 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.351200104 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.351206064 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.351229906 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.351258039 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.352339983 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.352385998 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.352401018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.352406979 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.352432966 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.352453947 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.355015993 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.355062008 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.355214119 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.355214119 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.355214119 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.355262041 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.356198072 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.356249094 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.356260061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.356267929 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.356292963 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.357441902 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.357484102 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.357506037 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.357516050 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.357543945 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.358445883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.358490944 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.358510971 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.358517885 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.358535051 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.359774113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.359817028 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.359837055 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.359846115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.359855890 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.359999895 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.360748053 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.360791922 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.360807896 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.360816002 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.360832930 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.361886024 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.361929893 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.361944914 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.361954927 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.361980915 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.362737894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.362782001 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.362792015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.362803936 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.362828016 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.364695072 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.364737034 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.364763021 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.364789963 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.364814043 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.364814043 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.364814043 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.365628958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.365668058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.365681887 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.365693092 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.365720034 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.367779016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.367822886 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.367839098 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.367862940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.367877007 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.368058920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.368098021 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.368102074 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.368118048 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.368154049 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.369734049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.369781971 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.369782925 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.369796991 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.369805098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.369815111 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.369822025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.369831085 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.370356083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.370398998 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.370418072 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.370429039 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.370440006 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.370897055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.370940924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.370953083 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.370970964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.370985985 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.371984005 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.372025013 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.372045994 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.372066975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.372077942 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.372890949 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.372936010 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.372941971 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.372956038 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.372984886 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.373661995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.373703003 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.373716116 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.373727083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.373752117 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.374800920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.374849081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.374864101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.374877930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.374898911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.375399113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.375442028 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.375448942 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.375459909 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.375495911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.376271963 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.376313925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.376321077 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.376338005 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.376353025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.376398087 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.616616964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.616688967 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.616760015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.616787910 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.616842985 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.616843939 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.617393970 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.617456913 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.617461920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.617477894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.617500067 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.618182898 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.618243933 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.618254900 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.618273020 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.618308067 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.619168043 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.619235039 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.619242907 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.619282007 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.619309902 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.620127916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.620198011 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.620203018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.620220900 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.620253086 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.621262074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.621326923 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.621331930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.621350050 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.621378899 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.622066975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.622144938 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.622147083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.622164965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.622199059 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.623944998 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.624015093 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.624017954 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.624044895 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.624062061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.625006914 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.625067949 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.625087023 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.625106096 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.625144005 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.626077890 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.626142025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.626147032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.626163960 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.626193047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.626987934 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.627052069 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.627058029 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.627074957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.627099991 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.627966881 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.628026009 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.628037930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.628056049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.628091097 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.628964901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.629024029 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.629025936 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.629045010 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.629071951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.630000114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.630059958 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.630073071 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.630089998 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.630125999 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.630950928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.631011963 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.631019115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.631033897 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.631057024 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.631939888 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.632004023 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.632019997 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.632039070 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.632076979 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.633138895 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.633214951 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.633227110 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.633259058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.633286953 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.633981943 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.634056091 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.634072065 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.634093046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.634134054 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.634947062 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.635011911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.635021925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.635039091 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.635068893 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.636671066 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.636734009 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.636745930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.636765003 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.636790037 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.637965918 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.638030052 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.638036013 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.638052940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.638084888 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.638875008 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.638947964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.638947964 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.638968945 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.639002085 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.639763117 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.639822960 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.639838934 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.639854908 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.639892101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.640721083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.640784025 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.640785933 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.640809059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.640827894 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.641545057 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.641601086 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.641609907 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.641625881 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.641664982 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.641711950 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.641757011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.641763926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.641777992 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.641808987 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.641823053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.642621994 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.642687082 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.642687082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.642702103 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.642726898 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.643655062 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.643708944 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.643723965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.643739939 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.643769979 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.643801928 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.644717932 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.644781113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.644813061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.644836903 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.644850969 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.644907951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.645756006 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.645823002 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.645837069 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.645858049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.645874977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.645912886 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.645927906 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.645975113 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.645988941 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.646006107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.646033049 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.646123886 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.647799015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.647866964 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.647875071 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.647892952 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.647922993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.648765087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.648823023 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.648829937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.648849010 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.648878098 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.650588036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.650650024 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.650649071 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.650670052 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.650700092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.653295994 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.653359890 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.653387070 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.653417110 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.653431892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.653470039 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.653490067 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.653497934 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.653510094 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.653544903 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.653589010 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.653595924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.653738976 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.653943062 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.654000998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.654014111 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.654028893 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.654063940 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.654151917 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.654716015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.654772043 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.654778004 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.654799938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.654814959 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.654846907 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.656274080 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.656332016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.656335115 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.656361103 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.656378031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.657174110 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.657232046 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.657233953 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.657249928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.657284975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.658113956 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.658169985 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.658174992 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.658200979 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.658217907 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.659179926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.659238100 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.659241915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.659269094 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.659302950 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.659992933 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.660053015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.660065889 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.660084009 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.660104036 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.660132885 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.660821915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.660882950 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.660887003 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.660898924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.660931110 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.661767960 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.661828995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.661828041 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.661844015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.661879063 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.662691116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.662746906 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.662754059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.662772894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.662792921 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.663477898 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.663535118 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.663542986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.663562059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.663594007 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.664396048 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.664452076 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.664458990 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.664474010 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.664506912 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.664530993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.665330887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.665388107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.665389061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.665401936 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.665431976 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.667092085 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.667151928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.667156935 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.667175055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.667193890 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.667223930 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.667973995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.668034077 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.668034077 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.668050051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.668072939 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.668994904 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.669060946 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.669064045 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.669080019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.669110060 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.669806957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.669862032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.669863939 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.669877052 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.669928074 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.670511007 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.670569897 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.670582056 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.670593977 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.670605898 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.670663118 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.671441078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.671499968 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.671513081 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.671525955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.671547890 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.671672106 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.672365904 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.672425985 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.672437906 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.672446966 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.672471046 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.672509909 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.673316956 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.673377037 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.673382044 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.673396111 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.673418045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.674005032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.674065113 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.674073935 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.674092054 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.674132109 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.674139023 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.674880028 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.674933910 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.674942017 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.674961090 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.674990892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.675791025 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.675848007 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.675852060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.675867081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.675896883 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.676654100 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.676707983 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.676722050 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.676732063 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.676738977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.676755905 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.676789045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.677432060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.677484035 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.677491903 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.677505016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.677532911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.678399086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.678457975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.678459883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.678474903 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.678504944 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.679264069 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.679325104 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.679327011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.679341078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.679366112 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.680807114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.680869102 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.680871964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.680886984 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.680927992 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.681716919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.681773901 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.681783915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.681802034 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.681840897 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.682621956 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.682684898 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.682687998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.682703972 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.682733059 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.682758093 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.683551073 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.683608055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.683620930 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.683631897 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.683655024 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.683696032 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.684195995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.684253931 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.684263945 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.684276104 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.684294939 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.685210943 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.685270071 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.685271025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.685286999 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.685318947 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.685379028 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.685422897 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.685432911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.685446978 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.685468912 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.685487986 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.685492992 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.685610056 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.686167002 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.686224937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.686225891 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.686239958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.686270952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.687494040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.687551022 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.687560081 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.687575102 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.687597036 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.687650919 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.688271046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.688327074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.688342094 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.688352108 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.688370943 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.688405991 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.688837051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.688888073 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.688898087 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.688908100 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.688932896 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.688962936 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.688966036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.688982010 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.689016104 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.689035892 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.689080954 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.689245939 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.689646006 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.689702034 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.689702988 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.689717054 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.689752102 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.689905882 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.690535069 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.690596104 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.690597057 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.690612078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.690644979 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.690752029 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.691534042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.691592932 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.691598892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.691610098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.691641092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.691663980 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.692244053 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.692305088 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.692307949 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.692322016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.692347050 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.692377090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.692403078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.692450047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.692456961 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.692470074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.692523956 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.692775011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.693229914 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.693295002 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.693296909 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.693314075 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.693341017 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.693497896 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.703156948 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.703226089 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.703255892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.703278065 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.703291893 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.703411102 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.703994036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.704055071 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.704056025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.704072952 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.704101086 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.704123974 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.704674959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.704736948 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.704750061 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.704763889 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.704798937 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.704859018 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.704905033 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.704909086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.704922915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.704952955 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.704967022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.743020058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.743089914 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.743151903 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.743176937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.743187904 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.743309021 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.804425955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.804491997 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.804574013 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.804591894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.804601908 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.804698944 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.805376053 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.805421114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.805445910 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.805455923 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.805464983 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.805470943 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.805505991 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.805711031 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.805754900 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.805756092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.805769920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.805799007 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.805840015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.818089962 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.818150043 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.818172932 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.818191051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.818202972 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.818217039 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.818783998 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.818835974 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.818844080 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.818855047 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.818886042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.819259882 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.819303036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.819314003 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.819320917 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.819355011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.820161104 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.820208073 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.820220947 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.820244074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.820256948 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.820287943 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.831902981 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.831954956 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.832007885 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.832031965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.832063913 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.832063913 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.893163919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.893215895 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.893273115 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.893291950 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.893301964 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.893404961 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.893760920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.893805027 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.893820047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.893829107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.893853903 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.893882036 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.894234896 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.894277096 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.894294977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.894301891 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.894325972 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.894346952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.906943083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.906991959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.907028913 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.907047033 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.907105923 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.907105923 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.907681942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.907727003 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.907741070 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.907762051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.907780886 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.907809973 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.908070087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.908111095 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.908123016 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.908135891 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.908158064 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.908193111 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.908793926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.908839941 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.908850908 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.908873081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.908891916 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.908919096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.928406000 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.928452015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.928633928 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.928658009 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.928724051 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.982103109 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.982155085 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.982355118 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.982368946 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.982460976 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.982583046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.982625961 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.982639074 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.982645988 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.982667923 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.982784033 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.983371973 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.983416080 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.983431101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.983438015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.983462095 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.983491898 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.998390913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.998450994 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.998485088 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.998497009 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.998523951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.998534918 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.998583078 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.998583078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.998599052 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.998632908 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.998698950 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.998711109 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.998740911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.998752117 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.998759031 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.998779058 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.999105930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.999149084 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.999174118 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.999181032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:40.999191999 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.999209881 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:40.999316931 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.018158913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.018208027 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.018250942 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.018261909 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.018284082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.018330097 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.072530031 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.072580099 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.072616100 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.072628975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.072638035 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.072725058 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.072956085 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.073000908 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.073012114 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.073019981 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.073045969 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.073168993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.074189901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.074233055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.074245930 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.074254036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.074275017 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.074301004 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.093111992 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.093164921 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.093180895 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.093188047 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.093198061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.093215942 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.093249083 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.093791962 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.093835115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.093847990 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.093853951 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.093928099 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.093981028 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.096657991 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.096707106 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.096708059 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.096723080 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.096750975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.100461006 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.100507975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.100508928 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.100522995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.100579023 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.107671022 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.107714891 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.107738018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.107748032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.107758045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.107790947 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.166088104 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.166136026 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.166198015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.166212082 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.166241884 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.166445971 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.166906118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.166949034 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.166965961 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.166973114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.166982889 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.167018890 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.168028116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.168071985 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.168080091 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.168087006 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.168118000 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.168137074 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.180310011 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.180354118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.180371046 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.180382967 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.180401087 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.180418968 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.181304932 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.181348085 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.181355953 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.181365967 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.181390047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.181413889 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.182077885 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.182122946 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.182135105 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.182141066 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.182167053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.182188988 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.182403088 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.182445049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.182447910 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.182457924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.182493925 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.182513952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.196742058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.196794987 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.196830988 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.196841955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.196996927 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.196996927 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.255624056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.255675077 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.255698919 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.255709887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.255721092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.255791903 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.256366968 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.256412983 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.256428003 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.256433964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.256454945 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.256498098 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.257334948 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.257379055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.257390022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.257399082 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.257420063 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.257457018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.270837069 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.270890951 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.270919085 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.270927906 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.270978928 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.271771908 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.271817923 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.271826029 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.271836042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.271862984 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.272238970 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.272285938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.272290945 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.272300959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.272335052 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.272914886 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.272957087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.272969961 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.272977114 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.273003101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.273049116 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.295671940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.295722008 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.295763969 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.295777082 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.295859098 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.296001911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.352899075 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.352953911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.353020906 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.353020906 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.353040934 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.353121042 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.353375912 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.353435993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.353441954 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.353456974 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.353481054 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.353481054 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.353655100 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.353965044 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.354012012 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.354029894 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.354037046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.354077101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.354077101 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.363707066 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.363759995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.363801956 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.363801956 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.363821983 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.364386082 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.364432096 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.364438057 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.364449024 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.364478111 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.365248919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.365291119 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.365298033 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.365312099 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.365370989 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.365809917 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.365860939 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.365895033 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.365905046 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.365953922 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.384156942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.384203911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.384242058 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.384242058 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.384285927 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.384303093 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.384303093 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.442054033 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.442111015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.442169905 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.442169905 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.442203045 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.442303896 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.442713976 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.442723036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.442759037 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.442792892 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.442795038 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.442806959 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.442822933 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.442864895 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.442864895 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.443347931 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.443391085 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.443439960 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.443439960 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.443449020 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.443468094 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.452725887 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.452780008 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.452790022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.452797890 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.452872038 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.453399897 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.453439951 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.453474998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.453485012 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.453499079 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.453511953 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.454265118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.454312086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.454361916 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.454361916 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.454370975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.454714060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.454756021 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.454787970 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.454794884 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.454811096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.473220110 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.473268032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.473352909 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.473364115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.473436117 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.477576017 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.533401966 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.533449888 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.533576012 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.533590078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.533605099 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.533605099 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.534617901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.534666061 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.534682989 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.534693956 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.534744978 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.534744978 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.535310030 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.535356045 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.535376072 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.535383940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.535409927 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.556754112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.556812048 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.556839943 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.556839943 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.556864023 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.556876898 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.556907892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.566324949 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.566368103 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.566418886 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.566418886 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.566437006 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.566457033 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.566636086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.566690922 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.566720009 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.566729069 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.566757917 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.566867113 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.567353010 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.567397118 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.567420959 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.567428112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.567471981 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.567471981 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.568089008 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.568136930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.568186998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.568186998 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:41.568196058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:41.763386011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971349955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971363068 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971396923 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971412897 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971422911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971455097 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971455097 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971455097 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971473932 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971486092 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971498013 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971581936 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971647024 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971831083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971838951 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971864939 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971878052 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971893072 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971893072 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971893072 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971916914 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971935034 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971935987 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.971941948 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.971963882 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.972498894 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.972507954 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.972548962 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.972557068 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.972579956 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.972589016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.972608089 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.973455906 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.973468065 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.973506927 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.973515034 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.973522902 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.973545074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.973563910 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.974582911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.974630117 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.974653959 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.974661112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.974693060 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.974693060 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.974910975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.974953890 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.974962950 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.974972963 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.975002050 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.975064993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.975136042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.975179911 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.975188971 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.975199938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.975238085 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.975275040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.975301027 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.975307941 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.975321054 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.975328922 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.975374937 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.975383043 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.975646019 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.977657080 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.977699995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.977711916 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.977719069 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.977766037 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.977766037 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.978635073 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.978678942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.978693962 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.978703976 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.978722095 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.978754997 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.979485989 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.979531050 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.979547977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.979553938 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.979583025 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.979598999 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.979646921 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.979691982 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.979695082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.979706049 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.979736090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.979793072 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.980313063 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.980356932 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.980370045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.980376005 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.980402946 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.980453968 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.981123924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.981165886 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.981204987 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.981204987 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.981213093 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.981920958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.981966019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.982011080 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.982011080 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.982023954 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.982182026 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.982225895 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.982244015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.982250929 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.982275009 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.982352972 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.983099937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.983143091 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.983164072 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.983170986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.983192921 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.983258963 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.984046936 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.984091043 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.984133959 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.984133959 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.984143019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.984157085 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.984425068 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.984468937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.984488964 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.984494925 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.984522104 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.985486984 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.985542059 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.985573053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.985579967 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.985619068 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.985651970 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.985706091 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.985707045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.985719919 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.985765934 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.985842943 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.986399889 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.986452103 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.986452103 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.986462116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.986494064 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.986598969 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.986871004 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.986921072 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.986948967 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.986953974 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.986967087 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.987056971 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.988042116 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.988104105 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.988106966 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.988120079 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.988172054 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.988497019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.988563061 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.988579988 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.988586903 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.988607883 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.990031004 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.990098000 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.990102053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.990115881 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.990149021 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.991292953 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.991362095 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.991409063 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.991409063 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.991415977 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.991941929 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.992002010 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.992012978 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.992024899 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.992079020 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.992084026 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.992897987 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.992961884 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.992966890 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.992984056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.993011951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.994035006 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.994081974 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.994131088 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.994131088 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.994138002 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.994173050 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.994589090 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.994633913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.994641066 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.994646072 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.994695902 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.994695902 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.995750904 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.995789051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.995819092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.995819092 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.995824099 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.995874882 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.995917082 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.995959044 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.995970011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.995975018 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.996026993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.996026993 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.997127056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.997164965 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.997184992 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.997193098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.997214079 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.997288942 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.998177052 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.998214006 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.998251915 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.998251915 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.998260975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.998281956 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.998673916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.998718023 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.998723030 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.998739004 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.998759985 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.999356031 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.999393940 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.999418974 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.999425888 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.999435902 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.999481916 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.999650955 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.999690056 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.999711037 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.999715090 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:42.999731064 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:42.999890089 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.000284910 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.000322104 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.000370979 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.000370979 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.000379086 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.000394106 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.000749111 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.000791073 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.000811100 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.000816107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.000844955 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.000863075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.001626968 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.001665115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.001684904 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.001688957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.001707077 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.001745939 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.001806974 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.001844883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.001869917 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.001874924 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.001889944 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.002011061 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.002346992 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.002388000 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.002398968 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.002408028 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.002458096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.002458096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.003195047 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.003242016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.003262043 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.003268003 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.003285885 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.003308058 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.003499985 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.003544092 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.003576994 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.003586054 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.003597021 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.003667116 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.004317045 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.004364014 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.004400015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.004400015 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.004405975 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.004476070 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.004661083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.004705906 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.004722118 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.004725933 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.004749060 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.004849911 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.005429029 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.005472898 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.005476952 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.005485058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.005515099 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.005908012 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.005951881 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.005959034 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.005964041 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.005985022 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.006083965 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.006897926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.006943941 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.006958008 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.006968021 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.007013083 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.007013083 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.007529974 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.007575989 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.007591963 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.007596016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.007646084 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.008229017 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.008275986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.008286953 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.008292913 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.008321047 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.008363962 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.008408070 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.008409023 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.008420944 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.008474112 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.008583069 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.009294033 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.009339094 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.009360075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.009363890 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.009378910 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.009424925 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.010102987 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.010140896 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.010160923 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.010165930 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.010174990 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.010214090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.010214090 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.010639906 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.010679007 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.010693073 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.010700941 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.010745049 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.010745049 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.011465073 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.011503935 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.011517048 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.011522055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.011569977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.011569977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.011780977 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.011818886 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.011856079 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.011857033 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.011862993 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.011997938 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.012512922 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.012552023 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.012572050 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.012576103 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.012595892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.012646914 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.013233900 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.013284922 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.013288975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.013300896 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.013353109 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.014053106 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.014091015 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.014107943 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.014115095 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.014132977 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.014173031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.014178991 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.014218092 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.014226913 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.014233112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.014321089 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.014410019 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.015491009 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.015528917 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.015563011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.015563011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.015568972 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.015588045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.015688896 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.015728951 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.015733004 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.015743017 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.015763044 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.015779018 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.015911102 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.016521931 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.016560078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.016582012 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.016586065 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.016613007 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.016649008 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.017396927 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.017435074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.017471075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.017477036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.017499924 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.017976999 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.018019915 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.018047094 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.018053055 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.018068075 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.018096924 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.018220901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.018259048 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.018277884 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.018281937 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.018337965 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.018434048 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.019045115 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.019083023 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.019139051 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.019145012 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.019228935 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.019917011 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.019958019 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.019967079 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.019973040 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020020008 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.020020008 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.020514011 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020551920 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020587921 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.020595074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020602942 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.020636082 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.020642042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020694017 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020703077 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.020709038 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020795107 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020800114 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.020804882 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020832062 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020833969 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.020843983 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.020848036 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.020869970 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.021133900 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.021800995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.021842003 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.021858931 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.021862984 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.021883965 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.021938086 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.022917986 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.022957087 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.022989035 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.022994995 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.023008108 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.023092985 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.023137093 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.023139000 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.023148060 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.023188114 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.023220062 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.023942947 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.023983002 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.024008036 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.024012089 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.024027109 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.024049997 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.024703979 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.024744987 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.024772882 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.024779081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.024796963 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.024837017 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.024874926 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.024900913 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.024907112 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.024951935 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.025012970 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.025702953 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.025764942 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.025787115 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.025791883 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.025808096 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.025880098 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.025926113 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.025928974 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.025938034 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.025963068 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.025993109 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.026417017 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.026462078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.026494026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.026494026 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.026499033 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.026799917 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.026846886 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.026855946 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.026861906 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.026900053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.027770042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.027812958 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.027822971 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.027831078 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.027853012 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.027873039 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.028126001 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.028172016 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.028203011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.028203011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.028208971 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.028220892 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.028671980 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.028718948 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.028723001 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.028729916 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.028762102 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.029015064 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.029058933 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.029077053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.029083014 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.029095888 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.029124975 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.029690027 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.029736042 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.029745102 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.029748917 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.029781103 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.030576944 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.030622005 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.030661106 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.030661106 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.030668020 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.031099081 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.031142950 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.031145096 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.031161070 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.031219006 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.031888008 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.031930923 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.031936884 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.031944990 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.031987906 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.031987906 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.032902002 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.032943964 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.032968044 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.032973051 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.032985926 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.033041000 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.033591032 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.033634901 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.033669949 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.033669949 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.033675909 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.033900976 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.033948898 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.033957005 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.033961058 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.033987045 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.034029961 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.034698963 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.034749985 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.034760952 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.034832954 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.035619020 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.035662889 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.035696030 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.035702944 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.035712957 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.035739899 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.036221981 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.036273003 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.036277056 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.036283970 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.036314011 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.036701918 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.036747932 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.036751032 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.036761999 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.036802053 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.037221909 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.037265062 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.037269115 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.037275076 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.037312031 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.037364960 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.038017988 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.038064957 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.038070917 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.038084984 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.038125992 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.038125992 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.038352013 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.038397074 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.038429976 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.038434982 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.038474083 CEST	443	49191	104.16.149.130	192.168.2.22
Jul 1, 2024 15:22:43.038477898 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.038521051 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:43.039047956 CEST	49191	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:22:44.358661890 CEST	49192	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:44.358712912 CEST	443	49192	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:44.358797073 CEST	49192	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:44.359116077 CEST	49192	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:44.359128952 CEST	443	49192	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:44.835937023 CEST	443	49192	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:44.839219093 CEST	49192	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:44.839238882 CEST	443	49192	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:44.839299917 CEST	49192	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:44.839308023 CEST	443	49192	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:45.249823093 CEST	443	49192	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:45.249943972 CEST	443	49192	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:45.250041962 CEST	49192	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:45.250602007 CEST	49192	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:45.255548000 CEST	49193	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:45.255604029 CEST	443	49193	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:45.255671978 CEST	49193	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:45.255950928 CEST	49193	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:45.255964041 CEST	443	49193	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:45.751378059 CEST	443	49193	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:45.754388094 CEST	49193	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:45.754419088 CEST	443	49193	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:45.754466057 CEST	49193	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:45.754473925 CEST	443	49193	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:45.981002092 CEST	443	49193	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:45.981103897 CEST	443	49193	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:45.981197119 CEST	49193	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:45.981642008 CEST	49193	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:48.374130964 CEST	49194	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:48.374188900 CEST	443	49194	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:48.374347925 CEST	49194	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:48.374551058 CEST	49194	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:48.374563932 CEST	443	49194	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:48.842694998 CEST	443	49194	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:48.845760107 CEST	49194	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:48.845793009 CEST	443	49194	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:48.845937967 CEST	49194	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:48.845946074 CEST	443	49194	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.030040979 CEST	443	49194	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.030157089 CEST	443	49194	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.030242920 CEST	49194	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.030776024 CEST	49194	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.035342932 CEST	49195	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.035378933 CEST	443	49195	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.035444021 CEST	49195	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.035706997 CEST	49195	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.035722017 CEST	443	49195	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.526077032 CEST	443	49195	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.529099941 CEST	49195	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.529135942 CEST	443	49195	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.529190063 CEST	49195	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.529196978 CEST	443	49195	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.699893951 CEST	443	49195	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.700002909 CEST	443	49195	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.700079918 CEST	49195	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.700572014 CEST	49195	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.715194941 CEST	49196	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.715246916 CEST	443	49196	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:49.715318918 CEST	49196	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.715596914 CEST	49196	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:49.715605021 CEST	443	49196	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:50.198255062 CEST	443	49196	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:50.201258898 CEST	49196	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:50.201289892 CEST	443	49196	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:50.201342106 CEST	49196	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:50.201359987 CEST	443	49196	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:50.370347977 CEST	443	49196	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:50.370474100 CEST	443	49196	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:50.370516062 CEST	49196	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:50.371129036 CEST	49196	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:50.376502991 CEST	49197	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:50.376544952 CEST	443	49197	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:50.376589060 CEST	49197	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:50.376925945 CEST	49197	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:50.376944065 CEST	443	49197	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:50.854624987 CEST	443	49197	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:50.858196020 CEST	49197	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:50.858218908 CEST	443	49197	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:50.858261108 CEST	49197	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:50.858268976 CEST	443	49197	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.028455019 CEST	443	49197	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.028570890 CEST	443	49197	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.028640985 CEST	49197	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.029165030 CEST	49197	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.039393902 CEST	49198	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.039428949 CEST	443	49198	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.039479017 CEST	49198	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.039740086 CEST	49198	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.039752960 CEST	443	49198	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.515240908 CEST	443	49198	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.518198013 CEST	49198	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.518215895 CEST	443	49198	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.518279076 CEST	49198	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.518285036 CEST	443	49198	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.710971117 CEST	443	49198	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.711085081 CEST	443	49198	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.711172104 CEST	49198	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.711715937 CEST	49198	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.716130018 CEST	49199	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.716176033 CEST	443	49199	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:51.716223955 CEST	49199	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.716562986 CEST	49199	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:51.716578960 CEST	443	49199	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:52.183357954 CEST	443	49199	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:52.198909044 CEST	49199	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:52.198982000 CEST	443	49199	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:52.199031115 CEST	49199	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:52.199043989 CEST	443	49199	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:52.368628979 CEST	443	49199	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:52.368761063 CEST	443	49199	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:52.368835926 CEST	49199	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:52.369235992 CEST	49199	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:52.390180111 CEST	49200	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:52.390242100 CEST	443	49200	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:52.390294075 CEST	49200	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:52.390577078 CEST	49200	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:52.390592098 CEST	443	49200	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:52.879343987 CEST	443	49200	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:52.886399031 CEST	49200	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:52.886436939 CEST	443	49200	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:52.886476994 CEST	49200	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:52.886485100 CEST	443	49200	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.069097042 CEST	443	49200	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.069204092 CEST	443	49200	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.069355965 CEST	49200	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.069828033 CEST	49200	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.074352980 CEST	49201	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.074387074 CEST	443	49201	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.074441910 CEST	49201	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.074826002 CEST	49201	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.074832916 CEST	443	49201	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.546560049 CEST	443	49201	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.549261093 CEST	49201	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.549277067 CEST	443	49201	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.549319983 CEST	49201	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.549328089 CEST	443	49201	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.731794119 CEST	443	49201	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.731909037 CEST	443	49201	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.731956959 CEST	49201	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.732429028 CEST	49201	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.741882086 CEST	49202	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.741924047 CEST	443	49202	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:53.741986036 CEST	49202	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.742271900 CEST	49202	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:53.742285967 CEST	443	49202	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:54.276920080 CEST	443	49202	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:54.279925108 CEST	49202	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:54.279958010 CEST	443	49202	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:54.280015945 CEST	49202	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:54.280025959 CEST	443	49202	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:54.450670958 CEST	443	49202	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:54.450783968 CEST	443	49202	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:54.450853109 CEST	49202	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:54.451308966 CEST	49202	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:54.455602884 CEST	49203	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:54.455651999 CEST	443	49203	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:54.455717087 CEST	49203	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:54.455987930 CEST	49203	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:54.456001997 CEST	443	49203	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:54.958981037 CEST	443	49203	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:54.962162971 CEST	49203	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:54.962193966 CEST	443	49203	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:54.962236881 CEST	49203	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:54.962244987 CEST	443	49203	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:55.156558037 CEST	443	49203	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:55.156692982 CEST	443	49203	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:55.156764984 CEST	49203	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:55.157160044 CEST	49203	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:55.442234039 CEST	49204	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:55.442279100 CEST	443	49204	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:55.442409992 CEST	49204	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:55.443742990 CEST	49204	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:55.443752050 CEST	443	49204	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:55.910888910 CEST	443	49204	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:55.914182901 CEST	49204	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:55.914203882 CEST	443	49204	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:55.914351940 CEST	49204	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:55.914357901 CEST	443	49204	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.065557003 CEST	443	49204	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.065656900 CEST	443	49204	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.065738916 CEST	49204	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.066380024 CEST	49204	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.070951939 CEST	49205	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.071000099 CEST	443	49205	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.071062088 CEST	49205	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.071322918 CEST	49205	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.071336985 CEST	443	49205	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.548387051 CEST	443	49205	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.551428080 CEST	49205	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.551461935 CEST	443	49205	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.551513910 CEST	49205	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.551521063 CEST	443	49205	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.752557039 CEST	443	49205	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.752667904 CEST	443	49205	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.752731085 CEST	49205	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.753251076 CEST	49205	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.759076118 CEST	49206	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.759108067 CEST	443	49206	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:56.759167910 CEST	49206	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.759440899 CEST	49206	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:56.759454012 CEST	443	49206	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:57.227621078 CEST	443	49206	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:57.230710030 CEST	49206	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:57.230748892 CEST	443	49206	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:57.230796099 CEST	49206	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:57.230804920 CEST	443	49206	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:57.406793118 CEST	443	49206	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:57.406903982 CEST	443	49206	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:57.406971931 CEST	49206	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:57.407522917 CEST	49206	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:57.412177086 CEST	49207	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:57.412209988 CEST	443	49207	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:57.412261963 CEST	49207	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:57.412534952 CEST	49207	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:57.412544012 CEST	443	49207	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:57.994266033 CEST	443	49207	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:57.997309923 CEST	49207	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:57.997328997 CEST	443	49207	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:57.997380018 CEST	49207	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:57.997386932 CEST	443	49207	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:58.220654964 CEST	443	49207	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:58.220856905 CEST	443	49207	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:58.220901012 CEST	49207	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:58.221261024 CEST	49207	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:58.231736898 CEST	49208	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:58.231780052 CEST	443	49208	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:58.231829882 CEST	49208	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:58.232100964 CEST	49208	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:58.232110023 CEST	443	49208	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.038501024 CEST	443	49208	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.041446924 CEST	49208	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.041467905 CEST	443	49208	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.041512966 CEST	49208	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.041522026 CEST	443	49208	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.194324017 CEST	443	49208	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.194437981 CEST	443	49208	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.194505930 CEST	49208	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.194920063 CEST	49208	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.199363947 CEST	49209	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.199414015 CEST	443	49209	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.199464083 CEST	49209	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.199743986 CEST	49209	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.199757099 CEST	443	49209	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.674827099 CEST	443	49209	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.677810907 CEST	49209	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.677846909 CEST	443	49209	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.677889109 CEST	49209	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.677896976 CEST	443	49209	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.841814041 CEST	443	49209	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.841934919 CEST	443	49209	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.841991901 CEST	49209	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.842473984 CEST	49209	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.858591080 CEST	49210	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.858625889 CEST	443	49210	104.18.26.149	192.168.2.22
Jul 1, 2024 15:22:59.858684063 CEST	49210	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.858988047 CEST	49210	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:22:59.858999968 CEST	443	49210	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:00.345565081 CEST	443	49210	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:00.348678112 CEST	49210	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:00.348709106 CEST	443	49210	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:00.348754883 CEST	49210	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:00.348762989 CEST	443	49210	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:00.536887884 CEST	443	49210	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:00.537003994 CEST	443	49210	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:00.537065983 CEST	49210	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:00.537597895 CEST	49210	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:00.542160988 CEST	49211	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:00.542192936 CEST	443	49211	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:00.542251110 CEST	49211	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:00.542522907 CEST	49211	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:00.542535067 CEST	443	49211	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.037261009 CEST	443	49211	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.040086031 CEST	49211	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.040096045 CEST	443	49211	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.040152073 CEST	49211	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.040160894 CEST	443	49211	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.196688890 CEST	443	49211	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.196801901 CEST	443	49211	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.196849108 CEST	49211	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.197308064 CEST	49211	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.207572937 CEST	49212	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.207631111 CEST	443	49212	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.207681894 CEST	49212	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.208026886 CEST	49212	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.208040953 CEST	443	49212	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.677964926 CEST	443	49212	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.680869102 CEST	49212	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.680910110 CEST	443	49212	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.680960894 CEST	49212	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.680969000 CEST	443	49212	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.848268986 CEST	443	49212	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.848376036 CEST	443	49212	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.848423004 CEST	49212	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.848839045 CEST	49212	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.853224039 CEST	49213	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.853255987 CEST	443	49213	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:01.853310108 CEST	49213	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.853566885 CEST	49213	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:01.853574991 CEST	443	49213	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:02.321304083 CEST	443	49213	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:02.324645996 CEST	49213	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:02.324662924 CEST	443	49213	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:02.324719906 CEST	49213	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:02.324727058 CEST	443	49213	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:02.539372921 CEST	443	49213	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:02.539495945 CEST	443	49213	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:02.539556980 CEST	49213	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:02.540019989 CEST	49213	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:02.545003891 CEST	49214	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:02.545032978 CEST	443	49214	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:02.545089960 CEST	49214	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:02.545348883 CEST	49214	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:02.545356035 CEST	443	49214	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.030724049 CEST	443	49214	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.033946037 CEST	49214	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.033972025 CEST	443	49214	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.034015894 CEST	49214	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.034024000 CEST	443	49214	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.219405890 CEST	443	49214	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.219522953 CEST	443	49214	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.219574928 CEST	49214	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.220365047 CEST	49214	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.225550890 CEST	49215	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.225595951 CEST	443	49215	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.225657940 CEST	49215	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.230031013 CEST	49215	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.230042934 CEST	443	49215	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.724134922 CEST	443	49215	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.727222919 CEST	49215	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.727262020 CEST	443	49215	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.727308989 CEST	49215	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.727318048 CEST	443	49215	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.934041023 CEST	443	49215	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.934148073 CEST	443	49215	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.934204102 CEST	49215	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.934628963 CEST	49215	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.948376894 CEST	49216	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.948427916 CEST	443	49216	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:03.948610067 CEST	49216	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.948966026 CEST	49216	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:03.948980093 CEST	443	49216	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:04.522885084 CEST	443	49216	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:04.526222944 CEST	49216	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:04.526252985 CEST	443	49216	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:04.526293993 CEST	49216	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:04.526302099 CEST	443	49216	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:04.681871891 CEST	443	49216	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:04.681993008 CEST	443	49216	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:04.682070971 CEST	49216	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:04.682519913 CEST	49216	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:04.686919928 CEST	49217	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:04.686955929 CEST	443	49217	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:04.687012911 CEST	49217	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:04.687282085 CEST	49217	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:04.687298059 CEST	443	49217	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:05.166034937 CEST	443	49217	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:05.169209003 CEST	49217	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:05.169238091 CEST	443	49217	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:05.169282913 CEST	49217	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:05.169291019 CEST	443	49217	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:05.349205971 CEST	443	49217	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:05.349320889 CEST	443	49217	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:05.349385977 CEST	49217	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:05.349812031 CEST	49217	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:10.170809031 CEST	49218	80	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:10.175623894 CEST	80	49218	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:10.175698996 CEST	49218	80	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:10.175843954 CEST	49218	80	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:10.180596113 CEST	80	49218	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:10.852588892 CEST	80	49218	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:10.910387039 CEST	80	49218	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:10.910474062 CEST	49218	80	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:10.952229977 CEST	49219	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:23:10.952264071 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:10.952316046 CEST	49219	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:23:10.953814983 CEST	49219	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:23:10.953834057 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:11.580128908 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:11.580231905 CEST	49219	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:23:11.585359097 CEST	49219	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:23:11.585374117 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:11.585658073 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:11.597894907 CEST	49219	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:23:11.640505075 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:11.640580893 CEST	49219	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:23:11.640588999 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:11.785551071 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:11.785609961 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:11.785679102 CEST	49219	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:23:11.785696030 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:11.785706043 CEST	443	49219	104.16.149.130	192.168.2.22
Jul 1, 2024 15:23:11.785744905 CEST	49219	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:23:11.786582947 CEST	49219	443	192.168.2.22	104.16.149.130
Jul 1, 2024 15:23:12.072139978 CEST	49220	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:12.072197914 CEST	443	49220	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:12.072257042 CEST	49220	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:12.072618961 CEST	49220	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:12.072637081 CEST	443	49220	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:12.589835882 CEST	443	49220	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:12.589967966 CEST	49220	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:12.594567060 CEST	49220	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:12.594597101 CEST	443	49220	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:12.594917059 CEST	443	49220	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:12.597479105 CEST	49220	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:12.597582102 CEST	49220	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:12.597600937 CEST	443	49220	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:12.597657919 CEST	49220	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:12.597671032 CEST	443	49220	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:12.735914946 CEST	443	49220	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:12.736033916 CEST	443	49220	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:12.736093998 CEST	49220	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:12.736716032 CEST	49220	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:13.356318951 CEST	49221	80	192.168.2.22	64.18.87.81
Jul 1, 2024 15:23:13.361181974 CEST	80	49221	64.18.87.81	192.168.2.22
Jul 1, 2024 15:23:13.361248970 CEST	49221	80	192.168.2.22	64.18.87.81
Jul 1, 2024 15:23:13.361488104 CEST	49221	80	192.168.2.22	64.18.87.81
Jul 1, 2024 15:23:13.367701054 CEST	80	49221	64.18.87.81	192.168.2.22
Jul 1, 2024 15:23:13.891020060 CEST	80	49221	64.18.87.81	192.168.2.22
Jul 1, 2024 15:23:13.902312994 CEST	49221	80	192.168.2.22	64.18.87.81
Jul 1, 2024 15:23:13.907092094 CEST	80	49221	64.18.87.81	192.168.2.22
Jul 1, 2024 15:23:14.017277002 CEST	80	49221	64.18.87.81	192.168.2.22
Jul 1, 2024 15:23:14.018591881 CEST	49221	80	192.168.2.22	64.18.87.81
Jul 1, 2024 15:23:14.024086952 CEST	80	49221	64.18.87.81	192.168.2.22
Jul 1, 2024 15:23:14.133461952 CEST	80	49221	64.18.87.81	192.168.2.22
Jul 1, 2024 15:23:14.134572983 CEST	49221	80	192.168.2.22	64.18.87.81
Jul 1, 2024 15:23:14.139348030 CEST	80	49221	64.18.87.81	192.168.2.22
Jul 1, 2024 15:23:14.251740932 CEST	80	49221	64.18.87.81	192.168.2.22
Jul 1, 2024 15:23:14.401452065 CEST	49222	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:14.401492119 CEST	443	49222	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:14.401549101 CEST	49222	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:14.401869059 CEST	49222	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:14.401880026 CEST	443	49222	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:14.461118937 CEST	49221	80	192.168.2.22	64.18.87.81
Jul 1, 2024 15:23:14.877064943 CEST	443	49222	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:14.884097099 CEST	49222	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:14.884126902 CEST	443	49222	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:14.884248018 CEST	49222	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:14.884253979 CEST	443	49222	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:15.050074100 CEST	443	49222	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:15.050215960 CEST	443	49222	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:15.050266027 CEST	49222	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:15.051126003 CEST	49222	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:15.618033886 CEST	49223	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:15.618074894 CEST	443	49223	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:15.618123055 CEST	49223	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:15.618558884 CEST	49223	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:15.618582964 CEST	443	49223	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:16.271930933 CEST	443	49223	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:16.274970055 CEST	49223	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:16.275006056 CEST	443	49223	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:16.275079012 CEST	49223	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:16.275085926 CEST	443	49223	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:16.461126089 CEST	443	49223	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:16.461234093 CEST	443	49223	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:16.461354017 CEST	49223	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:16.461968899 CEST	49223	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:16.462142944 CEST	49224	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:16.462172031 CEST	443	49224	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:16.462256908 CEST	49224	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:16.462502003 CEST	49224	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:16.462517977 CEST	443	49224	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:16.949558020 CEST	443	49224	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:16.952501059 CEST	49224	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:16.952527046 CEST	443	49224	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:16.952595949 CEST	49224	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:16.952605963 CEST	443	49224	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:17.116779089 CEST	443	49224	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:17.116909027 CEST	443	49224	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:17.117046118 CEST	49224	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:17.117476940 CEST	49224	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:17.127691984 CEST	49218	80	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:17.132694960 CEST	80	49218	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:17.263679981 CEST	80	49218	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:17.351989031 CEST	49225	80	192.168.2.22	104.19.159.224
Jul 1, 2024 15:23:17.356765032 CEST	80	49225	104.19.159.224	192.168.2.22
Jul 1, 2024 15:23:17.356937885 CEST	49225	80	192.168.2.22	104.19.159.224
Jul 1, 2024 15:23:17.356937885 CEST	49225	80	192.168.2.22	104.19.159.224
Jul 1, 2024 15:23:17.361727953 CEST	80	49225	104.19.159.224	192.168.2.22
Jul 1, 2024 15:23:17.472003937 CEST	49218	80	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:17.474452019 CEST	80	49218	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:17.474519968 CEST	49218	80	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:17.851248980 CEST	80	49225	104.19.159.224	192.168.2.22
Jul 1, 2024 15:23:18.062539101 CEST	80	49225	104.19.159.224	192.168.2.22
Jul 1, 2024 15:23:18.062634945 CEST	49225	80	192.168.2.22	104.19.159.224
Jul 1, 2024 15:23:18.294611931 CEST	49226	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:18.294663906 CEST	443	49226	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:18.294718981 CEST	49226	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:18.295057058 CEST	49226	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:18.295067072 CEST	443	49226	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:18.764833927 CEST	443	49226	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:18.767839909 CEST	49226	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:18.767879963 CEST	443	49226	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:18.767939091 CEST	49226	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:18.767947912 CEST	443	49226	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:18.932636023 CEST	443	49226	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:18.932771921 CEST	443	49226	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:18.932811975 CEST	49226	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:18.933527946 CEST	49226	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:18.962641954 CEST	49221	80	192.168.2.22	64.18.87.81
Jul 1, 2024 15:23:18.962924957 CEST	49218	80	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:18.963155031 CEST	49225	80	192.168.2.22	104.19.159.224
Jul 1, 2024 15:23:27.613250017 CEST	49227	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:27.613301039 CEST	443	49227	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:27.613362074 CEST	49227	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:27.614953995 CEST	49227	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:27.614964962 CEST	443	49227	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:28.366606951 CEST	443	49227	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:28.366763115 CEST	49227	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:28.378978014 CEST	49227	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:28.378998995 CEST	443	49227	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:28.379312038 CEST	443	49227	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:28.383677006 CEST	49227	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:28.428502083 CEST	443	49227	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:28.428637028 CEST	49227	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:28.428647995 CEST	443	49227	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:28.573164940 CEST	443	49227	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:28.573223114 CEST	443	49227	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:28.573349953 CEST	443	49227	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:28.573440075 CEST	49227	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:28.574445963 CEST	49227	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:28.760710955 CEST	49228	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:28.760759115 CEST	443	49228	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:28.760837078 CEST	49228	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:28.761482954 CEST	49228	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:28.761497974 CEST	443	49228	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:29.252310038 CEST	443	49228	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:29.252412081 CEST	49228	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:29.258317947 CEST	49228	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:29.258336067 CEST	443	49228	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:29.258714914 CEST	443	49228	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:29.266266108 CEST	49228	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:29.266393900 CEST	49228	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:29.266417980 CEST	443	49228	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:29.266484022 CEST	49228	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:29.266500950 CEST	443	49228	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:29.435477972 CEST	443	49228	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:29.435594082 CEST	443	49228	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:29.435645103 CEST	49228	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:29.436258078 CEST	49228	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:29.582149982 CEST	49229	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:29.582189083 CEST	443	49229	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:29.582240105 CEST	49229	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:29.582586050 CEST	49229	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:29.582602024 CEST	443	49229	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:30.150808096 CEST	443	49229	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:30.154247999 CEST	49229	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:30.154267073 CEST	443	49229	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:30.154320002 CEST	49229	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:30.154328108 CEST	443	49229	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:30.341259003 CEST	443	49229	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:30.341339111 CEST	443	49229	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:30.341440916 CEST	49229	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:30.355834961 CEST	49230	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:30.355878115 CEST	443	49230	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:30.356157064 CEST	49230	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:30.356262922 CEST	49230	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:30.356273890 CEST	443	49230	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:30.828799963 CEST	443	49230	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:30.867485046 CEST	49230	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:30.867506981 CEST	443	49230	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:30.867578030 CEST	49230	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:30.867588043 CEST	443	49230	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:31.212624073 CEST	443	49230	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:31.212737083 CEST	443	49230	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:31.212804079 CEST	49230	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:31.213319063 CEST	49230	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:31.443943024 CEST	49231	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:31.443991899 CEST	443	49231	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:31.444080114 CEST	49231	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:31.444386005 CEST	49231	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:31.444397926 CEST	443	49231	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:31.945302963 CEST	443	49231	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:31.949390888 CEST	49231	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:31.949418068 CEST	443	49231	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:31.949525118 CEST	49231	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:31.949531078 CEST	443	49231	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:32.399133921 CEST	443	49231	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:32.399315119 CEST	443	49231	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:32.399363995 CEST	49231	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:32.400832891 CEST	49231	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:34.329627037 CEST	49229	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.054183960 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.054218054 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.054270983 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.055696964 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.055706024 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.122956038 CEST	49233	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:38.123008013 CEST	443	49233	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:38.123071909 CEST	49233	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:38.123370886 CEST	49233	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:38.123388052 CEST	443	49233	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:38.605721951 CEST	443	49233	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:38.609157085 CEST	49233	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:38.609194994 CEST	443	49233	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:38.609241009 CEST	49233	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:38.609251022 CEST	443	49233	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:38.648252010 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.648453951 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.653074026 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.653091908 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.653373957 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.659241915 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.704493046 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.704540014 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.704545021 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.790421009 CEST	443	49233	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:38.790524006 CEST	443	49233	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:38.790611029 CEST	49233	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:38.791188002 CEST	49233	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:38.824078083 CEST	49234	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:38.824115038 CEST	443	49234	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:38.824172020 CEST	49234	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:38.824491978 CEST	49234	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:38.824501991 CEST	443	49234	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:38.851998091 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.852057934 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.852093935 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.852125883 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.852129936 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.852140903 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.852166891 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.852202892 CEST	443	49232	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:38.852241993 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:38.855931044 CEST	49232	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:39.050220966 CEST	49235	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:39.050261021 CEST	443	49235	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:39.050304890 CEST	49235	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:39.050698996 CEST	49235	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:39.050709009 CEST	443	49235	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:39.316203117 CEST	443	49234	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:39.319586992 CEST	49234	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:39.319622993 CEST	443	49234	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:39.319677114 CEST	49234	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:39.319686890 CEST	443	49234	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:39.531300068 CEST	443	49234	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:39.531395912 CEST	443	49234	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:39.531464100 CEST	443	49235	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:39.531471968 CEST	49234	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:39.531522989 CEST	49235	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:39.540790081 CEST	49234	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:39.545432091 CEST	49235	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:39.545449972 CEST	443	49235	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:39.545732975 CEST	443	49235	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:39.548331022 CEST	49235	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:39.548459053 CEST	49235	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:39.548472881 CEST	443	49235	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:39.548521042 CEST	49235	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:39.548537016 CEST	443	49235	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:39.596370935 CEST	49236	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:39.596407890 CEST	443	49236	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:39.596461058 CEST	49236	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:39.596738100 CEST	49236	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:39.596749067 CEST	443	49236	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:39.688004971 CEST	443	49235	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:39.688117027 CEST	443	49235	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:39.688163996 CEST	49235	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:39.688658953 CEST	49235	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:40.085289001 CEST	443	49236	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:40.117346048 CEST	49236	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:40.117384911 CEST	443	49236	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:40.118154049 CEST	49236	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:40.118160009 CEST	443	49236	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:40.268146038 CEST	443	49236	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:40.268327951 CEST	443	49236	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:40.268414974 CEST	49236	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:40.407171965 CEST	49236	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:40.541743994 CEST	49237	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:40.541821957 CEST	443	49237	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:40.541897058 CEST	49237	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:40.542321920 CEST	49237	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:40.542360067 CEST	443	49237	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:40.697429895 CEST	49238	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:40.697469950 CEST	443	49238	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:40.697551966 CEST	49238	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:40.697930098 CEST	49238	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:40.697940111 CEST	443	49238	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:41.039870024 CEST	443	49237	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.043167114 CEST	49237	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.043190956 CEST	443	49237	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.043226957 CEST	49237	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.043236017 CEST	443	49237	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.223687887 CEST	443	49237	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.223819017 CEST	443	49237	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.223881006 CEST	49237	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.224338055 CEST	49237	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.275007963 CEST	443	49238	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:41.278022051 CEST	49238	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:41.278054953 CEST	443	49238	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:41.278100967 CEST	49238	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:41.278111935 CEST	443	49238	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:41.278640032 CEST	49239	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.278685093 CEST	443	49239	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.278784990 CEST	49239	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.279067039 CEST	49239	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.279078007 CEST	443	49239	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.455717087 CEST	443	49238	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:41.455784082 CEST	443	49238	104.16.148.130	192.168.2.22
Jul 1, 2024 15:23:41.455871105 CEST	49238	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:41.471831083 CEST	49240	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:41.471863031 CEST	443	49240	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:41.471926928 CEST	49240	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:41.472255945 CEST	49240	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:41.472266912 CEST	443	49240	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:41.756670952 CEST	443	49239	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.759604931 CEST	49239	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.759637117 CEST	443	49239	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.759704113 CEST	49239	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.759711981 CEST	443	49239	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.946455002 CEST	443	49239	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.946562052 CEST	443	49239	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.946614981 CEST	49239	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.947105885 CEST	49239	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.956886053 CEST	443	49240	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:41.959778070 CEST	49240	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:41.959806919 CEST	443	49240	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:41.959858894 CEST	49240	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:41.959872961 CEST	443	49240	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:41.974713087 CEST	49241	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.974747896 CEST	443	49241	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:41.974800110 CEST	49241	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.975074053 CEST	49241	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:41.975085974 CEST	443	49241	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:42.137742043 CEST	443	49240	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:42.137854099 CEST	443	49240	104.18.27.149	192.168.2.22
Jul 1, 2024 15:23:42.137937069 CEST	49240	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:42.138509989 CEST	49240	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:23:42.217360973 CEST	49238	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:23:42.447942972 CEST	443	49241	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:42.450938940 CEST	49241	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:42.450973988 CEST	443	49241	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:42.451028109 CEST	49241	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:42.451037884 CEST	443	49241	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:42.650840044 CEST	443	49241	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:42.650943041 CEST	443	49241	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:42.650996923 CEST	49241	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:42.651499033 CEST	49241	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:42.793346882 CEST	49242	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:42.793394089 CEST	443	49242	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:42.793504953 CEST	49242	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:42.793872118 CEST	49242	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:42.793886900 CEST	443	49242	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:43.284022093 CEST	443	49242	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:43.474896908 CEST	49242	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:43.474929094 CEST	443	49242	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:43.474994898 CEST	49242	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:43.475003958 CEST	443	49242	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:43.628454924 CEST	443	49242	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:43.628562927 CEST	443	49242	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:43.628613949 CEST	49242	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:43.629106998 CEST	49242	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:43.782568932 CEST	49243	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:43.782623053 CEST	443	49243	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:43.782680035 CEST	49243	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:43.783058882 CEST	49243	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:43.783071995 CEST	443	49243	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:44.297820091 CEST	443	49243	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:44.301378965 CEST	49243	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:44.301414967 CEST	443	49243	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:44.301518917 CEST	49243	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:44.301527977 CEST	443	49243	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:44.447653055 CEST	443	49243	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:44.447776079 CEST	443	49243	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:44.447951078 CEST	49243	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:44.448322058 CEST	49243	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:44.473157883 CEST	49244	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:44.473208904 CEST	443	49244	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:44.473263025 CEST	49244	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:44.473553896 CEST	49244	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:44.473565102 CEST	443	49244	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:44.964895010 CEST	443	49244	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:44.968307972 CEST	49244	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:44.968336105 CEST	443	49244	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:44.968372107 CEST	49244	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:44.968379974 CEST	443	49244	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:45.130080938 CEST	443	49244	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:45.130387068 CEST	443	49244	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:45.130444050 CEST	49244	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:45.131007910 CEST	49244	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:50.855125904 CEST	49245	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:50.855181932 CEST	443	49245	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:50.855246067 CEST	49245	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:50.855669975 CEST	49245	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:50.855690002 CEST	443	49245	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:51.360239029 CEST	443	49245	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:51.387226105 CEST	49245	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:51.387254953 CEST	443	49245	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:51.387305021 CEST	49245	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:51.387312889 CEST	443	49245	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:51.776927948 CEST	443	49245	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:51.777056932 CEST	443	49245	104.18.26.149	192.168.2.22
Jul 1, 2024 15:23:51.777105093 CEST	49245	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:23:51.777631044 CEST	49245	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:24:12.072321892 CEST	49168	80	192.168.2.22	104.16.149.130
Jul 1, 2024 15:24:12.077435970 CEST	80	49168	104.16.149.130	192.168.2.22
Jul 1, 2024 15:24:12.077577114 CEST	49168	80	192.168.2.22	104.16.149.130
Jul 1, 2024 15:25:22.390944958 CEST	49246	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:22.391032934 CEST	443	49246	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:22.391117096 CEST	49246	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:22.391443014 CEST	49246	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:22.391473055 CEST	443	49246	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:22.887594938 CEST	443	49246	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:22.891004086 CEST	49246	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:22.891110897 CEST	443	49246	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:22.891171932 CEST	49246	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:22.891204119 CEST	443	49246	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.058140039 CEST	443	49246	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.058274031 CEST	443	49246	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.058326006 CEST	49246	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.058671951 CEST	49246	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.062314987 CEST	49247	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.062365055 CEST	443	49247	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.062455893 CEST	49247	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.062613964 CEST	49247	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.062637091 CEST	443	49247	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.540653944 CEST	443	49247	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.542175055 CEST	49247	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.542216063 CEST	443	49247	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.542294025 CEST	49247	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.542304993 CEST	443	49247	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.732058048 CEST	443	49247	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.732186079 CEST	443	49247	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.732247114 CEST	49247	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.732526064 CEST	49247	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.743784904 CEST	49248	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.743825912 CEST	443	49248	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:23.743916035 CEST	49248	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.744085073 CEST	49248	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:23.744102001 CEST	443	49248	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:24.233354092 CEST	443	49248	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:24.234936953 CEST	49248	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:24.234956026 CEST	443	49248	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:24.235096931 CEST	49248	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:24.235109091 CEST	443	49248	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:24.444057941 CEST	443	49248	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:24.444184065 CEST	443	49248	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:24.444250107 CEST	49248	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:24.444587946 CEST	49248	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:24.450190067 CEST	49249	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:24.450243950 CEST	443	49249	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:24.450294018 CEST	49249	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:24.450481892 CEST	49249	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:24.450491905 CEST	443	49249	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:24.924968004 CEST	443	49249	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:24.926677942 CEST	49249	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:24.926702023 CEST	443	49249	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:24.926862001 CEST	49249	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:24.926867962 CEST	443	49249	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:25.109447002 CEST	443	49249	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:25.109570980 CEST	443	49249	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:25.109633923 CEST	49249	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:25.109918118 CEST	49249	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:25.362590075 CEST	49250	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:25.362637043 CEST	443	49250	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:25.362689972 CEST	49250	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:25.363080978 CEST	49250	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:25.363091946 CEST	443	49250	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:25.853343964 CEST	49251	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:25.853379011 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:25.853437901 CEST	49251	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:25.853918076 CEST	443	49250	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:25.854549885 CEST	49251	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:25.854562998 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:25.855571032 CEST	49250	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:25.855597019 CEST	443	49250	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:25.855645895 CEST	49250	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:25.855654001 CEST	443	49250	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.032776117 CEST	443	49250	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.032907963 CEST	443	49250	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.032974958 CEST	49250	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.033286095 CEST	49250	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.097842932 CEST	49252	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.097898006 CEST	443	49252	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.097959995 CEST	49252	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.098140001 CEST	49252	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.098150015 CEST	443	49252	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.422337055 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:26.422425985 CEST	49251	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:26.426630020 CEST	49251	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:26.426651001 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:26.426963091 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:26.429815054 CEST	49251	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:26.472534895 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:26.472620964 CEST	49251	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:26.472656965 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:26.568366051 CEST	443	49252	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.569797039 CEST	49252	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.569822073 CEST	443	49252	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.569861889 CEST	49252	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.569869995 CEST	443	49252	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.752948999 CEST	443	49252	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.753066063 CEST	443	49252	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.753113985 CEST	49252	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.753397942 CEST	49252	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.780220985 CEST	49253	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.780260086 CEST	443	49253	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.780320883 CEST	49253	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.780608892 CEST	49253	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:26.780626059 CEST	443	49253	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:26.875160933 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:26.875228882 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:26.875308037 CEST	49251	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:26.875338078 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:26.875354052 CEST	443	49251	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:26.875391006 CEST	49251	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:26.876413107 CEST	49251	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:27.018332005 CEST	49254	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.018367052 CEST	443	49254	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:27.018425941 CEST	49254	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.018650055 CEST	49254	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.018661022 CEST	443	49254	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:27.369174957 CEST	443	49253	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:27.370771885 CEST	49253	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:27.370803118 CEST	443	49253	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:27.370866060 CEST	49253	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:27.370877981 CEST	443	49253	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:27.556790113 CEST	443	49253	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:27.556915998 CEST	443	49253	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:27.556981087 CEST	49253	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:27.557276011 CEST	49253	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:27.565453053 CEST	49255	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:27.565505028 CEST	443	49255	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:27.565557957 CEST	49255	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:27.565728903 CEST	49255	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:27.565746069 CEST	443	49255	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:27.572371006 CEST	443	49254	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:27.572468042 CEST	49254	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.576647043 CEST	49254	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.576669931 CEST	443	49254	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:27.577040911 CEST	443	49254	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:27.578403950 CEST	49254	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.578466892 CEST	49254	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.578495026 CEST	443	49254	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:27.578552008 CEST	49254	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.578560114 CEST	443	49254	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:27.735384941 CEST	443	49254	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:27.735538006 CEST	443	49254	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:27.735604048 CEST	49254	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.743643045 CEST	49254	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.910887003 CEST	49256	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.910962105 CEST	443	49256	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:27.911027908 CEST	49256	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.922734976 CEST	49256	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:27.922784090 CEST	443	49256	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:28.062230110 CEST	443	49255	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:28.077127934 CEST	49255	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:28.077162981 CEST	443	49255	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:28.077207088 CEST	49255	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:28.077214956 CEST	443	49255	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:28.228925943 CEST	443	49255	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:28.229043961 CEST	443	49255	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:28.229104996 CEST	49255	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:28.233663082 CEST	49255	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:28.348664045 CEST	49262	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:28.348728895 CEST	443	49262	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:28.348798037 CEST	49262	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:28.349140882 CEST	49262	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:28.349152088 CEST	443	49262	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:28.413619041 CEST	443	49256	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:28.466064930 CEST	49256	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:28.466089964 CEST	443	49256	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:28.466157913 CEST	49256	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:28.466169119 CEST	443	49256	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:28.608695984 CEST	443	49256	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:28.608818054 CEST	443	49256	104.18.27.149	192.168.2.22
Jul 1, 2024 15:25:28.608869076 CEST	49256	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:28.610043049 CEST	49256	443	192.168.2.22	104.18.27.149
Jul 1, 2024 15:25:28.842915058 CEST	443	49262	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:28.844510078 CEST	49262	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:28.844554901 CEST	443	49262	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:28.844611883 CEST	49262	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:28.844621897 CEST	443	49262	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.023217916 CEST	443	49262	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.023356915 CEST	443	49262	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.023423910 CEST	49262	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.023808956 CEST	49262	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.024069071 CEST	49264	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.024127007 CEST	443	49264	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.024177074 CEST	49264	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.024441957 CEST	49264	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.024458885 CEST	443	49264	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.497698069 CEST	443	49264	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.499205112 CEST	49264	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.499237061 CEST	443	49264	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.499278069 CEST	49264	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.499286890 CEST	443	49264	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.654113054 CEST	443	49264	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.654232025 CEST	443	49264	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.654285908 CEST	49264	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.654742956 CEST	49264	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.664366961 CEST	49273	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.664417982 CEST	443	49273	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:29.664489031 CEST	49273	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.664664984 CEST	49273	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:29.664674997 CEST	443	49273	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:30.151186943 CEST	443	49273	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:30.152739048 CEST	49273	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:30.152781010 CEST	443	49273	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:30.152839899 CEST	49273	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:30.152848959 CEST	443	49273	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:30.324172974 CEST	443	49273	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:30.324305058 CEST	443	49273	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:30.324347019 CEST	49273	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:30.324826956 CEST	49273	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:30.380551100 CEST	49276	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:30.380569935 CEST	443	49276	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:30.380618095 CEST	49276	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:30.380990982 CEST	49276	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:30.380997896 CEST	443	49276	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:30.857675076 CEST	443	49276	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:30.859328985 CEST	49276	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:30.859373093 CEST	443	49276	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:30.859464884 CEST	49276	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:30.859474897 CEST	443	49276	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:31.078007936 CEST	443	49276	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:31.078125000 CEST	443	49276	104.18.26.149	192.168.2.22
Jul 1, 2024 15:25:31.078190088 CEST	49276	443	192.168.2.22	104.18.26.149
Jul 1, 2024 15:25:31.166393042 CEST	49286	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:31.166446924 CEST	443	49286	104.16.148.130	192.168.2.22
Jul 1, 2024 15:25:31.166508913 CEST	49286	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:31.166681051 CEST	49286	443	192.168.2.22	104.16.148.130
Jul 1, 2024 15:25:31.166697025 CEST	443	49286	104.16.148.130	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 15:22:16.774072886 CEST	63926	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:22:16.784794092 CEST	53	63926	8.8.8.8	192.168.2.22
Jul 1, 2024 15:22:17.548866987 CEST	65510	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:22:17.558201075 CEST	53	65510	8.8.8.8	192.168.2.22
Jul 1, 2024 15:22:18.495419025 CEST	62672	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:22:18.505928040 CEST	53	62672	8.8.8.8	192.168.2.22
Jul 1, 2024 15:22:34.164289951 CEST	56475	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:22:34.177405119 CEST	53	56475	8.8.8.8	192.168.2.22
Jul 1, 2024 15:23:10.155729055 CEST	49384	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:23:10.166115999 CEST	53	49384	8.8.8.8	192.168.2.22
Jul 1, 2024 15:23:10.944397926 CEST	54842	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:23:10.951397896 CEST	53	54842	8.8.8.8	192.168.2.22
Jul 1, 2024 15:23:12.059725046 CEST	58105	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:23:12.071681976 CEST	53	58105	8.8.8.8	192.168.2.22
Jul 1, 2024 15:23:13.344824076 CEST	64928	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:23:13.355492115 CEST	53	64928	8.8.8.8	192.168.2.22
Jul 1, 2024 15:23:17.341917992 CEST	57390	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:23:17.351593018 CEST	53	57390	8.8.8.8	192.168.2.22
Jul 1, 2024 15:23:27.029278040 CEST	58095	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:23:27.036089897 CEST	53	58095	8.8.8.8	192.168.2.22
Jul 1, 2024 15:23:28.747982025 CEST	54261	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:23:28.759779930 CEST	53	54261	8.8.8.8	192.168.2.22
Jul 1, 2024 15:23:38.040770054 CEST	60507	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:23:38.047667027 CEST	53	60507	8.8.8.8	192.168.2.22
Jul 1, 2024 15:23:39.039028883 CEST	50446	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:23:39.049829006 CEST	53	50446	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:22.377365112 CEST	55939	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:22.390634060 CEST	53	55939	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:25.842619896 CEST	49608	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:25.850717068 CEST	53	49608	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:27.006795883 CEST	61486	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:27.018003941 CEST	53	61486	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:28.129336119 CEST	53	61467	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:28.164136887 CEST	61618	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:28.164362907 CEST	54422	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:28.174010038 CEST	53	61618	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:28.175121069 CEST	53	56329	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:28.175859928 CEST	53	54422	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:28.178227901 CEST	53	59447	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:28.661389112 CEST	51828	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:28.673327923 CEST	53	51828	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:29.348763943 CEST	49750	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:29.348855972 CEST	64687	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:29.355628014 CEST	53	49750	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:29.358153105 CEST	53	64687	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:29.359330893 CEST	53	65009	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:29.366617918 CEST	53	54521	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:29.366717100 CEST	53	63373	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:29.380970955 CEST	53	51955	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:29.514458895 CEST	58971	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:29.525811911 CEST	53	58971	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:30.600218058 CEST	53	53060	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:31.246788979 CEST	58257	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:31.246891022 CEST	54738	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:31.257493973 CEST	53	58257	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:31.257533073 CEST	53	54738	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:31.298573017 CEST	49478	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:31.298672915 CEST	49288	53	192.168.2.22	8.8.8.8
Jul 1, 2024 15:25:31.308459044 CEST	53	49478	8.8.8.8	192.168.2.22
Jul 1, 2024 15:25:31.309087038 CEST	53	49288	8.8.8.8	192.168.2.22

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 1, 2024 15:25:29.366698980 CEST	192.168.2.22	8.8.8.8	d042	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 15:22:16.774072886 CEST	192.168.2.22	8.8.8.8	0x83bf	Standard query (0)	geo.lavasoft.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:22:17.548866987 CEST	192.168.2.22	8.8.8.8	0xe3d7	Standard query (0)	featureflags.lavasoft.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:22:18.495419025 CEST	192.168.2.22	8.8.8.8	0x5e57	Standard query (0)	flwadw.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:22:34.164289951 CEST	192.168.2.22	8.8.8.8	0x8dcd	Standard query (0)	wcdownloadercdn.lavasoft.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:10.155729055 CEST	192.168.2.22	8.8.8.8	0x5486	Standard query (0)	geo.lavasoft.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:10.944397926 CEST	192.168.2.22	8.8.8.8	0x7279	Standard query (0)	featureflags.lavasoft.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:12.059725046 CEST	192.168.2.22	8.8.8.8	0x7a70	Standard query (0)	flwadw.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:13.344824076 CEST	192.168.2.22	8.8.8.8	0x63ce	Standard query (0)	wc-partners.lavasoft.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:17.341917992 CEST	192.168.2.22	8.8.8.8	0x1b1	Standard query (0)	webcompanion.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:27.029278040 CEST	192.168.2.22	8.8.8.8	0x69f8	Standard query (0)	featureflags.lavasoft.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:28.747982025 CEST	192.168.2.22	8.8.8.8	0x1525	Standard query (0)	flwadw.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:38.040770054 CEST	192.168.2.22	8.8.8.8	0x15e4	Standard query (0)	featureflags.lavasoft.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:39.039028883 CEST	192.168.2.22	8.8.8.8	0xb18f	Standard query (0)	flwadw.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:22.377365112 CEST	192.168.2.22	8.8.8.8	0x43b0	Standard query (0)	flwadw.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:25.842619896 CEST	192.168.2.22	8.8.8.8	0x47a8	Standard query (0)	featureflags.lavasoft.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:27.006795883 CEST	192.168.2.22	8.8.8.8	0xbfa	Standard query (0)	flwadw.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:28.164136887 CEST	192.168.2.22	8.8.8.8	0x20ef	Standard query (0)	webcompanion.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:28.164362907 CEST	192.168.2.22	8.8.8.8	0x688d	Standard query (0)	webcompanion.com	65	IN (0x0001)	false
Jul 1, 2024 15:25:28.661389112 CEST	192.168.2.22	8.8.8.8	0x65a4	Standard query (0)	partners.webcompanion.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:29.348763943 CEST	192.168.2.22	8.8.8.8	0x6f0e	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:29.348855972 CEST	192.168.2.22	8.8.8.8	0x7c1b	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Jul 1, 2024 15:25:29.514458895 CEST	192.168.2.22	8.8.8.8	0x925d	Standard query (0)	sg-bitmask.adaware.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:31.246788979 CEST	192.168.2.22	8.8.8.8	0x86	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:31.246891022 CEST	192.168.2.22	8.8.8.8	0x5a79	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Jul 1, 2024 15:25:31.298573017 CEST	192.168.2.22	8.8.8.8	0x372d	Standard query (0)	cdn.inspectlet.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:31.298672915 CEST	192.168.2.22	8.8.8.8	0x3abc	Standard query (0)	cdn.inspectlet.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 15:22:16.784794092 CEST	8.8.8.8	192.168.2.22	0x83bf	No error (0)	geo.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:22:16.784794092 CEST	8.8.8.8	192.168.2.22	0x83bf	No error (0)	geo.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:22:17.558201075 CEST	8.8.8.8	192.168.2.22	0xe3d7	No error (0)	featureflags.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:22:17.558201075 CEST	8.8.8.8	192.168.2.22	0xe3d7	No error (0)	featureflags.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:22:18.505928040 CEST	8.8.8.8	192.168.2.22	0x5e57	No error (0)	flwadw.com	104.18.26.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:22:18.505928040 CEST	8.8.8.8	192.168.2.22	0x5e57	No error (0)	flwadw.com	104.18.27.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:22:34.177405119 CEST	8.8.8.8	192.168.2.22	0x8dcd	No error (0)	wcdownloadercdn.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:22:34.177405119 CEST	8.8.8.8	192.168.2.22	0x8dcd	No error (0)	wcdownloadercdn.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:10.166115999 CEST	8.8.8.8	192.168.2.22	0x5486	No error (0)	geo.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:10.166115999 CEST	8.8.8.8	192.168.2.22	0x5486	No error (0)	geo.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:10.951397896 CEST	8.8.8.8	192.168.2.22	0x7279	No error (0)	featureflags.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:10.951397896 CEST	8.8.8.8	192.168.2.22	0x7279	No error (0)	featureflags.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:12.071681976 CEST	8.8.8.8	192.168.2.22	0x7a70	No error (0)	flwadw.com	104.18.26.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:12.071681976 CEST	8.8.8.8	192.168.2.22	0x7a70	No error (0)	flwadw.com	104.18.27.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:13.355492115 CEST	8.8.8.8	192.168.2.22	0x63ce	No error (0)	wc-partners.lavasoft.com	64.18.87.81	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:13.355492115 CEST	8.8.8.8	192.168.2.22	0x63ce	No error (0)	wc-partners.lavasoft.com	64.18.87.82	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:17.351593018 CEST	8.8.8.8	192.168.2.22	0x1b1	No error (0)	webcompanion.com	104.19.159.224	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:17.351593018 CEST	8.8.8.8	192.168.2.22	0x1b1	No error (0)	webcompanion.com	104.19.208.152	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:27.036089897 CEST	8.8.8.8	192.168.2.22	0x69f8	No error (0)	featureflags.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:27.036089897 CEST	8.8.8.8	192.168.2.22	0x69f8	No error (0)	featureflags.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:28.759779930 CEST	8.8.8.8	192.168.2.22	0x1525	No error (0)	flwadw.com	104.18.26.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:28.759779930 CEST	8.8.8.8	192.168.2.22	0x1525	No error (0)	flwadw.com	104.18.27.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:38.047667027 CEST	8.8.8.8	192.168.2.22	0x15e4	No error (0)	featureflags.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:38.047667027 CEST	8.8.8.8	192.168.2.22	0x15e4	No error (0)	featureflags.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:39.049829006 CEST	8.8.8.8	192.168.2.22	0xb18f	No error (0)	flwadw.com	104.18.27.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:23:39.049829006 CEST	8.8.8.8	192.168.2.22	0xb18f	No error (0)	flwadw.com	104.18.26.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:22.390634060 CEST	8.8.8.8	192.168.2.22	0x43b0	No error (0)	flwadw.com	104.18.26.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:22.390634060 CEST	8.8.8.8	192.168.2.22	0x43b0	No error (0)	flwadw.com	104.18.27.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:25.850717068 CEST	8.8.8.8	192.168.2.22	0x47a8	No error (0)	featureflags.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:25.850717068 CEST	8.8.8.8	192.168.2.22	0x47a8	No error (0)	featureflags.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:27.018003941 CEST	8.8.8.8	192.168.2.22	0xbfa	No error (0)	flwadw.com	104.18.27.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:27.018003941 CEST	8.8.8.8	192.168.2.22	0xbfa	No error (0)	flwadw.com	104.18.26.149	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:28.174010038 CEST	8.8.8.8	192.168.2.22	0x20ef	No error (0)	webcompanion.com	104.19.208.152	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:28.174010038 CEST	8.8.8.8	192.168.2.22	0x20ef	No error (0)	webcompanion.com	104.19.159.224	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:28.175859928 CEST	8.8.8.8	192.168.2.22	0x688d	No error (0)	webcompanion.com		65	IN (0x0001)	false
Jul 1, 2024 15:25:28.673327923 CEST	8.8.8.8	192.168.2.22	0x65a4	No error (0)	partners.webcompanion.com	104.19.208.152	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:28.673327923 CEST	8.8.8.8	192.168.2.22	0x65a4	No error (0)	partners.webcompanion.com	104.19.159.224	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:29.355628014 CEST	8.8.8.8	192.168.2.22	0x6f0e	No error (0)	cdn.cookielaw.org	104.19.178.52	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:29.355628014 CEST	8.8.8.8	192.168.2.22	0x6f0e	No error (0)	cdn.cookielaw.org	104.19.177.52	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:29.358153105 CEST	8.8.8.8	192.168.2.22	0x7c1b	No error (0)	cdn.cookielaw.org		65	IN (0x0001)	false
Jul 1, 2024 15:25:29.525811911 CEST	8.8.8.8	192.168.2.22	0x925d	No error (0)	sg-bitmask.adaware.com	104.16.213.94	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:29.525811911 CEST	8.8.8.8	192.168.2.22	0x925d	No error (0)	sg-bitmask.adaware.com	104.16.212.94	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:31.257493973 CEST	8.8.8.8	192.168.2.22	0x86	No error (0)	geolocation.onetrust.com	104.18.32.137	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:31.257493973 CEST	8.8.8.8	192.168.2.22	0x86	No error (0)	geolocation.onetrust.com	172.64.155.119	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:31.257533073 CEST	8.8.8.8	192.168.2.22	0x5a79	No error (0)	geolocation.onetrust.com		65	IN (0x0001)	false
Jul 1, 2024 15:25:31.308459044 CEST	8.8.8.8	192.168.2.22	0x372d	No error (0)	cdn.inspectlet.com	104.22.56.245	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:31.308459044 CEST	8.8.8.8	192.168.2.22	0x372d	No error (0)	cdn.inspectlet.com	104.22.57.245	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:31.308459044 CEST	8.8.8.8	192.168.2.22	0x372d	No error (0)	cdn.inspectlet.com	172.67.10.172	A (IP address)	IN (0x0001)	false
Jul 1, 2024 15:25:31.309087038 CEST	8.8.8.8	192.168.2.22	0x3abc	No error (0)	cdn.inspectlet.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

featureflags.lavasoft.com

flwadw.com

wcdownloadercdn.lavasoft.com

geo.lavasoft.com

wc-partners.lavasoft.com

webcompanion.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49168	104.16.149.130	80	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 15:22:16.795782089 CEST	66	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com Connection: Keep-Alive
Jul 1, 2024 15:22:17.284307003 CEST	311	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:17 GMT Content-Type: text/plain Content-Length: 77 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b4398bd943c9-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 47 42 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"GB","x-geocountryname":"United Kingdom","cf-ipcountry":"US"}
Jul 1, 2024 15:22:17.494416952 CEST	311	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:17 GMT Content-Type: text/plain Content-Length: 77 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b4398bd943c9-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 47 42 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"GB","x-geocountryname":"United Kingdom","cf-ipcountry":"US"}
Jul 1, 2024 15:22:31.914199114 CEST	42	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com
Jul 1, 2024 15:22:32.052702904 CEST	311	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:32 GMT Content-Type: text/plain Content-Length: 77 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b495dd3a43c9-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 47 42 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"GB","x-geocountryname":"United Kingdom","cf-ipcountry":"US"}
Jul 1, 2024 15:22:32.262634993 CEST	311	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:32 GMT Content-Type: text/plain Content-Length: 77 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b495dd3a43c9-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 47 42 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 4b 69 6e 67 64 6f 6d 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"GB","x-geocountryname":"United Kingdom","cf-ipcountry":"US"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49218	104.16.148.130	80	2596	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 15:23:10.175843954 CEST	66	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com Connection: Keep-Alive
Jul 1, 2024 15:23:10.852588892 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:10 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5874ba48c6b-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Jul 1, 2024 15:23:10.910387039 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:10 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5874ba48c6b-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Jul 1, 2024 15:23:17.127691984 CEST	42	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com
Jul 1, 2024 15:23:17.263679981 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:17 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5b05b6e8c6b-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Jul 1, 2024 15:23:17.474452019 CEST	310	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:17 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5b05b6e8c6b-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49221	64.18.87.81	80	2596	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 15:23:13.361488104 CEST	117	OUT	GET /Partner.svc/GetPartnerInfo?partner=IN240402 HTTP/1.1 Host: wc-partners.lavasoft.com Connection: Keep-Alive
Jul 1, 2024 15:23:13.891020060 CEST	381	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 01 Jul 2024 13:23:13 GMT Content-Type: application/json; charset=utf-8 Content-Length: 195 Connection: keep-alive X-Powered-By: ASP.NET Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 33 35 33 35 38 22 2c 22 44 65 66 61 75 6c 74 22 3a 66 61 6c 73 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 31 5c 2f 32 30 32 34 20 31 3a 32 33 3a 31 33 20 50 4d 22 2c 22 50 54 41 47 22 3a 22 41 31 36 30 42 31 36 46 30 38 33 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 32 34 39 22 7d 7d Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3335358","Default":false,"InstallDateUtc":"7\/1\/2024 1:23:13 PM","PTAG":"A160B16F083","PURL":"default","WCYID":"WCYID10249"}}
Jul 1, 2024 15:23:13.902312994 CEST	96	OUT	GET /Partner.svc/GetPartnerInfo?partner=IN240402_wb HTTP/1.1 Host: wc-partners.lavasoft.com
Jul 1, 2024 15:23:14.017277002 CEST	389	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 01 Jul 2024 13:23:13 GMT Content-Type: application/json; charset=utf-8 Content-Length: 203 Connection: keep-alive X-Powered-By: ASP.NET Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 32 39 33 38 30 22 2c 22 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 31 5c 2f 32 30 32 34 20 31 3a 32 33 3a 31 33 20 50 4d 22 2c 22 50 54 41 47 22 3a 22 41 30 33 31 45 44 39 34 32 36 37 33 46 34 38 36 34 42 39 46 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 30 30 30 22 7d 7d Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3329380","Default":true,"InstallDateUtc":"7\/1\/2024 1:23:13 PM","PTAG":"A031ED942673F4864B9F","PURL":"default","WCYID":"WCYID10000"}}
Jul 1, 2024 15:23:14.018591881 CEST	96	OUT	GET /Partner.svc/GetPartnerInfo?partner=IN240402_ab HTTP/1.1 Host: wc-partners.lavasoft.com
Jul 1, 2024 15:23:14.133461952 CEST	389	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 01 Jul 2024 13:23:14 GMT Content-Type: application/json; charset=utf-8 Content-Length: 203 Connection: keep-alive X-Powered-By: ASP.NET Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 32 39 33 38 30 22 2c 22 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 31 5c 2f 32 30 32 34 20 31 3a 32 33 3a 31 34 20 50 4d 22 2c 22 50 54 41 47 22 3a 22 41 30 33 31 45 44 39 34 32 36 37 33 46 34 38 36 34 42 39 46 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 30 30 30 22 7d 7d Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3329380","Default":true,"InstallDateUtc":"7\/1\/2024 1:23:14 PM","PTAG":"A031ED942673F4864B9F","PURL":"default","WCYID":"WCYID10000"}}
Jul 1, 2024 15:23:14.134572983 CEST	96	OUT	GET /Partner.svc/GetPartnerInfo?partner=IN240402_ac HTTP/1.1 Host: wc-partners.lavasoft.com
Jul 1, 2024 15:23:14.251740932 CEST	389	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 01 Jul 2024 13:23:14 GMT Content-Type: application/json; charset=utf-8 Content-Length: 203 Connection: keep-alive X-Powered-By: ASP.NET Data Raw: 7b 22 47 65 74 50 61 72 74 6e 65 72 49 6e 66 6f 52 65 73 75 6c 74 22 3a 7b 22 43 4c 49 44 44 53 22 3a 31 30 30 30 38 37 31 2c 22 43 4c 49 44 48 50 22 3a 32 31 37 33 33 31 32 2c 22 43 54 49 44 22 3a 22 43 54 33 33 32 39 33 38 30 22 2c 22 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 55 74 63 22 3a 22 37 5c 2f 31 5c 2f 32 30 32 34 20 31 3a 32 33 3a 31 34 20 50 4d 22 2c 22 50 54 41 47 22 3a 22 41 30 33 31 45 44 39 34 32 36 37 33 46 34 38 36 34 42 39 46 22 2c 22 50 55 52 4c 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 57 43 59 49 44 22 3a 22 57 43 59 49 44 31 30 30 30 30 22 7d 7d Data Ascii: {"GetPartnerInfoResult":{"CLIDDS":1000871,"CLIDHP":2173312,"CTID":"CT3329380","Default":true,"InstallDateUtc":"7\/1\/2024 1:23:14 PM","PTAG":"A031ED942673F4864B9F","PURL":"default","WCYID":"WCYID10000"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49225	104.19.159.224	80	2596	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 15:23:17.356937885 CEST	110	OUT	GET /version_logs?json=true&version=13.900.0.1080 HTTP/1.1 Host: webcompanion.com Connection: Keep-Alive
Jul 1, 2024 15:23:17.851248980 CEST	629	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.2.34 Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5b4190742bf-EWR Data Raw: 31 35 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 31 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 38 3c 2f 62 3e [TRUNCATED] Data Ascii: 158<br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>91</b><br /><br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>98</b><br />null0
Jul 1, 2024 15:23:18.062539101 CEST	629	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.2.34 Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5b4190742bf-EWR Data Raw: 31 35 38 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 31 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 57 61 72 6e 69 6e 67 3c 2f 62 3e 3a 20 20 63 6f 75 6e 74 28 29 3a 20 50 61 72 61 6d 65 74 65 72 20 6d 75 73 74 20 62 65 20 61 6e 20 61 72 72 61 79 20 6f 72 20 61 6e 20 6f 62 6a 65 63 74 20 74 68 61 74 20 69 6d 70 6c 65 6d 65 6e 74 73 20 43 6f 75 6e 74 61 62 6c 65 20 69 6e 20 3c 62 3e 2f 76 61 72 2f 77 77 77 2f 68 74 6d 6c 2f 69 6e 63 6c 75 64 65 73 2f 66 75 6e 63 74 69 6f 6e 73 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 39 38 3c 2f 62 3e [TRUNCATED] Data Ascii: 158<br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>91</b><br /><br /><b>Warning</b>: count(): Parameter must be an array or an object that implements Countable in <b>/var/www/html/includes/functions.php</b> on line <b>98</b><br />null0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49169	104.16.148.130	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:18 UTC	143	OUT	POST /api/feature/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 194 Connection: Keep-Alive
2024-07-01 13:22:18 UTC	194	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 47 42 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 35 34 31 36 31 39 31 33 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 30 37 30 31 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 69 6e 73 74 61 6c 6c 65 72 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 66 65 61 74 75 72 65 77 70 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 7d Data Ascii: {"Geo":"GB","Partner":"IN240402","Campaign":"20541619131","InstallDate":"20240701","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
2024-07-01 13:22:18 UTC	472	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 846 Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b4403ef67290-EWR
2024-07-01 13:22:18 UTC	846	IN	Data Raw: 5b 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 49 63 6f 6e 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 5c 22 2c 20 5c 22 41 70 70 4e 61 6d 65 5c 22 3a 20 5c 22 57 65 62 20 43 6f 6d 70 61 6e 69 6f 6e 5c 22 2c 20 5c 22 53 65 74 74 69 6e 67 73 5c 22 3a 20 5b 5c 22 57 43 41 75 74 6f 55 70 64 61 74 65 5c 22 2c 20 5c 22 45 6e 61 62 6c 65 47 72 61 6e 75 6c 61 72 69 74 79 5c 22 2c 20 5c 22 50 6f 73 74 52 75 6e 56 32 41 63 74 69 6f 6e 5c 22 2c 20 5c 22 50 6f 73 74 52 75 6e 54 69 6d 65 72 41 63 74 69 6f 6e 5c 22 2c 20 5c 22 45 6e 61 62 6c 65 54 65 Data Ascii: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49170	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:19 UTC	166	OUT	POST /v1/event-stat?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 470 Connection: Keep-Alive
2024-07-01 13:22:19 UTC	470	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 54 72 69 67 67 65 72 22 3a 20 22 69 6e 73 74 61 6c 6c 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "Trigger": "install", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit
2024-07-01 13:22:19 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:19 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b448598f41c1-EWR
2024-07-01 13:22:19 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49171	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:20 UTC	145	OUT	POST /v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 421
2024-07-01 13:22:20 UTC	421	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 54 72 69 67 67 65 72 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","Trigger":"install","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402"
2024-07-01 13:22:20 UTC	235	IN	HTTP/1.1 400 Bad Request Date: Mon, 01 Jul 2024 13:22:20 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b44c7d6243c9-EWR
2024-07-01 13:22:20 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 49 6e 76 61 6c 69 64 20 66 6f 72 6d 61 74 2f 64 61 74 61 22 7d 0d 0a Data Ascii: 21{"message":"Invalid format/data"}
2024-07-01 13:22:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49172	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:20 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 531
2024-07-01 13:22:20 UTC	531	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:20 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:20 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b4508aa56a58-EWR
2024-07-01 13:22:20 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49173	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:21 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 669
2024-07-01 13:22:21 UTC	669	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:21 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:21 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b454cf8f43f1-EWR
2024-07-01 13:22:21 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49174	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:22 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 538
2024-07-01 13:22:22 UTC	538	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:23 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:22 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b45d2ed342f8-EWR
2024-07-01 13:22:23 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49175	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:23 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 505
2024-07-01 13:22:23 UTC	505	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:23 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:23 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b4618b7d4328-EWR
2024-07-01 13:22:23 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49176	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:24 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 538
2024-07-01 13:22:24 UTC	538	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:24 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:24 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b465dcc843fd-EWR
2024-07-01 13:22:24 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49177	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:24 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 511
2024-07-01 13:22:24 UTC	511	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:25 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:25 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b46a2f8941fe-EWR
2024-07-01 13:22:25 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49178	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:25 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 550
2024-07-01 13:22:25 UTC	550	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:25 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:25 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b46e98ee0cbc-EWR
2024-07-01 13:22:25 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49179	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:26 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 489
2024-07-01 13:22:26 UTC	489	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:26 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:26 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b472ee1c5e78-EWR
2024-07-01 13:22:26 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49180	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:26 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 550
2024-07-01 13:22:26 UTC	550	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:27 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:27 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b4773c7a0f9b-EWR
2024-07-01 13:22:27 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49181	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:27 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 481
2024-07-01 13:22:27 UTC	481	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:27 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:27 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b47b4e096a52-EWR
2024-07-01 13:22:27 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49182	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:28 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 543
2024-07-01 13:22:28 UTC	543	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:28 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:28 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b47fbc084210-EWR
2024-07-01 13:22:28 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49183	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:29 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 483
2024-07-01 13:22:29 UTC	483	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:29 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b483ea507d05-EWR
2024-07-01 13:22:29 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49184	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:29 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 543
2024-07-01 13:22:29 UTC	543	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:29 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b487f8de8c2f-EWR
2024-07-01 13:22:29 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49185	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:30 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 498
2024-07-01 13:22:30 UTC	498	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:30 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:30 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b48c4e6e4407-EWR
2024-07-01 13:22:30 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49186	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:31 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 543
2024-07-01 13:22:31 UTC	543	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:31 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:31 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b490694a8c48-EWR
2024-07-01 13:22:31 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49187	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:31 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 514
2024-07-01 13:22:31 UTC	514	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:31 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:31 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b494e8d0440c-EWR
2024-07-01 13:22:31 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49188	104.16.148.130	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:32 UTC	118	OUT	POST /api/Update/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 194
2024-07-01 13:22:32 UTC	194	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 47 42 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 35 34 31 36 31 39 31 33 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 30 37 30 31 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 69 6e 73 74 61 6c 6c 65 72 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 66 65 61 74 75 72 65 77 70 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 7d Data Ascii: {"Geo":"GB","Partner":"IN240402","Campaign":"20541619131","InstallDate":"20240701","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
2024-07-01 13:22:32 UTC	472	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:32 GMT Content-Type: application/json; charset=utf-8 Content-Length: 320 Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b49a3f7e423e-EWR
2024-07-01 13:22:32 UTC	320	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 22 55 50 44 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 20 5c 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 5c 22 2c 20 5c 22 49 6e 73 74 61 6c 6c 65 72 45 78 65 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 31 33 2e 30 2e 30 2e 31 30 38 30 2f 57 43 49 6e 73 74 61 6c 6c 65 72 5f 4e 6f 6e 41 64 6d 69 6e 2e 65 78 65 5c 22 2c 20 5c 22 49 6e 73 74 61 6c 6c 65 72 5a 69 70 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 2f 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2d 31 33 2e 39 30 30 2e 30 2e 31 Data Ascii: {"code":"UPD","configuration":"{\"Version\": \"13.900.0.1080\", \"InstallerExe\": \"https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe\", \"InstallerZip\": \"https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49189	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:33 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 540
2024-07-01 13:22:33 UTC	540	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:33 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:33 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b49ec8f643f7-EWR
2024-07-01 13:22:33 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49190	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:33 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 508
2024-07-01 13:22:33 UTC	508	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:34 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b4a2dd550caa-EWR
2024-07-01 13:22:34 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49191	104.16.149.130	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:34 UTC	127	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com Connection: Keep-Alive
2024-07-01 13:22:34 UTC	378	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:34 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "4139849418" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: REVALIDATED Expires: Mon, 01 Jul 2024 17:22:34 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 89c6b4a78d944228-EWR
2024-07-01 13:22:34 UTC	991	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-07-01 13:22:34 UTC	1369	IN	Data Raw: 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 ae 3f ce Data Ascii: he+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF?
2024-07-01 13:22:34 UTC	1369	IN	Data Raw: a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 a1 86 80 Data Ascii: r\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-07-01 13:22:34 UTC	1369	IN	Data Raw: 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 67 00 a6 Data Ascii: ABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1g
2024-07-01 13:22:34 UTC	1369	IN	Data Raw: d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 d3 28 0f Data Ascii: d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n(
2024-07-01 13:22:34 UTC	1369	IN	Data Raw: 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed 2e 5a f2 Data Ascii: .]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s.Z
2024-07-01 13:22:34 UTC	1369	IN	Data Raw: cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 d2 d1 f4 Data Ascii: Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-07-01 13:22:34 UTC	1369	IN	Data Raw: ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a 9d 7c 26 Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B\|&
2024-07-01 13:22:34 UTC	1369	IN	Data Raw: 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 ea c1 9f Data Ascii: gs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-07-01 13:22:34 UTC	1369	IN	Data Raw: 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a 95 1d 47 Data Ascii: B$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\LpujG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49192	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:44 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 541
2024-07-01 13:22:44 UTC	541	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:45 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:44 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b4e6be0e4222-EWR
2024-07-01 13:22:45 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49193	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:45 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 544
2024-07-01 13:22:45 UTC	544	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:45 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:45 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b4ec8a5e0cc2-EWR
2024-07-01 13:22:45 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49194	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:48 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 536
2024-07-01 13:22:48 UTC	536	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:49 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:48 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b4ffde6b5e67-EWR
2024-07-01 13:22:49 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49195	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:49 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 514
2024-07-01 13:22:49 UTC	514	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:49 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:49 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b50409218cb3-EWR
2024-07-01 13:22:49 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49196	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:50 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 545
2024-07-01 13:22:50 UTC	545	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:50 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:50 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5083a550c80-EWR
2024-07-01 13:22:50 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49197	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:50 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 510
2024-07-01 13:22:50 UTC	510	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:51 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:50 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b50c6a8b0f7f-EWR
2024-07-01 13:22:51 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49198	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:51 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 544
2024-07-01 13:22:51 UTC	544	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:51 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:51 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5108b1c0f41-EWR
2024-07-01 13:22:51 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49199	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:52 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 508
2024-07-01 13:22:52 UTC	508	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:52 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:52 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b514b8bc4356-EWR
2024-07-01 13:22:52 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49200	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:52 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 544
2024-07-01 13:22:52 UTC	544	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:53 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:53 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5191ef54309-EWR
2024-07-01 13:22:53 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49201	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:53 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 520
2024-07-01 13:22:53 UTC	520	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:53 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:53 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b51d18e68ce6-EWR
2024-07-01 13:22:53 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49202	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:54 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 546
2024-07-01 13:22:54 UTC	546	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:54 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:54 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b521bb531a0f-EWR
2024-07-01 13:22:54 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49203	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:54 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 514
2024-07-01 13:22:54 UTC	514	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:55 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:55 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5261e360f6c-EWR
2024-07-01 13:22:55 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49204	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:55 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 544
2024-07-01 13:22:55 UTC	544	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:56 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:56 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b52bdef342af-EWR
2024-07-01 13:22:56 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.22	49205	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:56 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 484
2024-07-01 13:22:56 UTC	484	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:56 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:56 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b52fdd8e43d6-EWR
2024-07-01 13:22:56 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.22	49206	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:57 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 541
2024-07-01 13:22:57 UTC	541	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:57 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:57 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5343957c407-EWR
2024-07-01 13:22:57 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.22	49207	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:57 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 508
2024-07-01 13:22:57 UTC	508	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:58 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:58 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5390aa60f68-EWR
2024-07-01 13:22:58 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.22	49208	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:59 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 546
2024-07-01 13:22:59 UTC	546	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:22:59 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:59 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b53f681bc43b-EWR
2024-07-01 13:22:59 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.22	49209	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:22:59 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 509
2024-07-01 13:22:59 UTC	509	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:22:59 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:22:59 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b54379e742e9-EWR
2024-07-01 13:22:59 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:22:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.22	49210	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:00 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 542
2024-07-01 13:23:00 UTC	542	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:23:00 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:00 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b547b9bd78d6-EWR
2024-07-01 13:23:00 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.22	49211	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:01 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 492
2024-07-01 13:23:01 UTC	492	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:23:01 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:01 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b54bfc024319-EWR
2024-07-01 13:23:01 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.22	49212	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:01 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 544
2024-07-01 13:23:01 UTC	544	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:23:01 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:01 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5500a644245-EWR
2024-07-01 13:23:01 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.22	49213	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:02 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 503
2024-07-01 13:23:02 UTC	503	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:23:02 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:02 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5540c904349-EWR
2024-07-01 13:23:02 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.22	49214	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:03 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 544
2024-07-01 13:23:03 UTC	544	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:23:03 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:03 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5587a8b8c87-EWR
2024-07-01 13:23:03 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.22	49215	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:03 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 502
2024-07-01 13:23:03 UTC	502	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:23:03 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:03 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b55cb96ec359-EWR
2024-07-01 13:23:03 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.22	49216	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:04 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 540
2024-07-01 13:23:04 UTC	540	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:23:04 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:04 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b561cbc0192a-EWR
2024-07-01 13:23:04 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.22	49217	104.18.26.149	443	2412	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:05 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 502
2024-07-01 13:23:05 UTC	502	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:23:05 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:05 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b565d84043b8-EWR
2024-07-01 13:23:05 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.22	49219	104.16.149.130	443	2596	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:11 UTC	143	OUT	POST /api/feature/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 466 Connection: Keep-Alive
2024-07-01 13:23:11 UTC	466	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 35 34 31 36 31 39 31 33 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 61 66 74 65 72 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 61 70 70 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 45 6e 67 69 6e 65 49 64 22 3a 6e 75 6c 6c 2c 22 54 65 6d 70 6c 61 74 65 49 64 22 3a 6e 75 6c 6c 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 63 73 73 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 73 6c 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 73 6f 22 3a Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20541619131","InstallDate":"","TriggerType":"afterinstall","TriggerEvent":"app","Version":"13.900.0.1080","EngineId":null,"TemplateId":null,"featureal":true,"featuremtcss":true,"featuremtsl":true,"featuremtso":
2024-07-01 13:23:11 UTC	473	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:11 GMT Content-Type: application/json; charset=utf-8 Content-Length: 2278 Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b58dc9a74384-EWR
2024-07-01 13:23:11 UTC	896	IN	Data Raw: 5b 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 4d 54 46 47 22 2c 22 63 6f 64 65 22 3a 22 4d 54 54 50 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 54 79 70 65 5c 22 3a 20 5c 22 4e 6f 6e 55 49 5c 22 2c 20 5c 22 52 65 73 65 74 5c 22 3a 20 5c 22 31 38 30 5c 22 2c 20 5c 22 41 63 74 69 6f 6e 73 5c 22 3a 20 5b 7b 5c 22 44 61 74 61 5c 22 3a 20 7b 5c 22 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 5c 22 3a 20 7b 5c 22 45 6e 61 62 6c 65 4d 61 6e 61 67 65 41 50 49 5c 22 3a 20 66 61 6c 73 65 2c 20 5c 22 44 69 73 61 62 6c 65 52 65 70 6f 72 74 69 6e 67 5c 22 3a 20 74 72 75 65 7d 7d 2c 20 5c 22 4e 61 6d 65 5c 22 3a 20 5c 22 45 6e 61 62 6c 65 46 46 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 5c 22 2c 20 5c 22 43 72 69 74 65 72 69 61 5c 22 3a 20 Data Ascii: [{"sectionCode":"MTFG","code":"MTTP","configuration":"{\"Type\": \"NonUI\", \"Reset\": \"180\", \"Actions\": [{\"Data\": {\"TelemetryShield\": {\"EnableManageAPI\": false, \"DisableReporting\": true}}, \"Name\": \"EnableFFTelemetryShield\", \"Criteria\":
2024-07-01 13:23:11 UTC	1369	IN	Data Raw: 74 56 65 72 73 69 6f 6e 5c 22 3a 20 5c 22 39 2e 33 2e 30 5c 22 7d 22 2c 22 74 61 72 67 65 74 49 64 22 3a 33 30 31 7d 2c 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 6e 75 6c 6c 2c 22 63 6f 64 65 22 3a 22 4f 53 4c 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 5b 7b 5c 22 42 72 6f 77 73 65 72 5c 22 3a 20 5c 22 46 69 72 65 66 6f 78 5c 22 2c 20 5c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 73 5c 22 3a 20 5b 5c 22 4d 79 20 42 69 6e 67 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 44 65 66 61 75 6c 74 20 53 65 61 72 63 68 20 45 6e 67 69 6e 65 5c 22 2c 20 5c 22 53 65 63 75 72 65 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 50 72 69 76 61 74 65 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 4d 79 20 46 69 72 65 66 6f 78 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 53 65 61 72 63 68 Data Ascii: tVersion\": \"9.3.0\"}","targetId":301},{"sectionCode":null,"code":"OSL","configuration":"[{\"Browser\": \"Firefox\", \"SearchEngines\": [\"My Bing Search\", \"Default Search Engine\", \"Secure Search\", \"Private Search\", \"My Firefox Search\", \"Search
2024-07-01 13:23:11 UTC	13	IN	Data Raw: 72 67 65 74 49 64 22 3a 32 34 31 7d 5d Data Ascii: rgetId":241}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.22	49220	104.18.26.149	443	2596	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:12 UTC	180	OUT	POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 4686 Connection: Keep-Alive
2024-07-01 13:23:12 UTC	4686	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 61 66 74 65 72 69 6e 73 74 61 6c 6c 22 2c 22 4e 61 6d 65 22 3a 22 47 65 74 46 65 61 74 75 72 65 73 22 2c 22 52 65 71 75 65 73 74 22 3a 22 7b 5c 22 47 65 6f 5c 22 3a 5c 22 55 53 5c 22 2c 5c 22 50 61 72 74 6e 65 72 5c 22 3a 5c 22 49 4e 32 34 30 34 30 32 5c 22 2c 5c 22 43 61 6d 70 61 69 67 6e 5c 22 3a 5c 22 32 30 35 34 31 36 31 39 31 33 31 5c 22 2c 5c 22 49 6e 73 74 61 6c 6c 44 61 74 65 5c 22 3a 5c 22 5c 22 2c 5c 22 54 72 69 67 67 65 72 54 79 70 65 5c 22 3a 5c 22 61 66 74 65 72 69 6e 73 74 61 6c 6c 5c 22 2c 5c 22 54 72 69 67 67 65 72 45 76 65 6e 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 5c 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 5c 22 2c 5c 22 45 6e 67 69 6e 65 49 Data Ascii: {"Data": {"Trigger":"afterinstall","Name":"GetFeatures","Request":"{\"Geo\":\"US\",\"Partner\":\"IN240402\",\"Campaign\":\"20541619131\",\"InstallDate\":\"\",\"TriggerType\":\"afterinstall\",\"TriggerEvent\":\"app\",\"Version\":\"13.900.0.1080\",\"EngineI
2024-07-01 13:23:12 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:12 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5940db38cad-EWR
2024-07-01 13:23:12 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.22	49222	104.18.26.149	443	2596	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:14 UTC	143	OUT	POST /v1/event-stat?Type=Launch&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 423
2024-07-01 13:23:14 UTC	423	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 53 74 61 72 74 54 72 69 67 67 65 72 22 3a 22 49 6e 73 74 61 6c 6c 52 75 6e 22 2c 22 55 73 65 72 53 74 61 74 75 73 22 3a 22 41 6e 6f 6e 79 6d 6f 75 73 22 2c 22 49 73 53 79 73 74 65 6d 22 3a 66 61 6c 73 65 2c 22 49 73 43 6f 6d 70 6f 6e 65 6e 74 42 61 73 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6d 70 6f 6e 65 6e 74 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 30 31 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 Data Ascii: {"Data": {"StartTrigger":"InstallRun","UserStatus":"Anonymous","IsSystem":false,"IsComponentBased":false,"Component":"","InstallDate":"2024-07-01T00:00:00","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Language":"en-US","MachineId":"de4229fc-f97f-58
2024-07-01 13:23:15 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:15 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5a26a884299-EWR
2024-07-01 13:23:15 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.22	49223	104.18.26.149	443	2596	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:16 UTC	148	OUT	POST /v1/event-stat-wc?Type=FirstRun&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 326
2024-07-01 13:23:16 UTC	326	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 44 65 66 61 75 6c 74 42 72 6f 77 73 65 72 22 3a 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 31 30 39 2e 30 2e 35 34 31 34 2e 31 32 30 22 2c 22 4f 72 69 67 69 6e 61 6c 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 4f 72 69 67 69 6e 61 6c 48 6f 6d 65 70 61 67 65 22 3a 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 22 2c 22 49 50 22 3a 6e 75 6c 6c 2c 22 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","DefaultBrowser":"Google Chrome109.0.5414.120","OriginalSearch":"Google","OriginalHomepage":"about:blank","IP":null,"
2024-07-01 13:23:16 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:16 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5ab1b321839-EWR
2024-07-01 13:23:16 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.22	49224	104.18.26.149	443	2596	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:16 UTC	145	OUT	POST /v1/event-stat?Type=FirstRun&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 326
2024-07-01 13:23:16 UTC	326	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 44 65 66 61 75 6c 74 42 72 6f 77 73 65 72 22 3a 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 31 30 39 2e 30 2e 35 34 31 34 2e 31 32 30 22 2c 22 4f 72 69 67 69 6e 61 6c 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 4f 72 69 67 69 6e 61 6c 48 6f 6d 65 70 61 67 65 22 3a 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 22 2c 22 49 50 22 3a 6e 75 6c 6c 2c 22 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","DefaultBrowser":"Google Chrome109.0.5414.120","OriginalSearch":"Google","OriginalHomepage":"about:blank","IP":null,"
2024-07-01 13:23:17 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:17 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5af6e478c0b-EWR
2024-07-01 13:23:17 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.22	49226	104.18.26.149	443	2596	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:18 UTC	149	OUT	POST /v1/event-stat?Type=NanoBrowser&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 1801
2024-07-01 13:23:18 UTC	1801	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 49 6e 73 74 61 6c 6c 22 2c 22 42 72 6f 77 73 65 72 22 3a 7b 22 43 68 72 6f 6d 65 22 3a 7b 22 49 73 44 65 66 61 75 6c 74 22 3a 74 72 75 65 2c 22 49 73 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 52 75 6e 6e 69 6e 67 22 3a 66 61 6c 73 65 2c 22 4f 72 69 67 69 6e 61 6c 48 6f 6d 65 50 61 67 65 22 3a 22 61 62 6f 75 74 3a 62 6c 61 6e 6b 22 2c 22 4f 72 69 67 69 6e 61 6c 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 30 39 2e 30 2e 35 34 31 34 2e 31 32 30 22 2c 22 50 72 6f 66 69 6c 65 73 22 3a 31 2c 22 70 72 6f 66 69 6c 65 31 22 3a 7b 22 4f 72 69 67 69 6e 61 6c 48 6f 6d 65 50 61 67 65 22 3a 22 61 62 6f 75 74 3a 68 6f 6d 65 22 2c 22 4f 72 69 67 69 6e Data Ascii: {"Data": {"Trigger":"Install","Browser":{"Chrome":{"IsDefault":true,"IsInstalled":true,"IsRunning":false,"OriginalHomePage":"about:blank","OriginalSearch":"Google","Version":"109.0.5414.120","Profiles":1,"profile1":{"OriginalHomePage":"about:home","Origin
2024-07-01 13:23:18 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:18 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5baaa524343-EWR
2024-07-01 13:23:18 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.22	49227	104.16.148.130	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:28 UTC	143	OUT	POST /api/feature/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 479 Connection: Keep-Alive
2024-07-01 13:23:28 UTC	479	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 35 34 31 36 31 39 31 33 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 6c 61 75 6e 63 68 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 61 70 70 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 45 6e 67 69 6e 65 49 64 22 3a 6e 75 6c 6c 2c 22 54 65 6d 70 6c 61 74 65 49 64 22 3a 6e 75 6c 6c 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 63 73 73 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 73 6c 22 3a 74 72 75 65 2c 22 Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20541619131","InstallDate":"2024-07-01T13:23:12","TriggerType":"launch","TriggerEvent":"app","Version":"13.900.0.1080","EngineId":null,"TemplateId":null,"featureal":true,"featuremtcss":true,"featuremtsl":true,"
2024-07-01 13:23:28 UTC	473	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:28 GMT Content-Type: application/json; charset=utf-8 Content-Length: 4180 Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5f6bb4e0f7f-EWR
2024-07-01 13:23:28 UTC	896	IN	Data Raw: 5b 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 4d 54 46 47 22 2c 22 63 6f 64 65 22 3a 22 4d 54 54 50 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 54 79 70 65 5c 22 3a 20 5c 22 4e 6f 6e 55 49 5c 22 2c 20 5c 22 52 65 73 65 74 5c 22 3a 20 5c 22 31 38 30 5c 22 2c 20 5c 22 41 63 74 69 6f 6e 73 5c 22 3a 20 5b 7b 5c 22 44 61 74 61 5c 22 3a 20 7b 5c 22 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 5c 22 3a 20 7b 5c 22 45 6e 61 62 6c 65 4d 61 6e 61 67 65 41 50 49 5c 22 3a 20 66 61 6c 73 65 2c 20 5c 22 44 69 73 61 62 6c 65 52 65 70 6f 72 74 69 6e 67 5c 22 3a 20 74 72 75 65 7d 7d 2c 20 5c 22 4e 61 6d 65 5c 22 3a 20 5c 22 45 6e 61 62 6c 65 46 46 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 5c 22 2c 20 5c 22 43 72 69 74 65 72 69 61 5c 22 3a 20 Data Ascii: [{"sectionCode":"MTFG","code":"MTTP","configuration":"{\"Type\": \"NonUI\", \"Reset\": \"180\", \"Actions\": [{\"Data\": {\"TelemetryShield\": {\"EnableManageAPI\": false, \"DisableReporting\": true}}, \"Name\": \"EnableFFTelemetryShield\", \"Criteria\":
2024-07-01 13:23:28 UTC	1369	IN	Data Raw: 4d 69 63 72 6f 73 6f 66 74 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 5c 5c 5c 41 70 70 20 50 61 74 68 73 5c 5c 5c 5c 63 68 72 6f 6d 65 2e 65 78 65 5c 22 2c 20 5c 22 43 6f 6d 70 61 72 69 73 69 6f 6e 5c 22 3a 20 5c 22 45 78 69 73 74 73 5c 22 7d 5d 2c 20 5c 22 4f 75 72 53 65 61 72 63 68 5c 22 3a 20 5b 7b 5c 22 42 72 6f 77 73 65 72 5c 22 3a 20 5c 22 43 68 72 6f 6d 65 5c 22 2c 20 5c 22 43 6f 6d 70 61 72 69 73 69 6f 6e 5c 22 3a 20 5c 22 4e 45 51 5c 22 2c 20 5c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 73 5c 22 3a 20 5b 5c 22 59 61 68 6f 6f 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 42 69 6e 67 20 44 65 66 61 75 6c 74 5c 22 2c 20 5c 22 42 69 6e 67 20 44 65 66 61 75 6c 74 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 44 65 66 61 Data Ascii: Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\chrome.exe\", \"Comparision\": \"Exists\"}], \"OurSearch\": [{\"Browser\": \"Chrome\", \"Comparision\": \"NEQ\", \"SearchEngines\": [\"Yahoo Search\", \"Bing Default\", \"Bing Default Search\", \"Defa
2024-07-01 13:23:28 UTC	1369	IN	Data Raw: 20 5c 22 38 5c 22 2c 20 5c 22 43 6f 6d 70 61 72 69 73 69 6f 6e 5c 22 3a 20 5c 22 47 54 45 51 5c 22 7d 7d 7d 5d 2c 20 5c 22 46 65 61 74 75 72 65 5c 22 3a 20 5c 22 53 65 61 72 63 68 53 65 74 5c 22 2c 20 5c 22 54 72 69 67 67 65 72 5c 22 3a 20 5c 22 6d 69 6e 69 6d 69 7a 65 5c 22 2c 20 5c 22 54 65 6d 70 6c 61 74 65 5c 22 3a 20 5c 22 54 72 61 79 47 72 65 65 6e 5c 22 7d 22 2c 22 74 61 72 67 65 74 49 64 22 3a 31 32 32 31 7d 2c 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 49 63 6f 6e 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 5c 22 2c 20 5c 22 41 Data Ascii: \"8\", \"Comparision\": \"GTEQ\"}}}], \"Feature\": \"SearchSet\", \"Trigger\": \"minimize\", \"Template\": \"TrayGreen\"}","targetId":1221},{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"A
2024-07-01 13:23:28 UTC	546	IN	Data Raw: 62 65 72 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 59 61 68 6f 6f 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 59 61 6e 64 65 78 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 50 6f 73 68 75 6b 61 63 68 20 45 6e 67 69 6e 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 4d 61 69 6c 2e 72 75 5c 22 2c 20 5c 22 47 6f 47 6f 20 54 65 63 68 20 53 65 61 72 63 68 5c 22 5d 7d 5d 22 2c 22 74 61 72 67 65 74 49 64 22 3a 36 32 35 7d 2c 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 57 46 41 49 22 2c 22 63 6f 64 65 22 3a 22 57 43 50 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 20 5c 22 33 2e 30 2e 32 2e 31 32 5c 22 2c 20 5c 22 46 69 6c 65 50 61 74 68 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 72 74 2e 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f Data Ascii: ber Search\", \"Yahoo Search\", \"Yandex Search\", \"Poshukach Engin Search\", \"Mail.ru\", \"GoGo Tech Search\"]}]","targetId":625},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.22	49228	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:29 UTC	180	OUT	POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 7931 Connection: Keep-Alive
2024-07-01 13:23:29 UTC	7931	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 6c 61 75 6e 63 68 22 2c 22 4e 61 6d 65 22 3a 22 47 65 74 46 65 61 74 75 72 65 73 22 2c 22 52 65 71 75 65 73 74 22 3a 22 7b 5c 22 47 65 6f 5c 22 3a 5c 22 55 53 5c 22 2c 5c 22 50 61 72 74 6e 65 72 5c 22 3a 5c 22 49 4e 32 34 30 34 30 32 5c 22 2c 5c 22 43 61 6d 70 61 69 67 6e 5c 22 3a 5c 22 32 30 35 34 31 36 31 39 31 33 31 5c 22 2c 5c 22 49 6e 73 74 61 6c 6c 44 61 74 65 5c 22 3a 5c 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 5c 22 2c 5c 22 54 72 69 67 67 65 72 54 79 70 65 5c 22 3a 5c 22 6c 61 75 6e 63 68 5c 22 2c 5c 22 54 72 69 67 67 65 72 45 76 65 6e 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 5c 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 5c 22 2c 5c 22 Data Ascii: {"Data": {"Trigger":"launch","Name":"GetFeatures","Request":"{\"Geo\":\"US\",\"Partner\":\"IN240402\",\"Campaign\":\"20541619131\",\"InstallDate\":\"2024-07-01T13:23:12\",\"TriggerType\":\"launch\",\"TriggerEvent\":\"app\",\"Version\":\"13.900.0.1080\",\"
2024-07-01 13:23:29 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b5fc39714338-EWR
2024-07-01 13:23:29 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.22	49229	104.16.148.130	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:30 UTC	118	OUT	POST /api/Update/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 479
2024-07-01 13:23:30 UTC	479	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 35 34 31 36 31 39 31 33 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 75 70 64 61 74 65 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 61 70 70 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 45 6e 67 69 6e 65 49 64 22 3a 6e 75 6c 6c 2c 22 54 65 6d 70 6c 61 74 65 49 64 22 3a 6e 75 6c 6c 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 63 73 73 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 73 6c 22 3a 74 72 75 65 2c 22 Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20541619131","InstallDate":"2024-07-01T13:23:12","TriggerType":"update","TriggerEvent":"app","Version":"13.900.0.1080","EngineId":null,"TemplateId":null,"featureal":true,"featuremtcss":true,"featuremtsl":true,"
2024-07-01 13:23:30 UTC	412	IN	HTTP/1.1 204 No Content Date: Mon, 01 Jul 2024 13:23:30 GMT Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b601c8708cb4-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.22	49230	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:30 UTC	156	OUT	POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 1020
2024-07-01 13:23:30 UTC	1020	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 75 70 64 61 74 65 22 2c 22 4e 61 6d 65 22 3a 22 43 68 65 63 6b 55 70 64 61 74 65 22 2c 22 52 65 71 75 65 73 74 22 3a 22 7b 5c 22 47 65 6f 5c 22 3a 5c 22 55 53 5c 22 2c 5c 22 50 61 72 74 6e 65 72 5c 22 3a 5c 22 49 4e 32 34 30 34 30 32 5c 22 2c 5c 22 43 61 6d 70 61 69 67 6e 5c 22 3a 5c 22 32 30 35 34 31 36 31 39 31 33 31 5c 22 2c 5c 22 49 6e 73 74 61 6c 6c 44 61 74 65 5c 22 3a 5c 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 5c 22 2c 5c 22 54 72 69 67 67 65 72 54 79 70 65 5c 22 3a 5c 22 75 70 64 61 74 65 5c 22 2c 5c 22 54 72 69 67 67 65 72 45 76 65 6e 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 5c 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 5c 22 2c 5c 22 Data Ascii: {"Data": {"Trigger":"update","Name":"CheckUpdate","Request":"{\"Geo\":\"US\",\"Partner\":\"IN240402\",\"Campaign\":\"20541619131\",\"InstallDate\":\"2024-07-01T13:23:12\",\"TriggerType\":\"update\",\"TriggerEvent\":\"app\",\"Version\":\"13.900.0.1080\",\"
2024-07-01 13:23:31 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:31 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b6077c67425e-EWR
2024-07-01 13:23:31 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.22	49231	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:31 UTC	149	OUT	POST /v1/event-stat?Type=ToggleButton&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 577
2024-07-01 13:23:31 UTC	577	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 42 75 74 74 6f 6e 22 3a 22 4c 61 75 6e 63 68 41 74 53 74 61 72 74 75 70 22 2c 22 46 65 61 74 75 72 65 22 3a 22 4e 2f 41 22 2c 22 50 6c 61 63 65 6d 65 6e 74 22 3a 22 53 65 74 74 69 6e 67 73 22 2c 22 4e 61 6d 65 22 3a 22 4e 2f 41 22 2c 22 45 6e 61 62 6c 65 41 75 74 6f 55 70 64 61 74 65 22 3a 74 72 75 65 2c 22 45 6e 61 62 6c 65 53 69 74 65 4d 6f 6e 69 74 6f 72 69 6e 67 22 3a 66 61 6c 73 65 2c 22 45 6e 61 62 6c 65 54 79 70 6f 73 71 75 61 74 74 69 6e 67 50 72 6f 74 65 63 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 45 6e 61 62 6c 65 55 70 64 61 74 65 4e 6f 74 69 66 69 63 61 74 69 6f 6e 73 22 3a 74 72 75 65 2c 22 4c 61 6e 67 75 61 67 65 53 65 74 74 69 6e 67 22 3a 22 65 6e 2d 55 53 22 2c 22 4c 61 75 6e 63 68 41 74 53 74 61 72 74 75 70 Data Ascii: {"Data": {"Button":"LaunchAtStartup","Feature":"N/A","Placement":"Settings","Name":"N/A","EnableAutoUpdate":true,"EnableSiteMonitoring":false,"EnableTyposquattingProtection":false,"EnableUpdateNotifications":true,"LanguageSetting":"en-US","LaunchAtStartup
2024-07-01 13:23:32 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:32 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b60d2ab05e71-EWR
2024-07-01 13:23:32 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.22	49233	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:38 UTC	159	OUT	POST /v1/event-stat?Type=ValidateMicrotargeting&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 715
2024-07-01 13:23:38 UTC	715	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 43 68 72 6f 6d 65 43 75 72 72 65 6e 74 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 43 68 72 6f 6d 65 56 65 72 73 69 6f 6e 22 3a 22 31 30 39 2e 30 2e 35 34 31 34 2e 31 32 30 22 2c 22 46 65 61 74 75 72 65 4d 61 74 63 68 22 3a 74 72 75 65 2c 22 46 69 72 65 66 6f 78 43 75 72 72 65 6e 74 53 65 61 72 63 68 22 3a 22 47 6f 6f 67 6c 65 22 2c 22 46 69 72 65 66 6f 78 56 65 72 73 69 6f 6e 22 3a 22 35 32 2e 30 2e 31 22 2c 22 49 6e 73 74 61 6c 6c 41 67 65 22 3a 22 30 22 2c 22 49 73 43 68 72 6f 6d 65 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 49 73 46 69 72 65 66 6f 78 49 6e 73 74 61 6c 6c 65 64 22 3a 74 72 75 65 2c 22 4f 75 72 49 6e 73 74 61 6c 6c 65 64 45 78 74 65 6e 73 69 6f 6e 73 22 3a 5b 5d 2c 22 4f 75 72 53 65 61 Data Ascii: {"Data": {"ChromeCurrentSearch":"Google","ChromeVersion":"109.0.5414.120","FeatureMatch":true,"FirefoxCurrentSearch":"Google","FirefoxVersion":"52.0.1","InstallAge":"0","IsChromeInstalled":true,"IsFirefoxInstalled":true,"OurInstalledExtensions":[],"OurSea
2024-07-01 13:23:38 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:38 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b636d8e41774-EWR
2024-07-01 13:23:38 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.22	49232	104.16.148.130	443	204	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:38 UTC	143	OUT	POST /api/feature/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 479 Connection: Keep-Alive
2024-07-01 13:23:38 UTC	479	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 35 34 31 36 31 39 31 33 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 6c 61 75 6e 63 68 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 61 70 70 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 45 6e 67 69 6e 65 49 64 22 3a 6e 75 6c 6c 2c 22 54 65 6d 70 6c 61 74 65 49 64 22 3a 6e 75 6c 6c 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 63 73 73 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 73 6c 22 3a 74 72 75 65 2c 22 Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20541619131","InstallDate":"2024-07-01T13:23:12","TriggerType":"launch","TriggerEvent":"app","Version":"13.900.0.1080","EngineId":null,"TemplateId":null,"featureal":true,"featuremtcss":true,"featuremtsl":true,"
2024-07-01 13:23:38 UTC	473	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:38 GMT Content-Type: application/json; charset=utf-8 Content-Length: 4180 Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b636f9887c8e-EWR
2024-07-01 13:23:38 UTC	896	IN	Data Raw: 5b 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 4d 54 46 47 22 2c 22 63 6f 64 65 22 3a 22 4d 54 54 50 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 54 79 70 65 5c 22 3a 20 5c 22 4e 6f 6e 55 49 5c 22 2c 20 5c 22 52 65 73 65 74 5c 22 3a 20 5c 22 31 38 30 5c 22 2c 20 5c 22 41 63 74 69 6f 6e 73 5c 22 3a 20 5b 7b 5c 22 44 61 74 61 5c 22 3a 20 7b 5c 22 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 5c 22 3a 20 7b 5c 22 45 6e 61 62 6c 65 4d 61 6e 61 67 65 41 50 49 5c 22 3a 20 66 61 6c 73 65 2c 20 5c 22 44 69 73 61 62 6c 65 52 65 70 6f 72 74 69 6e 67 5c 22 3a 20 74 72 75 65 7d 7d 2c 20 5c 22 4e 61 6d 65 5c 22 3a 20 5c 22 45 6e 61 62 6c 65 46 46 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 5c 22 2c 20 5c 22 43 72 69 74 65 72 69 61 5c 22 3a 20 Data Ascii: [{"sectionCode":"MTFG","code":"MTTP","configuration":"{\"Type\": \"NonUI\", \"Reset\": \"180\", \"Actions\": [{\"Data\": {\"TelemetryShield\": {\"EnableManageAPI\": false, \"DisableReporting\": true}}, \"Name\": \"EnableFFTelemetryShield\", \"Criteria\":
2024-07-01 13:23:38 UTC	1369	IN	Data Raw: 4d 69 63 72 6f 73 6f 66 74 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 5c 5c 5c 41 70 70 20 50 61 74 68 73 5c 5c 5c 5c 63 68 72 6f 6d 65 2e 65 78 65 5c 22 2c 20 5c 22 43 6f 6d 70 61 72 69 73 69 6f 6e 5c 22 3a 20 5c 22 45 78 69 73 74 73 5c 22 7d 5d 2c 20 5c 22 4f 75 72 53 65 61 72 63 68 5c 22 3a 20 5b 7b 5c 22 42 72 6f 77 73 65 72 5c 22 3a 20 5c 22 43 68 72 6f 6d 65 5c 22 2c 20 5c 22 43 6f 6d 70 61 72 69 73 69 6f 6e 5c 22 3a 20 5c 22 4e 45 51 5c 22 2c 20 5c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 73 5c 22 3a 20 5b 5c 22 59 61 68 6f 6f 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 42 69 6e 67 20 44 65 66 61 75 6c 74 5c 22 2c 20 5c 22 42 69 6e 67 20 44 65 66 61 75 6c 74 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 44 65 66 61 Data Ascii: Microsoft\\\\Windows\\\\CurrentVersion\\\\App Paths\\\\chrome.exe\", \"Comparision\": \"Exists\"}], \"OurSearch\": [{\"Browser\": \"Chrome\", \"Comparision\": \"NEQ\", \"SearchEngines\": [\"Yahoo Search\", \"Bing Default\", \"Bing Default Search\", \"Defa
2024-07-01 13:23:38 UTC	1369	IN	Data Raw: 20 5c 22 38 5c 22 2c 20 5c 22 43 6f 6d 70 61 72 69 73 69 6f 6e 5c 22 3a 20 5c 22 47 54 45 51 5c 22 7d 7d 7d 5d 2c 20 5c 22 46 65 61 74 75 72 65 5c 22 3a 20 5c 22 53 65 61 72 63 68 53 65 74 5c 22 2c 20 5c 22 54 72 69 67 67 65 72 5c 22 3a 20 5c 22 6d 69 6e 69 6d 69 7a 65 5c 22 2c 20 5c 22 54 65 6d 70 6c 61 74 65 5c 22 3a 20 5c 22 54 72 61 79 47 72 65 65 6e 5c 22 7d 22 2c 22 74 61 72 67 65 74 49 64 22 3a 31 32 32 31 7d 2c 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 49 63 6f 6e 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 5c 22 2c 20 5c 22 41 Data Ascii: \"8\", \"Comparision\": \"GTEQ\"}}}], \"Feature\": \"SearchSet\", \"Trigger\": \"minimize\", \"Template\": \"TrayGreen\"}","targetId":1221},{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"A
2024-07-01 13:23:38 UTC	546	IN	Data Raw: 62 65 72 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 59 61 68 6f 6f 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 59 61 6e 64 65 78 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 50 6f 73 68 75 6b 61 63 68 20 45 6e 67 69 6e 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 4d 61 69 6c 2e 72 75 5c 22 2c 20 5c 22 47 6f 47 6f 20 54 65 63 68 20 53 65 61 72 63 68 5c 22 5d 7d 5d 22 2c 22 74 61 72 67 65 74 49 64 22 3a 36 32 35 7d 2c 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 57 46 41 49 22 2c 22 63 6f 64 65 22 3a 22 57 43 50 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 20 5c 22 33 2e 30 2e 32 2e 31 32 5c 22 2c 20 5c 22 46 69 6c 65 50 61 74 68 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 72 74 2e 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f Data Ascii: ber Search\", \"Yahoo Search\", \"Yandex Search\", \"Poshukach Engin Search\", \"Mail.ru\", \"GoGo Tech Search\"]}]","targetId":625},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.22	49234	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:39 UTC	154	OUT	POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 548
2024-07-01 13:23:39 UTC	548	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 44 61 69 6c 79 52 75 6e 22 2c 22 46 65 61 74 75 72 65 22 3a 22 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 22 2c 22 41 63 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 53 74 61 74 75 73 22 3a 22 53 74 61 72 74 22 2c 22 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 54 65 6d 70 6c 61 74 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 55 49 22 3a 6e 75 6c 6c 2c 22 55 73 65 72 49 6e 70 75 74 22 3a 6e 75 6c 6c 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 6e 75 6c 6c 2c 22 45 78 74 65 6e 73 69 6f 6e 49 64 22 3a 6e 75 6c 6c 2c 22 43 72 69 74 65 72 69 61 22 3a 6e 75 6c 6c 2c 22 49 6e 73 74 61 6c 6c 44 61 Data Ascii: {"Data": {"Trigger":"DailyRun","Feature":"TelemetryShield","Action":null,"Status":"Start","Message":null,"OfferTemplate":null,"OfferName":null,"OfferMessage":null,"UI":null,"UserInput":null,"SearchEngine":null,"ExtensionId":null,"Criteria":null,"InstallDa
2024-07-01 13:23:39 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:39 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b63b58258cba-EWR
2024-07-01 13:23:39 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.22	49235	104.18.27.149	443	204	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:39 UTC	180	OUT	POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 7931 Connection: Keep-Alive
2024-07-01 13:23:39 UTC	7931	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 6c 61 75 6e 63 68 22 2c 22 4e 61 6d 65 22 3a 22 47 65 74 46 65 61 74 75 72 65 73 22 2c 22 52 65 71 75 65 73 74 22 3a 22 7b 5c 22 47 65 6f 5c 22 3a 5c 22 55 53 5c 22 2c 5c 22 50 61 72 74 6e 65 72 5c 22 3a 5c 22 49 4e 32 34 30 34 30 32 5c 22 2c 5c 22 43 61 6d 70 61 69 67 6e 5c 22 3a 5c 22 32 30 35 34 31 36 31 39 31 33 31 5c 22 2c 5c 22 49 6e 73 74 61 6c 6c 44 61 74 65 5c 22 3a 5c 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 5c 22 2c 5c 22 54 72 69 67 67 65 72 54 79 70 65 5c 22 3a 5c 22 6c 61 75 6e 63 68 5c 22 2c 5c 22 54 72 69 67 67 65 72 45 76 65 6e 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 5c 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 5c 22 2c 5c 22 Data Ascii: {"Data": {"Trigger":"launch","Name":"GetFeatures","Request":"{\"Geo\":\"US\",\"Partner\":\"IN240402\",\"Campaign\":\"20541619131\",\"InstallDate\":\"2024-07-01T13:23:12\",\"TriggerType\":\"launch\",\"TriggerEvent\":\"app\",\"Version\":\"13.900.0.1080\",\"
2024-07-01 13:23:39 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:39 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b63c7a480f8f-EWR
2024-07-01 13:23:39 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.22	49236	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:40 UTC	154	OUT	POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 963
2024-07-01 13:23:40 UTC	963	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 44 61 69 6c 79 52 75 6e 22 2c 22 46 65 61 74 75 72 65 22 3a 22 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 22 2c 22 41 63 74 69 6f 6e 22 3a 22 45 6e 61 62 6c 65 46 46 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 22 2c 22 53 74 61 74 75 73 22 3a 22 45 6c 69 67 69 62 6c 65 22 2c 22 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 54 65 6d 70 6c 61 74 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 55 49 22 3a 6e 75 6c 6c 2c 22 55 73 65 72 49 6e 70 75 74 22 3a 6e 75 6c 6c 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 6e 75 6c 6c 2c 22 45 78 74 65 6e 73 69 6f 6e 49 64 22 3a 6e 75 6c 6c 2c 22 43 Data Ascii: {"Data": {"Trigger":"DailyRun","Feature":"TelemetryShield","Action":"EnableFFTelemetryShield","Status":"Eligible","Message":null,"OfferTemplate":null,"OfferName":null,"OfferMessage":null,"UI":null,"UserInput":null,"SearchEngine":null,"ExtensionId":null,"C
2024-07-01 13:23:40 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:40 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b6400fefc425-EWR
2024-07-01 13:23:40 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.22	49237	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:41 UTC	154	OUT	POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 565
2024-07-01 13:23:41 UTC	565	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 44 61 69 6c 79 52 75 6e 22 2c 22 46 65 61 74 75 72 65 22 3a 22 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 22 2c 22 41 63 74 69 6f 6e 22 3a 22 45 6e 61 62 6c 65 46 46 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 22 2c 22 53 74 61 74 75 73 22 3a 22 50 65 72 66 6f 72 6d 22 2c 22 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 54 65 6d 70 6c 61 74 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4e 61 6d 65 22 3a 22 22 2c 22 4f 66 66 65 72 4d 65 73 73 61 67 65 22 3a 22 22 2c 22 55 49 22 3a 22 53 69 6c 65 6e 74 22 2c 22 55 73 65 72 49 6e 70 75 74 22 3a 22 22 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 22 22 2c 22 45 78 74 65 6e 73 69 6f 6e 49 64 22 3a 22 22 2c 22 43 72 69 74 65 72 69 61 Data Ascii: {"Data": {"Trigger":"DailyRun","Feature":"TelemetryShield","Action":"EnableFFTelemetryShield","Status":"Perform","Message":null,"OfferTemplate":null,"OfferName":"","OfferMessage":"","UI":"Silent","UserInput":"","SearchEngine":"","ExtensionId":"","Criteria
2024-07-01 13:23:41 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:41 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b6461dae8cda-EWR
2024-07-01 13:23:41 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.22	49238	104.16.148.130	443	204	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:41 UTC	118	OUT	POST /api/Update/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 479
2024-07-01 13:23:41 UTC	479	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 35 34 31 36 31 39 31 33 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 75 70 64 61 74 65 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 61 70 70 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 45 6e 67 69 6e 65 49 64 22 3a 6e 75 6c 6c 2c 22 54 65 6d 70 6c 61 74 65 49 64 22 3a 6e 75 6c 6c 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 63 73 73 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 73 6c 22 3a 74 72 75 65 2c 22 Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20541619131","InstallDate":"2024-07-01T13:23:12","TriggerType":"update","TriggerEvent":"app","Version":"13.900.0.1080","EngineId":null,"TemplateId":null,"featureal":true,"featuremtcss":true,"featuremtsl":true,"
2024-07-01 13:23:41 UTC	412	IN	HTTP/1.1 204 No Content Date: Mon, 01 Jul 2024 13:23:41 GMT Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b6474a684375-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.22	49239	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:41 UTC	154	OUT	POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 551
2024-07-01 13:23:41 UTC	551	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 44 61 69 6c 79 52 75 6e 22 2c 22 46 65 61 74 75 72 65 22 3a 22 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 22 2c 22 41 63 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 53 74 61 74 75 73 22 3a 22 43 6f 6d 70 6c 65 74 65 22 2c 22 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 54 65 6d 70 6c 61 74 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 55 49 22 3a 6e 75 6c 6c 2c 22 55 73 65 72 49 6e 70 75 74 22 3a 6e 75 6c 6c 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 6e 75 6c 6c 2c 22 45 78 74 65 6e 73 69 6f 6e 49 64 22 3a 6e 75 6c 6c 2c 22 43 72 69 74 65 72 69 61 22 3a 6e 75 6c 6c 2c 22 49 6e 73 74 61 6c Data Ascii: {"Data": {"Trigger":"DailyRun","Feature":"TelemetryShield","Action":null,"Status":"Complete","Message":null,"OfferTemplate":null,"OfferName":null,"OfferMessage":null,"UI":null,"UserInput":null,"SearchEngine":null,"ExtensionId":null,"Criteria":null,"Instal
2024-07-01 13:23:41 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:41 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b64a780641e3-EWR
2024-07-01 13:23:41 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.22	49240	104.18.27.149	443	204	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:41 UTC	156	OUT	POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 1020
2024-07-01 13:23:41 UTC	1020	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 75 70 64 61 74 65 22 2c 22 4e 61 6d 65 22 3a 22 43 68 65 63 6b 55 70 64 61 74 65 22 2c 22 52 65 71 75 65 73 74 22 3a 22 7b 5c 22 47 65 6f 5c 22 3a 5c 22 55 53 5c 22 2c 5c 22 50 61 72 74 6e 65 72 5c 22 3a 5c 22 49 4e 32 34 30 34 30 32 5c 22 2c 5c 22 43 61 6d 70 61 69 67 6e 5c 22 3a 5c 22 32 30 35 34 31 36 31 39 31 33 31 5c 22 2c 5c 22 49 6e 73 74 61 6c 6c 44 61 74 65 5c 22 3a 5c 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 5c 22 2c 5c 22 54 72 69 67 67 65 72 54 79 70 65 5c 22 3a 5c 22 75 70 64 61 74 65 5c 22 2c 5c 22 54 72 69 67 67 65 72 45 76 65 6e 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 5c 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 5c 22 2c 5c 22 Data Ascii: {"Data": {"Trigger":"update","Name":"CheckUpdate","Request":"{\"Geo\":\"US\",\"Partner\":\"IN240402\",\"Campaign\":\"20541619131\",\"InstallDate\":\"2024-07-01T13:23:12\",\"TriggerType\":\"update\",\"TriggerEvent\":\"app\",\"Version\":\"13.900.0.1080\",\"
2024-07-01 13:23:42 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:42 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b64bcb364251-EWR
2024-07-01 13:23:42 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.22	49241	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:42 UTC	154	OUT	POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 542
2024-07-01 13:23:42 UTC	542	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 44 61 69 6c 79 52 75 6e 22 2c 22 46 65 61 74 75 72 65 22 3a 22 53 65 61 72 63 68 53 65 74 22 2c 22 41 63 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 53 74 61 74 75 73 22 3a 22 53 74 61 72 74 22 2c 22 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 54 65 6d 70 6c 61 74 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 55 49 22 3a 6e 75 6c 6c 2c 22 55 73 65 72 49 6e 70 75 74 22 3a 6e 75 6c 6c 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 6e 75 6c 6c 2c 22 45 78 74 65 6e 73 69 6f 6e 49 64 22 3a 6e 75 6c 6c 2c 22 43 72 69 74 65 72 69 61 22 3a 6e 75 6c 6c 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 Data Ascii: {"Data": {"Trigger":"DailyRun","Feature":"SearchSet","Action":null,"Status":"Start","Message":null,"OfferTemplate":null,"OfferName":null,"OfferMessage":null,"UI":null,"UserInput":null,"SearchEngine":null,"ExtensionId":null,"Criteria":null,"InstallDate":"2
2024-07-01 13:23:42 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:42 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b64ede990cc2-EWR
2024-07-01 13:23:42 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.22	49242	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:43 UTC	155	OUT	POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 1369
2024-07-01 13:23:43 UTC	1369	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 44 61 69 6c 79 52 75 6e 22 2c 22 46 65 61 74 75 72 65 22 3a 22 53 65 61 72 63 68 53 65 74 22 2c 22 41 63 74 69 6f 6e 22 3a 22 45 6e 61 62 6c 65 53 65 61 72 63 68 53 65 74 43 68 72 6f 6d 65 22 2c 22 53 74 61 74 75 73 22 3a 22 4e 6f 74 45 6c 69 67 69 62 6c 65 22 2c 22 4d 65 73 73 61 67 65 22 3a 22 49 6e 73 74 61 6c 6c 41 67 65 20 66 61 69 6c 65 64 22 2c 22 4f 66 66 65 72 54 65 6d 70 6c 61 74 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 55 49 22 3a 6e 75 6c 6c 2c 22 55 73 65 72 49 6e 70 75 74 22 3a 6e 75 6c 6c 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 6e 75 6c 6c 2c 22 45 78 74 65 6e 73 69 6f 6e 49 Data Ascii: {"Data": {"Trigger":"DailyRun","Feature":"SearchSet","Action":"EnableSearchSetChrome","Status":"NotEligible","Message":"InstallAge failed","OfferTemplate":null,"OfferName":null,"OfferMessage":null,"UI":null,"UserInput":null,"SearchEngine":null,"ExtensionI
2024-07-01 13:23:43 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:43 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b6550e3943dd-EWR
2024-07-01 13:23:43 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.22	49243	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:44 UTC	155	OUT	POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 1355
2024-07-01 13:23:44 UTC	1355	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 44 61 69 6c 79 52 75 6e 22 2c 22 46 65 61 74 75 72 65 22 3a 22 53 65 61 72 63 68 53 65 74 22 2c 22 41 63 74 69 6f 6e 22 3a 22 45 6e 61 62 6c 65 53 65 61 72 63 68 53 65 74 46 69 72 65 66 6f 78 22 2c 22 53 74 61 74 75 73 22 3a 22 4e 6f 74 45 6c 69 67 69 62 6c 65 22 2c 22 4d 65 73 73 61 67 65 22 3a 22 49 6e 73 74 61 6c 6c 41 67 65 20 66 61 69 6c 65 64 22 2c 22 4f 66 66 65 72 54 65 6d 70 6c 61 74 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 55 49 22 3a 6e 75 6c 6c 2c 22 55 73 65 72 49 6e 70 75 74 22 3a 6e 75 6c 6c 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 6e 75 6c 6c 2c 22 45 78 74 65 6e 73 69 6f 6e Data Ascii: {"Data": {"Trigger":"DailyRun","Feature":"SearchSet","Action":"EnableSearchSetFirefox","Status":"NotEligible","Message":"InstallAge failed","OfferTemplate":null,"OfferName":null,"OfferMessage":null,"UI":null,"UserInput":null,"SearchEngine":null,"Extension
2024-07-01 13:23:44 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:44 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b65a39c1c477-EWR
2024-07-01 13:23:44 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.22	49244	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:44 UTC	154	OUT	POST /v1/event-stat?Type=FeatureActionInfo&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 545
2024-07-01 13:23:44 UTC	545	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 44 61 69 6c 79 52 75 6e 22 2c 22 46 65 61 74 75 72 65 22 3a 22 53 65 61 72 63 68 53 65 74 22 2c 22 41 63 74 69 6f 6e 22 3a 6e 75 6c 6c 2c 22 53 74 61 74 75 73 22 3a 22 43 6f 6d 70 6c 65 74 65 22 2c 22 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 54 65 6d 70 6c 61 74 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 4f 66 66 65 72 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 55 49 22 3a 6e 75 6c 6c 2c 22 55 73 65 72 49 6e 70 75 74 22 3a 6e 75 6c 6c 2c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 22 3a 6e 75 6c 6c 2c 22 45 78 74 65 6e 73 69 6f 6e 49 64 22 3a 6e 75 6c 6c 2c 22 43 72 69 74 65 72 69 61 22 3a 6e 75 6c 6c 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 Data Ascii: {"Data": {"Trigger":"DailyRun","Feature":"SearchSet","Action":null,"Status":"Complete","Message":null,"OfferTemplate":null,"OfferName":null,"OfferMessage":null,"UI":null,"UserInput":null,"SearchEngine":null,"ExtensionId":null,"Criteria":null,"InstallDate"
2024-07-01 13:23:45 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:45 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b65e8a76186d-EWR
2024-07-01 13:23:45 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.22	49245	104.18.26.149	443	1304	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:23:51 UTC	143	OUT	POST /v1/event-stat?Type=UIOpen&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 342
2024-07-01 13:23:51 UTC	342	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 53 65 73 73 69 6f 6e 22 3a 31 2c 22 54 72 69 67 67 65 72 22 3a 22 55 73 65 72 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 30 31 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 Data Ascii: {"Data": {"Session":1,"Trigger":"User","InstallDate":"2024-07-01T00:00:00","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Language":"en-US","MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","OsVersion":"Microsoft Windows 7 Professional Service Pack
2024-07-01 13:23:51 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:23:51 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b68688ff8ce2-EWR
2024-07-01 13:23:51 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:23:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.22	49246	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:22 UTC	176	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 540 Connection: Keep-Alive
2024-07-01 13:25:22 UTC	540	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:25:23 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:23 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8c2895b4289-EWR
2024-07-01 13:25:23 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.22	49247	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:23 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 623
2024-07-01 13:25:23 UTC	623	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:25:23 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:23 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8c68e5742c2-EWR
2024-07-01 13:25:23 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.22	49248	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:24 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 540
2024-07-01 13:25:24 UTC	540	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:25:24 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:24 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8cb0ead4319-EWR
2024-07-01 13:25:24 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.22	49249	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:24 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 497
2024-07-01 13:25:24 UTC	497	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:25:25 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:25 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8cf5fac8ccc-EWR
2024-07-01 13:25:25 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.22	49250	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:25 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 540
2024-07-01 13:25:25 UTC	540	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:25:26 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:25 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8d4f8018c9c-EWR
2024-07-01 13:25:26 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.22	49251	104.16.148.130	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:26 UTC	143	OUT	POST /api/feature/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 485 Connection: Keep-Alive
2024-07-01 13:25:26 UTC	485	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 35 34 31 36 31 39 31 33 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 61 66 74 65 72 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 61 70 70 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 45 6e 67 69 6e 65 49 64 22 3a 6e 75 6c 6c 2c 22 54 65 6d 70 6c 61 74 65 49 64 22 3a 6e 75 6c 6c 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 63 73 73 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 73 6c 22 3a Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20541619131","InstallDate":"2024-07-01T13:23:12","TriggerType":"afterinstall","TriggerEvent":"app","Version":"13.900.0.1080","EngineId":null,"TemplateId":null,"featureal":true,"featuremtcss":true,"featuremtsl":
2024-07-01 13:25:26 UTC	473	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:26 GMT Content-Type: application/json; charset=utf-8 Content-Length: 2278 Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8d878231916-EWR
2024-07-01 13:25:26 UTC	896	IN	Data Raw: 5b 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 4d 54 46 47 22 2c 22 63 6f 64 65 22 3a 22 4d 54 54 50 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 54 79 70 65 5c 22 3a 20 5c 22 4e 6f 6e 55 49 5c 22 2c 20 5c 22 52 65 73 65 74 5c 22 3a 20 5c 22 31 38 30 5c 22 2c 20 5c 22 41 63 74 69 6f 6e 73 5c 22 3a 20 5b 7b 5c 22 44 61 74 61 5c 22 3a 20 7b 5c 22 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 5c 22 3a 20 7b 5c 22 45 6e 61 62 6c 65 4d 61 6e 61 67 65 41 50 49 5c 22 3a 20 66 61 6c 73 65 2c 20 5c 22 44 69 73 61 62 6c 65 52 65 70 6f 72 74 69 6e 67 5c 22 3a 20 74 72 75 65 7d 7d 2c 20 5c 22 4e 61 6d 65 5c 22 3a 20 5c 22 45 6e 61 62 6c 65 46 46 54 65 6c 65 6d 65 74 72 79 53 68 69 65 6c 64 5c 22 2c 20 5c 22 43 72 69 74 65 72 69 61 5c 22 3a 20 Data Ascii: [{"sectionCode":"MTFG","code":"MTTP","configuration":"{\"Type\": \"NonUI\", \"Reset\": \"180\", \"Actions\": [{\"Data\": {\"TelemetryShield\": {\"EnableManageAPI\": false, \"DisableReporting\": true}}, \"Name\": \"EnableFFTelemetryShield\", \"Criteria\":
2024-07-01 13:25:26 UTC	1369	IN	Data Raw: 74 56 65 72 73 69 6f 6e 5c 22 3a 20 5c 22 39 2e 33 2e 30 5c 22 7d 22 2c 22 74 61 72 67 65 74 49 64 22 3a 33 30 31 7d 2c 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 6e 75 6c 6c 2c 22 63 6f 64 65 22 3a 22 4f 53 4c 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 5b 7b 5c 22 42 72 6f 77 73 65 72 5c 22 3a 20 5c 22 46 69 72 65 66 6f 78 5c 22 2c 20 5c 22 53 65 61 72 63 68 45 6e 67 69 6e 65 73 5c 22 3a 20 5b 5c 22 4d 79 20 42 69 6e 67 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 44 65 66 61 75 6c 74 20 53 65 61 72 63 68 20 45 6e 67 69 6e 65 5c 22 2c 20 5c 22 53 65 63 75 72 65 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 50 72 69 76 61 74 65 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 4d 79 20 46 69 72 65 66 6f 78 20 53 65 61 72 63 68 5c 22 2c 20 5c 22 53 65 61 72 63 68 Data Ascii: tVersion\": \"9.3.0\"}","targetId":301},{"sectionCode":null,"code":"OSL","configuration":"[{\"Browser\": \"Firefox\", \"SearchEngines\": [\"My Bing Search\", \"Default Search Engine\", \"Secure Search\", \"Private Search\", \"My Firefox Search\", \"Search
2024-07-01 13:25:26 UTC	13	IN	Data Raw: 72 67 65 74 49 64 22 3a 32 34 31 7d 5d Data Ascii: rgetId":241}]

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.22	49252	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:26 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 621
2024-07-01 13:25:26 UTC	621	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:25:26 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:26 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8d97b254414-EWR
2024-07-01 13:25:26 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.22	49253	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:27 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 540
2024-07-01 13:25:27 UTC	540	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:25:27 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:27 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8de9c77c466-EWR
2024-07-01 13:25:27 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.22	49254	104.18.27.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:27 UTC	180	OUT	POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 4705 Connection: Keep-Alive
2024-07-01 13:25:27 UTC	4705	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 61 66 74 65 72 69 6e 73 74 61 6c 6c 22 2c 22 4e 61 6d 65 22 3a 22 47 65 74 46 65 61 74 75 72 65 73 22 2c 22 52 65 71 75 65 73 74 22 3a 22 7b 5c 22 47 65 6f 5c 22 3a 5c 22 55 53 5c 22 2c 5c 22 50 61 72 74 6e 65 72 5c 22 3a 5c 22 49 4e 32 34 30 34 30 32 5c 22 2c 5c 22 43 61 6d 70 61 69 67 6e 5c 22 3a 5c 22 32 30 35 34 31 36 31 39 31 33 31 5c 22 2c 5c 22 49 6e 73 74 61 6c 6c 44 61 74 65 5c 22 3a 5c 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 5c 22 2c 5c 22 54 72 69 67 67 65 72 54 79 70 65 5c 22 3a 5c 22 61 66 74 65 72 69 6e 73 74 61 6c 6c 5c 22 2c 5c 22 54 72 69 67 67 65 72 45 76 65 6e 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 5c 22 31 33 2e 39 30 30 Data Ascii: {"Data": {"Trigger":"afterinstall","Name":"GetFeatures","Request":"{\"Geo\":\"US\",\"Partner\":\"IN240402\",\"Campaign\":\"20541619131\",\"InstallDate\":\"2024-07-01T13:23:12\",\"TriggerType\":\"afterinstall\",\"TriggerEvent\":\"app\",\"Version\":\"13.900
2024-07-01 13:25:27 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:27 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8dfa9645e7e-EWR
2024-07-01 13:25:27 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.22	49255	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:28 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 490
2024-07-01 13:25:28 UTC	490	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:25:28 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:28 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8e2fd4643ef-EWR
2024-07-01 13:25:28 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.22	49256	104.18.27.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:28 UTC	143	OUT	POST /v1/event-stat?Type=Launch&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 428
2024-07-01 13:25:28 UTC	428	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 53 74 61 72 74 54 72 69 67 67 65 72 22 3a 22 49 6e 73 74 61 6c 6c 46 69 72 73 74 52 75 6e 22 2c 22 55 73 65 72 53 74 61 74 75 73 22 3a 22 41 6e 6f 6e 79 6d 6f 75 73 22 2c 22 49 73 53 79 73 74 65 6d 22 3a 66 61 6c 73 65 2c 22 49 73 43 6f 6d 70 6f 6e 65 6e 74 42 61 73 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6d 70 6f 6e 65 6e 74 22 3a 22 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 30 31 54 30 30 3a 30 30 3a 30 30 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 4c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 55 53 22 2c 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 Data Ascii: {"Data": {"StartTrigger":"InstallFirstRun","UserStatus":"Anonymous","IsSystem":false,"IsComponentBased":false,"Component":"","InstallDate":"2024-07-01T00:00:00","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Language":"en-US","MachineId":"de4229fc-f9
2024-07-01 13:25:28 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:28 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8e53d8578db-EWR
2024-07-01 13:25:28 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.22	49262	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:28 UTC	152	OUT	POST /v1/event-stat?Type=CompleteInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 443
2024-07-01 13:25:28 UTC	443	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:25:29 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:28 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8e7cc4643e2-EWR
2024-07-01 13:25:29 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.22	49264	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:29 UTC	155	OUT	POST /v1/event-stat-wc?Type=CompleteInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 399
2024-07-01 13:25:29 UTC	399	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:25:29 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8ebda0b5e68-EWR
2024-07-01 13:25:29 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.22	49273	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:30 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 550
2024-07-01 13:25:30 UTC	550	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 Data Ascii: {"Data": { "MachineId": "de4229fc-f97f-5879-f50f-8fd339540479", "InstallId": "a88aeddf-b18a-44a3-adb5-a827b688973a", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 7 Professional Service Pack 1", "OsBit": "64", "PartnerId":
2024-07-01 13:25:30 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:30 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8effe631986-EWR
2024-07-01 13:25:30 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.22	49276	104.18.26.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:30 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 515
2024-07-01 13:25:30 UTC	515	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 64 65 34 32 32 39 66 63 2d 66 39 37 66 2d 35 38 37 39 2d 66 35 30 66 2d 38 66 64 33 33 39 35 34 30 34 37 39 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 61 38 38 61 65 64 64 66 2d 62 31 38 61 2d 34 34 61 33 2d 61 64 62 35 2d 61 38 32 37 62 36 38 38 39 37 33 61 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 65 72 76 69 63 65 20 50 61 63 6b 20 31 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 Data Ascii: {"Data": {"MachineId":"de4229fc-f97f-5879-f50f-8fd339540479","InstallId":"a88aeddf-b18a-44a3-adb5-a827b688973a","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 7 Professional Service Pack 1","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN2404
2024-07-01 13:25:31 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:31 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8f46ac90ca5-EWR
2024-07-01 13:25:31 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.22	49286	104.16.148.130	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:31 UTC	118	OUT	POST /api/Update/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 479
2024-07-01 13:25:31 UTC	479	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 35 34 31 36 31 39 31 33 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 75 70 64 61 74 65 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 61 70 70 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 45 6e 67 69 6e 65 49 64 22 3a 6e 75 6c 6c 2c 22 54 65 6d 70 6c 61 74 65 49 64 22 3a 6e 75 6c 6c 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 63 73 73 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 6d 74 73 6c 22 3a 74 72 75 65 2c 22 Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20541619131","InstallDate":"2024-07-01T13:23:12","TriggerType":"update","TriggerEvent":"app","Version":"13.900.0.1080","EngineId":null,"TemplateId":null,"featureal":true,"featuremtcss":true,"featuremtsl":true,"
2024-07-01 13:25:31 UTC	412	IN	HTTP/1.1 204 No Content Date: Mon, 01 Jul 2024 13:25:31 GMT Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8f9ab5c72a7-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.22	49293	104.18.27.149	443

Timestamp	Bytes transferred	Direction	Data
2024-07-01 13:25:32 UTC	156	OUT	POST /v1/event-stat?Type=FeatureFlagRequest&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 1020
2024-07-01 13:25:32 UTC	1020	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 54 72 69 67 67 65 72 22 3a 22 75 70 64 61 74 65 22 2c 22 4e 61 6d 65 22 3a 22 43 68 65 63 6b 55 70 64 61 74 65 22 2c 22 52 65 71 75 65 73 74 22 3a 22 7b 5c 22 47 65 6f 5c 22 3a 5c 22 55 53 5c 22 2c 5c 22 50 61 72 74 6e 65 72 5c 22 3a 5c 22 49 4e 32 34 30 34 30 32 5c 22 2c 5c 22 43 61 6d 70 61 69 67 6e 5c 22 3a 5c 22 32 30 35 34 31 36 31 39 31 33 31 5c 22 2c 5c 22 49 6e 73 74 61 6c 6c 44 61 74 65 5c 22 3a 5c 22 32 30 32 34 2d 30 37 2d 30 31 54 31 33 3a 32 33 3a 31 32 5c 22 2c 5c 22 54 72 69 67 67 65 72 54 79 70 65 5c 22 3a 5c 22 75 70 64 61 74 65 5c 22 2c 5c 22 54 72 69 67 67 65 72 45 76 65 6e 74 5c 22 3a 5c 22 61 70 70 5c 22 2c 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 5c 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 5c 22 2c 5c 22 Data Ascii: {"Data": {"Trigger":"update","Name":"CheckUpdate","Request":"{\"Geo\":\"US\",\"Partner\":\"IN240402\",\"Campaign\":\"20541619131\",\"InstallDate\":\"2024-07-01T13:23:12\",\"TriggerType\":\"update\",\"TriggerEvent\":\"app\",\"Version\":\"13.900.0.1080\",\"
2024-07-01 13:25:32 UTC	479	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 13:25:32 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89c6b8fe3ff41811-EWR
2024-07-01 13:25:32 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-07-01 13:25:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:22:13
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	545'352 bytes
MD5 hash:	A081CFF1D93F1BCC478835DCB98E7C47
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:22:13
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe
Wow64 process (32bit):	true
Commandline:	.\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20541619131 --version=13.900.0.1080
Imagebase:	0x990000
File size:	438'936 bytes
MD5 hash:	A27F9713DB1688D03D2082BFA1827803
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS053FCFED\WebCompanion-Installer.exe, Author: Joe Security
Antivirus matches:	Detection: 8%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:22:53
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
Imagebase:	0x4a940000
File size:	302'592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:22:54
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh http add urlacl url=http://+:9007/ user=Everyone
Imagebase:	0x840000
File size:	96'256 bytes
MD5 hash:	784A50A6A09C25F011C3143DDD68E729
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:23:04
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=
Imagebase:	0x1070000
File size:	3'429'528 bytes
MD5 hash:	D5180525E08932A69DD1903AB30313EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe, Author: Joe Security
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:23:22
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize
Imagebase:	0x1070000
File size:	3'429'528 bytes
MD5 hash:	D5180525E08932A69DD1903AB30313EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	09:23:31
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --minimize
Imagebase:	0x1070000
File size:	3'429'528 bytes
MD5 hash:	D5180525E08932A69DD1903AB30313EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\155oeosf.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\1eyjg5un.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\3ljphqa5.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\bu202zfu.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\cjju51tc.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\ckxtsujp.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\d2zczf42.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\ecx1uqkv.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\epvcswql.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\figgaxwc.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\fyq3btjf.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\gvivsu1u.newcfg

C:\Users\user\AppData\Local\Lavasoft\WebCompanion.exe_Url_yp2hpg3cf5eojnthoee4kcwsmwwiacqj\13.900.0.1080\hdoy2tpb.newcfg

Windows Analysis Report
Setup.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre