Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1515445
MD5:	1586cb9126c49565414bcea085b97366
SHA1:	199111eb1881f8ddb35f1858d0c85737f223c026
SHA256:	9633a7f85713f5a9e685f775860390f000013f377d9ef68e12e1c50f923c5583
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Setup.exe (PID: 6292 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 1586CB9126C49565414BCEA085B97366)

WebCompanion-Installer.exe (PID: 6488 cmdline: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=21551594541 --version=13.900.0.1080 MD5: A27F9713DB1688D03D2082BFA1827803)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.0.WebCompanion-Installer.exe.900000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.Setup.exe.21914b8.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.Setup.exe.218e8b8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.Setup.exe.218feb8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-22T19:39:06.693470+0200	2803305	3	Unknown Traffic	192.168.2.4	49732	104.16.149.130	80	TCP
2024-09-22T19:39:19.253171+0200	2803305	3	Unknown Traffic	192.168.2.4	49768	104.16.148.130	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

ReversingLabs: Detection: 20%

Multi AV Scanner detection for submitted file

Source: Setup.exe	Virustotal: Detection: 45%			Perma Link
Source: Setup.exe	ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 88.2% probability

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Jump to behavior

Source: Setup.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49767 version: TLS 1.2

Source:	Binary string: Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: &Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, WebCompanion-Installer.exe, 00000001.00000002.4181951446.00000000066C2000.00000002.00000001.01000000.00000007.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: eApplication/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F9B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F93000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F97000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F8F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: Application/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F9B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F93000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F97000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F8F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanion-Installer.pdb source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405434 FindFirstFileA,FindFirstFileW,

0_2_00405434

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.0.WebCompanion-Installer.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.21914b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.218e8b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.218feb8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe, type: DROPPED

Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 447Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 398
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 508
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 646
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 515
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 482
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 515
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 488
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 527
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 466
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 527
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 458
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 460
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 475
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 491
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 517Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 485
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 728Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 674
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com

Source: Joe Sandbox View	IP Address: 104.18.27.149 104.18.27.149
Source: Joe Sandbox View	IP Address: 104.16.149.130 104.16.149.130
Source: Joe Sandbox View	IP Address: 104.16.148.130 104.16.148.130

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49732 -> 104.16.149.130:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49768 -> 104.16.148.130:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com

Source: global traffic	DNS traffic detected: DNS query: geo.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: featureflags.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: flwadw.com
Source: global traffic	DNS traffic detected: DNS query: wcdownloadercdn.lavasoft.com

Source: unknown

HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive

Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://aia.entrust.net/evcs2-chain.p7c01
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl.entrust.net/evcs2.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl.entrust.net/g2ca.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://geo.lavasoft.com/
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://localhost:9008Fhttp://localhost:9008/webcompanion/4http://rt.webcompanion.com
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net00
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net01
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://staging-cloudflow.lavasoft.net/v1/event-stat-wc
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/$
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/:WebHttpBinding4
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetComponentsInfoByProductT
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetComponentsInfoT
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetComponentsVersionInfoT
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetProductInfoT
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreen
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValues
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValuesResponse
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/SignZipInstallerByProductT
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/SignZipInstallerT
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/T
Source: Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wc-update-service.lavasoft.com/components.asmx
Source: Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wc-update-service.lavasoft.com/update.asmx
Source: Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip
Source: Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.entrust.net/rpa0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.lavasoft.com
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.webcompanion.com
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D2C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D34000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/blacklist
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D2C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D34000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/permanentwhitelist
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acs.lavasoft.comZhttps://acs.lavasoft.com/api/v2/url/blacklistlhttps://acs.lavasoft.com/api/
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acscdn.lavasoft.com/urlnotificationlist.json
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acscdn.lavasoft.comhhttps://acscdn.lavasoft.com/urlnotificationlist.json0https://webcompanio
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WC
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WCw
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC$https://flwadw.comFhttps://flwadw.com/v1/event-stat
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flow.lavasoft.com/v1/event-stat/v1/event-stat
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flwadw.com/v1/event-stat
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flwadw.com/v1/event-stat-wc
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flwadw.com/v1/event-statJhttp://staging-cloudflow.lavasoft.netlhttp://staging-cloudflow.lava
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://partner-tracking.lavasoft.com/api/Tracking/Decrypt
Source: Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D2C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D34000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WcInstaller.log.1.dr	String found in binary or memory: https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://sandbox-featureflags-api.lavasoft.net/api/Update/WC
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox-featureflags-api.lavasoft.net/api/feature/WC
Source: Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip
Source: Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip
Source: Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe
Source: Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-internal.zip
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4184518138.000000000CFE8000.00000004.00000020.00020000.00000000.sdmp, WcInstaller.log.1.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe
Source: Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe
Source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4184518138.000000000CFE8000.00000004.00000020.00020000.00000000.sdmp, WcInstaller.log.1.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/en/help.php
Source: WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/en/install.php?partner=
Source: WcInstaller.log.1.dr	String found in binary or memory: https://webcompanion.com/images/favicon.ico
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://www.adaware.com/privacy-policy
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://www.adaware.com/terms-of-use

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49767 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00416076	0_2_00416076
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040E38E	0_2_0040E38E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00412480	0_2_00412480
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004039C8	0_2_004039C8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00418CC1	0_2_00418CC1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00418D9B	0_2_00418D9B
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_02C70DE0	1_2_02C70DE0
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_02C7F0D0	1_2_02C7F0D0
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_02C7E390	1_2_02C7E390
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05415250	1_2_05415250
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_054164A9	1_2_054164A9
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_0543E1F8	1_2_0543E1F8
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_054382A0	1_2_054382A0
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_0543BD98	1_2_0543BD98
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_0543AF70	1_2_0543AF70
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_0543EF10	1_2_0543EF10
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_0543BBC4	1_2_0543BBC4
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05437A28	1_2_05437A28
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_054382A0	1_2_054382A0
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05AA3AC0	1_2_05AA3AC0
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06227121	1_2_06227121
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_0622AA60	1_2_0622AA60
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_064D05A8	1_2_064D05A8
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06AF9E60	1_2_06AF9E60
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06AFA730	1_2_06AFA730
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06AFB1B0	1_2_06AFB1B0
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06AF546A	1_2_06AF546A
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06AF9B18	1_2_06AF9B18

Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00413724 appears 176 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00403A63 appears 33 times

Source: Setup.exe, 00000000.00000000.1701455196.0000000000427000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe
Source: Setup.exe, 00000000.00000003.1704027423.0000000002154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.1704027423.0000000002154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dll8 vs Setup.exe
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: get_OriginalFilename vs Setup.exe
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.1702127393.0000000002051000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe
Source: Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll4 vs Setup.exe
Source: Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: get_OriginalFilename vs Setup.exe
Source: Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: ICSharpCode.SharpZipLib.dll.0.dr, InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.0.dr, DeflaterOutputStream.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.0.dr, ZipAESTransform.cs	Cryptographic APIs: 'TransformBlock'

Source: classification engine

Classification label: mal48.troj.winEXE@3/17@4/3

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Roaming\Lavasoft

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe	Virustotal: Detection: 45%
Source: Setup.exe	ReversingLabs: Detection: 28%

Source: WebCompanion-Installer.exe	String found in binary or memory: WebCompanion-Installer.resources
Source: WebCompanion-Installer.exe	String found in binary or memory: WebCompanion-Installer.resources.dll
Source: Setup.exe	String found in binary or memory: RunProgram="WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=21551594541 --version=13.900.0.1080"

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=21551594541 --version=13.900.0.1080
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=21551594541 --version=13.900.0.1080	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Setup.exe

Static PE information: certificate valid

Source:	Binary string: Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: &Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, WebCompanion-Installer.exe, 00000001.00000002.4181951446.00000000066C2000.00000002.00000001.01000000.00000007.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: eApplication/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F9B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F93000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F97000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F8F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: Application/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F9B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F93000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F97000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002F8F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanion-Installer.pdb source: Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004180F0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004180F0

Source: Setup.exe	Static PE information: real checksum: 0x93527 should be: 0x8cd7e
Source: WebCompanion-Installer.resources.dll8.0.dr	Static PE information: real checksum: 0x0 should be: 0xa6a7
Source: WebCompanion-Installer.resources.dll5.0.dr	Static PE information: real checksum: 0x0 should be: 0xc6c2
Source: WebCompanion-Installer.resources.dll1.0.dr	Static PE information: real checksum: 0x0 should be: 0x3e3f
Source: WebCompanion-Installer.resources.dll7.0.dr	Static PE information: real checksum: 0x0 should be: 0xcb69
Source: WebCompanion-Installer.resources.dll2.0.dr	Static PE information: real checksum: 0x0 should be: 0x4885
Source: WebCompanion-Installer.resources.dll4.0.dr	Static PE information: real checksum: 0x0 should be: 0x5659
Source: WebCompanion-Installer.resources.dll6.0.dr	Static PE information: real checksum: 0x0 should be: 0xd8a3
Source: WebCompanion-Installer.resources.dll0.0.dr	Static PE information: real checksum: 0x0 should be: 0xe72f
Source: WebCompanion-Installer.resources.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x2ab0
Source: WebCompanion-Installer.resources.dll3.0.dr	Static PE information: real checksum: 0x0 should be: 0x842b

Source: Setup.exe

Static PE information: section name: .sxdata

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00411130 push ecx; mov dword ptr [esp], ecx	0_2_00411131
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00413724 push eax; ret	0_2_00413742
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00413A90 push eax; ret	0_2_00413ABE
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_079B2050 push ss; retf	1_2_079B2073
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05AADD0E push es; ret	1_2_05AADD10
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05AADD60 push es; ret	1_2_05AADD70
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05AADD4E push es; ret	1_2_05AADD50
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05AADCA0 push es; ret	1_2_05AADC70
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05AADCA0 push es; ret	1_2_05AADCD0
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05AADC8E push es; ret	1_2_05AADC90
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05AADCEE push es; ret	1_2_05AADCF0
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05AADC6E push es; ret	1_2_05AADC70
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_05AACA5E push es; iretd	1_2_05AACA60
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06224A20 push es; ret	1_2_06224A30
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_062289B1 push es; ret	1_2_062289C0
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06AFF66A push esp; retf	1_2_06AFF679
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06AFC77E push es; ret	1_2_06AFC780
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06AFFB4D pushfd ; iretd	1_2_06AFFB51
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06AFF1A2 pushfd ; iretd	1_2_06AFF1D1
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Code function: 1_2_06AFF192 pushad ; iretd	1_2_06AFF1A1

Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS498BA48F\ICSharpCode.SharpZipLib.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597850	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597659	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597534	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595655	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595105	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 594907	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 594453	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Window / User API: threadDelayed 1460			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Window / User API: threadDelayed 8385			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS498BA48F\ICSharpCode.SharpZipLib.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -598625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -598515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -598297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -597968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -597850s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -597659s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -597534s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -596969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -596750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -596641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -596422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -596094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -595875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -595765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -595655s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -595547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -595105s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -594907s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe TID: 1228	Thread sleep time: -594453s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405434 FindFirstFileA,FindFirstFileW,

0_2_00405434

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597850	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597659	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597534	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595655	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 595105	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 594907	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Thread delayed: delay time: 594453	Jump to behavior

Source: WebCompanion-Installer.exe.0.dr	Binary or memory string: vmware
Source: WebCompanion-Installer.exe, 00000001.00000002.4176791635.0000000000ECC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@

Source: C:\Users\user\Desktop\Setup.exe

API call chain: ExitProcess graph end node

graph_0-16392

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004180F0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004180F0

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0041561A SetUnhandledExceptionFilter,		0_2_0041561A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0041562C SetUnhandledExceptionFilter,		0_2_0041562C

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS498BA48F\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS498BA48F\en-US\WebCompanion-Installer.resources.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXmlLinq.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS498BA48F\ICSharpCode.SharpZipLib.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004148D4 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

0_2_004148D4

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	46%	Virustotal		Browse
Setup.exe	29%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\7zS498BA48F\ICSharpCode.SharpZipLib.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\ICSharpCode.SharpZipLib.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\7zS498BA48F\Newtonsoft.Json.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe	21%	ReversingLabs	Win32.PUA.Generic
C:\Users\user\AppData\Local\Temp\7zS498BA48F\de-DE\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\en-US\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\es-ES\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\fr-CA\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\it-IT\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\ja-JP\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\pt-BR\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\ru-RU\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\tr-TR\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS498BA48F\zh-CHS\WebCompanion-Installer.resources.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
geo.lavasoft.com	0%	Virustotal	Browse
wcdownloadercdn.lavasoft.com	1%	Virustotal	Browse
featureflags.lavasoft.com	0%	Virustotal	Browse
flwadw.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe	0%	Avira URL Cloud	safe
https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe	0%	Avira URL Cloud	safe
http://tempuri.org/GetComponentsVersionInfoT	0%	Avira URL Cloud	safe
http://crl.entrust.net/g2ca.crl0	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
https://featureflags.lavasoft.com/api/feature/WC	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat-wc	0%	Avira URL Cloud	safe
http://crl.entrust.net/g2ca.crl0	0%	Virustotal		Browse
https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1	0%	Virustotal		Browse
http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValuesResponse	0%	Avira URL Cloud	safe
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe	0%	Virustotal		Browse
http://ocsp.entrust.net01	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValuesResponse	1%	Virustotal		Browse
https://featureflags.lavasoft.com/api/Update/WC	0%	Avira URL Cloud	safe
https://featureflags.lavasoft.com/api/feature/WC	0%	Virustotal		Browse
https://flwadw.com/v1/event-stat-wc	0%	Virustotal		Browse
http://ocsp.entrust.net00	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat	0%	Avira URL Cloud	safe
https://acs.lavasoft.com/api/v2/url/permanentwhitelist	0%	Avira URL Cloud	safe
https://featureflags.lavasoft.com/api/Update/WC	0%	Virustotal		Browse
https://www.adaware.com/privacy-policy	0%	Avira URL Cloud	safe
http://tempuri.org/GetComponentsVersionInfoT	3%	Virustotal		Browse
http://tempuri.org/	0%	Avira URL Cloud	safe
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
https://www.adaware.com/privacy-policy	0%	Virustotal		Browse
https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe	0%	Virustotal		Browse
https://flwadw.com/v1/event-stat	0%	Virustotal		Browse
http://tempuri.org/:WebHttpBinding4	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Virustotal		Browse
https://webcompanion.com/images/favicon.ico	0%	Avira URL Cloud	safe
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip	0%	Virustotal		Browse
http://www.webcompanion.com	0%	Avira URL Cloud	safe
https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip	0%	Avira URL Cloud	safe
https://acs.lavasoft.com/api/v2/url/permanentwhitelist	0%	Virustotal		Browse
http://tempuri.org/:WebHttpBinding4	1%	Virustotal		Browse
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse	0%	Avira URL Cloud	safe
http://crl.entrust.net/csbr1.crl0	0%	Avira URL Cloud	safe
https://webcompanion.com/images/favicon.ico	2%	Virustotal		Browse
https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip	2%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	0%	Avira URL Cloud	safe
https://sandbox-featureflags-api.lavasoft.net/api/feature/WC	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValues	0%	Avira URL Cloud	safe
http://www.webcompanion.com	3%	Virustotal		Browse
http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse	1%	Virustotal		Browse
http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValues	1%	Virustotal		Browse
http://crl.entrust.net/csbr1.crl0	0%	Virustotal		Browse
http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www	2%	Virustotal		Browse
https://featureflags.lavasoft.com/api/feature/WC$https://flwadw.comFhttps://flwadw.com/v1/event-stat	0%	Avira URL Cloud	safe
https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip	0%	Avira URL Cloud	safe
https://sandbox-featureflags-api.lavasoft.net/api/feature/WC	0%	Virustotal		Browse
https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip	0%	Virustotal		Browse
http://aia.entrust.net/evcs2-chain.p7c01	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating	0%	Avira URL Cloud	safe
http://www.entrust.net/rpa0	0%	Avira URL Cloud	safe
https://acscdn.lavasoft.com/urlnotificationlist.json	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	0%	Virustotal		Browse
https://featureflags.lavasoft.com/api/feature/WC$https://flwadw.comFhttps://flwadw.com/v1/event-stat	0%	Virustotal		Browse
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-internal.zip	0%	Avira URL Cloud	safe
http://aia.entrust.net/evcs2-chain.p7c01	0%	Virustotal		Browse
http://tempuri.org/GetProductInfoT	0%	Avira URL Cloud	safe
http://tempuri.org/$	0%	Avira URL Cloud	safe
https://webcompanion.com/en/install.php?partner=	0%	Avira URL Cloud	safe
https://acscdn.lavasoft.com/urlnotificationlist.json	0%	Virustotal		Browse
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-internal.zip	0%	Virustotal		Browse
https://webcompanion.com/en/help.php	0%	Avira URL Cloud	safe
http://tempuri.org/GetProductInfoT	2%	Virustotal		Browse
http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip	0%	Avira URL Cloud	safe
http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating	1%	Virustotal		Browse
https://www.adaware.com/terms-of-use	0%	Avira URL Cloud	safe
http://www.entrust.net/rpa0	0%	Virustotal		Browse
https://webcompanion.com/en/install.php?partner=	1%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	Avira URL Cloud	safe
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreen	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-statJhttp://staging-cloudflow.lavasoft.netlhttp://staging-cloudflow.lava	0%	Avira URL Cloud	safe
https://flow.lavasoft.com/v1/event-stat/v1/event-stat	0%	Avira URL Cloud	safe
https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip	0%	Avira URL Cloud	safe
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe	0%	Avira URL Cloud	safe
https://partner-tracking.lavasoft.com/api/Tracking/Decrypt	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat?Type=Start&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
http://geo.lavasoft.com/	0%	Avira URL Cloud	safe
https://flwadw.com	0%	Avira URL Cloud	safe
https://acs.lavasoft.comZhttps://acs.lavasoft.com/api/v2/url/blacklistlhttps://acs.lavasoft.com/api/	0%	Avira URL Cloud	safe
https://flwadw.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1	0%	Avira URL Cloud	safe
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe	0%	Avira URL Cloud	safe
http://localhost:9008Fhttp://localhost:9008/webcompanion/4http://rt.webcompanion.com	0%	Avira URL Cloud	safe
http://staging-cloudflow.lavasoft.net/v1/event-stat-wc	0%	Avira URL Cloud	safe
http://james.newtonking.com/projects/json	0%	Avira URL Cloud	safe
http://tempuri.org/GetComponentsInfoByProductT	0%	Avira URL Cloud	safe
http://www.lavasoft.com	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	Avira URL Cloud	safe
https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geo.lavasoft.com	104.16.149.130	true	false	0%, Virustotal, Browse	unknown
wcdownloadercdn.lavasoft.com	104.16.148.130	true	false	1%, Virustotal, Browse	unknown
featureflags.lavasoft.com	104.16.149.130	true	false	0%, Virustotal, Browse	unknown
flwadw.com	104.18.27.149	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://featureflags.lavasoft.com/api/feature/WC	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://featureflags.lavasoft.com/api/Update/WC	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1	false	Avira URL Cloud: safe	unknown
https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat?Type=Start&ProductID=wc&EventVersion=1	false	Avira URL Cloud: safe	unknown
http://geo.lavasoft.com/	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.entrust.net/g2ca.crl0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/GetComponentsVersionInfoT	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe	Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat-wc	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValuesResponse	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.entrust.net02	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	URL Reputation: safe	unknown
http://ocsp.entrust.net01	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net00	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-stat	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://acs.lavasoft.com/api/v2/url/permanentwhitelist	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D2C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D34000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.adaware.com/privacy-policy	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip	Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/:WebHttpBinding4	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://webcompanion.com/images/favicon.ico	WcInstaller.log.1.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.webcompanion.com	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip	Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D2C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D34000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WcInstaller.log.1.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.entrust.net/csbr1.crl0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sandbox-featureflags-api.lavasoft.net/api/feature/WC	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValues	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://featureflags.lavasoft.com/api/feature/WC$https://flwadw.comFhttps://flwadw.com/v1/event-stat	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip	Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://aia.entrust.net/evcs2-chain.p7c01	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://acscdn.lavasoft.com/urlnotificationlist.json	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.entrust.net/rpa0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-internal.zip	Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/GetProductInfoT	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/$	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://webcompanion.com/en/install.php?partner=	WebCompanion-Installer.exe.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://webcompanion.com/en/help.php	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip	Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false	Avira URL Cloud: safe	unknown
https://www.adaware.com/terms-of-use	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreen	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://flwadw.com/v1/event-statJhttp://staging-cloudflow.lavasoft.netlhttp://staging-cloudflow.lava	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	URL Reputation: safe	unknown
https://flow.lavasoft.com/v1/event-stat/v1/event-stat	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe	Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false	Avira URL Cloud: safe	unknown
https://partner-tracking.lavasoft.com/api/Tracking/Decrypt	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://flwadw.com	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://acs.lavasoft.comZhttps://acs.lavasoft.com/api/v2/url/blacklistlhttps://acs.lavasoft.com/api/	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4184518138.000000000CFE8000.00000004.00000020.00020000.00000000.sdmp, WcInstaller.log.1.dr	false	Avira URL Cloud: safe	unknown
http://localhost:9008Fhttp://localhost:9008/webcompanion/4http://rt.webcompanion.com	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://staging-cloudflow.lavasoft.net/v1/event-stat-wc	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://james.newtonking.com/projects/json	Newtonsoft.Json.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/GetComponentsInfoByProductT	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.lavasoft.com	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://acs.lavasoft.com/api/v2/url/blacklist	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D2C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D34000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://acscdn.lavasoft.comhhttps://acscdn.lavasoft.com/urlnotificationlist.json0https://webcompanio	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/T	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://featureflags.lavasoft.com/api/Update/WCw	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sandbox-featureflags-api.lavasoft.net/api/Update/WC	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://tempuri.org/SignZipInstallerByProductT	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip	Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002FB3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/evcs2.crl0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wc-update-service.lavasoft.com/update.asmx	Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wc-update-service.lavasoft.com/components.asmx	Setup.exe, 00000000.00000003.1702334669.000000000215C000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/SignZipInstallerT	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	WebCompanion-Installer.exe, 00000001.00000002.4177408181.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/GetComponentsInfoT	Setup.exe, 00000000.00000003.1704184239.0000000000470000.00000004.00001000.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1704027423.000000000218B000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1704385350.0000000000902000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.27.149	flwadw.com	United States	13335	CLOUDFLARENETUS	false
104.16.149.130	geo.lavasoft.com	United States	13335	CLOUDFLARENETUS	false
104.16.148.130	wcdownloadercdn.lavasoft.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1515445
Start date and time:	2024-09-22 19:37:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	MAL
Classification:	mal48.troj.winEXE@3/17@4/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 457 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, ocsp.entrust.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target WebCompanion-Installer.exe, PID 6488 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:39:05	API Interceptor	12017842x Sleep call for process: WebCompanion-Installer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.18.27.149	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
	APInstaller (4).exe	Get hash	malicious	Unknown	Browse
	APInstaller.exe	Get hash	malicious	Unknown	Browse
	https://download.adaware.com/nano_download.php?partner=IN221105&nonadmin&tych&campaign=20540828322	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
104.16.149.130	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	flow.lavasoft.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	flow.lavasoft.com/v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1
	SecuriteInfo.com.Program.Unwanted.2818.3154.4230.exe	Get hash	malicious	Petite Virus	Browse	flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exe	Get hash	malicious	Unknown	Browse	downloadnada.lavasoft.com/update/12.10.158.0/win32/AdAwareWebInstaller.exe
104.16.148.130	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	flow.lavasoft.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	wcdownloadercdn.lavasoft.com/9.1.0.993/WebCompanion-9.1.0.993-prod.zip
	SecuriteInfo.com.Program.Unwanted.2818.3154.4230.exe	Get hash	malicious	Petite Virus	Browse	flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exe	Get hash	malicious	Unknown	Browse	downloadnada.lavasoft.com/update/12.10.158.0/win32/AdAwareWebInstaller.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
wcdownloadercdn.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
featureflags.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
geo.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
flwadw.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.27.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.27.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PO-001.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	DoomRat.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	LOL and profile.exe	Get hash	malicious	FormBook	Browse	104.21.64.108
	Specification and Quantity Pdf.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	ADNOC REQUESTS & reviews.exe	Get hash	malicious	FormBook	Browse	104.21.64.108
	SecuriteInfo.com.BScope.TrojanPSW.Stealer.11760.26822.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	#U041f#U043b#U0430#U0449#U0430#U043d#U0435.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	SecuriteInfo.com.W64.Agent.IKW.gen.Eldorado.19678.19551.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.4.91
	Docswift004994.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
CLOUDFLARENETUS	PO-001.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	DoomRat.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	LOL and profile.exe	Get hash	malicious	FormBook	Browse	104.21.64.108
	Specification and Quantity Pdf.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	ADNOC REQUESTS & reviews.exe	Get hash	malicious	FormBook	Browse	104.21.64.108
	SecuriteInfo.com.BScope.TrojanPSW.Stealer.11760.26822.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	#U041f#U043b#U0430#U0449#U0430#U043d#U0435.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	SecuriteInfo.com.W64.Agent.IKW.gen.Eldorado.19678.19551.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.4.91
	Docswift004994.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
CLOUDFLARENETUS	PO-001.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	DoomRat.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	LOL and profile.exe	Get hash	malicious	FormBook	Browse	104.21.64.108
	Specification and Quantity Pdf.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	ADNOC REQUESTS & reviews.exe	Get hash	malicious	FormBook	Browse	104.21.64.108
	SecuriteInfo.com.BScope.TrojanPSW.Stealer.11760.26822.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	#U041f#U043b#U0430#U0449#U0430#U043d#U0435.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3
	SecuriteInfo.com.W64.Agent.IKW.gen.Eldorado.19678.19551.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	104.21.4.91
	Docswift004994.docx.doc	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	30Q82nyox2.exe	Get hash	malicious	Quasar	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	17270167872e3551983fc1704f6bae61c606ba56a091aa94c947297b10e7ebcbb66eba6dd1894.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	SecuriteInfo.com.BScope.TrojanPSW.Stealer.11760.26822.exe	Get hash	malicious	Unknown	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	P0 n.#U00b0 1037596.exe	Get hash	malicious	AgentTesla	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	Gymnasielrere84.vbs	Get hash	malicious	Unknown	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	urgent inquiry.exe	Get hash	malicious	AgentTesla	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	pic1.jpg.exe	Get hash	malicious	Unknown	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	Ziraat Bankas#U0131 Swift Mesaj#U0131.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	DHL INVOICE pfd.bat.exe	Get hash	malicious	AgentTesla	Browse	104.18.27.149 104.16.149.130 104.16.148.130

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\7zS498BA48F\Newtonsoft.Json.dll	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\7zS498BA48F\ICSharpCode.SharpZipLib.dll	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7zS498BA48F\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	213656
Entropy (8bit):	5.7590593524797615
Encrypted:	false
SSDEEP:	3072:LK1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4Q:Ge9OAQsFtJrGPBnmIRZUL
MD5:	0CFE19791546A96C6699657A94604596
SHA1:	5D1A1B74CCA9F74FFFEBCB583661C02E4CA626DD
SHA-256:	56FDFD148F0D60805B2873A5A49739909001D11789B75DAB2B0EA8E55BC60913
SHA-512:	586CC695A2C3C03008D0A1032C221CD3384B5F4363E83C9D903753FB1DAD65B340BC8CD0659F7F891A641F8BD7535C9B889219842045854AA98CD380F0FE4AA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......... ........... ........@.. .......................@......sC....@.................................d...W........................2... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS498BA48F\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	438424
Entropy (8bit):	6.09887709092106
Encrypted:	false
SSDEEP:	6144:fHerwzLkqCG3uKWf4g6tUwoOkErUx5/Rsnaszr0tZDPEaN+YB5+GonYy:fHerIacuKUtOkESbKQrvB5+qy
MD5:	461C476F474A5F13D2EA9344AE6F70F6
SHA1:	8F74702B99F08277D4514C63956E2E69E8090073
SHA-256:	4F0EC6439B24652F16DF066F4A38B64518B5A874080EDA63DE45968545830F67
SHA-512:	E69080C205CD82EA2C056FA1328BBEC4C03CA3FDC3EE381C4FB44CB356247BE5FE4B8ADD53036DCB19CAC2C6D59B8E02F81932320EA534B5BA50DB80A0647017
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.R...........!.....t............... ........... ..............................%.....@.....................................K.......8............~...2..........x................................................ ............... ..H............text....s... ...t.................. ..`.rsrc...8............v..............@..@.reloc...............\|..............@..B........................H.......h...................X...P ......................................yK.N...f....i5.#I..xV. ..%BR..^.....t0"..z.%./.G'.j....{...2...k)w...'>.c..P..X.......n...h....E...ex..X/H].R.e.{..;&.-.'....{...."..}....V.(x.....(......}....2.{....oy...2.{....oz...B..(....&..(.......0...........oo........YE....}...............}...n...............n.......I...I...I...I...3...I...X...8D....t......{.....or...o{....ow.....+U..o\|.....{.....o....oo...o}.....o....o....t.....o....o..

C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	438936
Entropy (8bit):	6.4311342686757245
Encrypted:	false
SSDEEP:	6144:p0CMChRMg/ZytotgM7/J/NMFkl619WTRIlY57pMF9v2aiSVRlY/8a:CGhGI1Wo/J1l619WQY57pMfi8a
MD5:	A27F9713DB1688D03D2082BFA1827803
SHA1:	B8DF4649659003609419D052757166499D2322E8
SHA-256:	2F86EB0D3902A11DA1F534D9734DABAE37D33E2C57B03F968198A1CFC2E652A9
SHA-512:	F952C6792F10CB60CA3ECC00B317C33AADB65C8471D106171660EC0FCB0603C8D18B8AD2A90AACDA6581D342647290099AF0ED0FDD897EDB390D5BF9209EA905
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf.....................t.......(... ...@....@.. ....................................@..................................(..K....@...q...............2..........X'............................................... ............... ..H............text........ ...................... ..`.rsrc....q...@...r..................@..@.reloc...............~..............@..B.................(......H..................{....i...9............................................~....}.....(......su...}......(....}.....r...pz.(....r'..p.{....(......(........0..j..........{....r...pov...,.(.....+.(......r...p(......(......r...p.{....o....o.......(........sG........o......z..........UU......N.(....r...p..(.....r...p.......{...."..}.....rA..p.rS..p.(....oV...f.~....}.....(......(.....ro..pN.(....r...p..(.....0..i.......~......(....(!...,.r...p.+..(.......(j.....(...+

C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe.config

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2273
Entropy (8bit):	5.064418012146103
Encrypted:	false
SSDEEP:	48:c5+qM3DzYnwAGvSy6ZYEcCUkmPlrAn6EVr6R841docr7S3tB:jV3f84CRvur+rAN3r7sz
MD5:	E3D3AA100B93504676414B9268DFBAD4
SHA1:	A7D1E59C9D8C48DFE259D2973C13B0E2965E67AA
SHA-256:	EA7747D876307B0022F055C311C4F8F8112FDDE380E0848FD35508C00EDF8E7A
SHA-512:	9470E0B4784CE3AA94248DDBD9C17BCA988B6A680754511CBE1F1C368270F6D18C75AD1EA0F3A438CA5BB1A12E55E8745F68F2EBC9F78C68B373A6541AC9EFBE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ProdSettings" type="System.Configuration.NameValueSectionHandler"/>.. <section name="StagingSettings" type="System.Configuration.NameValueSectionHandler"/>.. </configSections>.. <ProdSettings>.. <add key="Installer" value="https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe"/>.. <add key="WebProtectionZip" value="https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip"/>.. <add key="InstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip"/>.. <add key="WebInstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip"/>.. </ProdSettings>.. <StagingSettings>.. <add key="Installer" value="https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe"/>.. <add key="WebProtectionZip" va

C:\Users\user\AppData\Local\Temp\7zS498BA48F\de-DE\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.423116664692943
Encrypted:	false
SSDEEP:	96:5GfMjBmbsmYpthmv13DA+7ZaOrO2I72LYlty5dPolY:5GEjBmb/Ypthmd3k+7LBTUa5NolY
MD5:	A564D6AE745D289B599A010E570E609E
SHA1:	7A698D14CDAB971982B02AF5A9C49D8AEDA56A19
SHA-256:	E20A9695E1322491C57C8A0E61839E5AEEBA40F43AAB400C29F19531D18FA037
SHA-512:	2894F6832F6D20E97E18FF09780D34E7CC25074F0382742838C9A060AF7ADE3FFD3DA9F844E0475697E3854A97379F0961A7F65A1EB5F2ACBA2AF17E49D75B39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................1... ...@....... ....................................@..................................0..O....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......h-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS498BA48F\en-US\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.337584317889265
Encrypted:	false
SSDEEP:	96:tDXGBpbsiopCUoHve6v7ptEAT0VOGSxQ7F0ltEj8dPolY:trGBpbLopDoHm1MeGU8NolY
MD5:	88498F281D2BC857F09C3A0EFFE97A35
SHA1:	5560555DED4D2336EBAAC6AECBD80C2FC6F0AAE7
SHA-256:	2FBD9C10CEC246D5E6EE2F41635F283C3064773724253BAE598BFAEA735B702D
SHA-512:	2550C9C2E42E77A44520EC53418636721C3A56BE7B647C839B7A3063A9BDE4FFD304A6812F51A95DF19B1F04E05285FA9C23AF946472F07DE10F514DDB0DF9C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................N/... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0/......H........+..d...........P ..I...........................................E..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet.... .......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..............v.D\|-......."..&...'c$Q:#Uv=.9.W..Y`..[.F.^:1;jg.Jq........\.......i.......t...............z...O...L...<...5..........................E...........L...

C:\Users\user\AppData\Local\Temp\7zS498BA48F\es-ES\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.320496600456879
Encrypted:	false
SSDEEP:	96:wfMjBDbsPnpEaLv3lhC3E1Wb/xg/x9lt2EZdPolY:wEjBDbWnpEaLPlhC3fa9ZNolY
MD5:	A22C9231A5562DCA9F0BC186BDA3348D
SHA1:	D4D281A596E272A482C6917DC3CA67C150E72FCB
SHA-256:	AF899C47BDE2A325F3F9F22772F4E305F6B50EAF040670DE508226FEFBED649B
SHA-512:	C140934BF63AADB01F7C0A1A4A7E89FB7CC6DEAA5219BBCB64EB6FB9D29F8139DC4A17C990373BB008A891436BD60E8B21CF748DAB0FA263853663AD17BA9FB4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@.................................<0..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p0......H........,..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS498BA48F\fr-CA\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.4162624308031155
Encrypted:	false
SSDEEP:	96:vfMjBwbssSpcuov88johXbk3LFXRq7hltE5dPolY:vEjBwbJSpcuo0aX07hM5NolY
MD5:	07759138B75C31E8E62E2DCB9E5B4121
SHA1:	C78CAC2D69DD3770256EA1D22FE62F8991AE1735
SHA-256:	460E0EA0F891B4A7D8FCF4D7C1DAF4034B1A8C01F35C55B87C4DE4D34F7E1119
SHA-512:	7089069EFBE9109ED034C9538B16F482573757A6DAED2D870CF1711F15B1F39FFFC6E5F9FF5E3380514EAFCEE49797F63DD0C9E472D37647EE3FCF34E086B189
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@..................................0..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......8-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS498BA48F\it-IT\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.05939038461759
Encrypted:	false
SSDEEP:	48:64WHsDO4eUqFAjpI1UhCvEWRCYVl6TxNLu6hxPFraKuhuXahZ439M/oKx8Welt4u:UFfAjpI1fvC6StPPtM+7tlth8tdPolY
MD5:	320A49D5E8C225BF7D8C8FC8F0FBA1FE
SHA1:	6986D89BABDB474B16E3074865EEDFFCCECC9337
SHA-256:	53F48BF5DEB5FB756EB61D5EE78BB72EF4509ADB396EB40BEF9671ECAA8D9819
SHA-512:	6EC2883F6542F8EA3966F367E11359B3702B8E8E01FAFA3D3828E16D216CC77CC71B92BB1BFBC0C7F146C79FB4DBEE5FAD84288DFE1C5979F0C59841B92F03D6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................n,... ...@....... ....................................@..................................,..W....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P,......H........(..d...........P ..`...........................................\..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&#Uv=.9.W.F.^:1;j........a.......J...'...........(...............p.......E...........{...........b.......B...O............B.T.N._.C.L.O.S.E......

C:\Users\user\AppData\Local\Temp\7zS498BA48F\ja-JP\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.697358912630535
Encrypted:	false
SSDEEP:	96:KsC3ASpa3kvBYTnRDzIWI2dPRp0QltdHmdPolY:KsOASpa3kpXoR+Q1GNolY
MD5:	442654050F5E5EBFB286C75A6AD10485
SHA1:	7F9AB13C925DDDE3ADE1EBA334DD17F6BF341F7A
SHA-256:	B85CC7BA82B58AFD8FA00DFCCD820B5B34BC14A942EBDAB5380FCE8F7257C0AE
SHA-512:	E7F9F728603091728451127C02B1F8412C741C57C5ADFED91FECA37989C07570886ACA262ECBDB17A968474E05936C3485602115CBC26EDCEE65DD7764B76795
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................-... ...@....... ....................................@..................................-..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H....... *..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\7zS498BA48F\pt-BR\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.272201212454418
Encrypted:	false
SSDEEP:	96:afMjBsbswapvL6vu1667y4UNGaB3q4kUO6ltMNdPolY:aEjBsb9apvL6ms67yJ3hUNNolY
MD5:	01CCD85F0676258B5E4A223832E3258C
SHA1:	630CD9F369A81A7823905FD842FDDEEFAF23D3A1
SHA-256:	C482D074CFDA0B6921A6750F0CCC1279BA6FCFB9D2037CA6EAAF704D8DAF811F
SHA-512:	1BB2DB0ABF3E0BCA3B131D2DF5329006A56E3FAA4E540621E54AA98DBB0BF4E27093314B477AA66E4F10FE0AF5DF1887FF23CAD938C5B0F98E455433E14FAD01
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......\|,..d...........P ..,...........................................(..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS498BA48F\ru-RU\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.608207837862824
Encrypted:	false
SSDEEP:	96:41fMjBGbsSopXm7vGQdkxbdV2UCwbT+T/UA7+1styo36glt55odPolY:eEjBGbbopXm7eXxbWqExi1splHoNolY
MD5:	F2876EC061D1CC88E44104ED97FC36F8
SHA1:	68BFE2A32CA14B0C379EF725E426AB2FED09E075
SHA-256:	6071DAA27880FE3F6B9FB704890250CA655CAFE832A1B9A4E59F0CFFFB042E04
SHA-512:	E3DD2BAAB3C5AFB124DC9CC0BB2D9318D33707732B4F23C211C2E3BC5A8A8889FAF42003857DA98D43DD7F7368CAFB3A02591BE04DCA4E1343A00283CA071DB6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................3... ...@....... ....................................@..................................3..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H.......L0..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS498BA48F\tr-TR\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.204809000235561
Encrypted:	false
SSDEEP:	48:6teH9O4G6ULy3ABApQe1eBpQvu18JvLh4jK0YuPx4S8zqeelt4833PPbknI5Klfy:TsC3AWpt1eYvJgjKZSJltkFdPolY
MD5:	D0009577C38F3338B2A3DCCEE9DF5169
SHA1:	D567D95A61B57885B55D7D70B93BC839EF162436
SHA-256:	598BAD964E2BED4A4EDAFAC5E8838C7B922C6EBBFBA70EDA0D400E543B91E54B
SHA-512:	95F766F541CA5EFC74C3DCC9D5C299798B581F1B302A4EFFDCA9B7ED4177DAF4E8547B7729DB724EB0A8A28C9770FC470BF9BDF2C616F70782DC96056CF8410E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................,... ...@....... ....................................@.................................<,..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p,......H........(..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\7zS498BA48F\zh-CHS\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.582926268925439
Encrypted:	false
SSDEEP:	96:vsC3AjpTfYGvqLH+/WZGrlqlt9kdPolY:vsOAjpTfxyb+/gGJq1kNolY
MD5:	322549094C487E49ACEB9899419D8EC6
SHA1:	DD0E5FF6BC3E4590203829DA1BB8BD7B00CBD07E
SHA-256:	7824381C18E86E72C0D4A8BB0ED377DFDB6E3B5374984ED67AF119B14268E70D
SHA-512:	80747F72196406993110D0DB5B736BCA21975C26615D34F771042E69CA0D519ED80C0E9267A90517A5B9862AB44CF9F9D96C354E952CB9CB0C32EB4887F80A1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................+... ...@....... ....................................@.................................t+..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........(..h...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\WcInstaller.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe
File Type:	ASCII text, with very long lines (912), with CRLF line terminators
Category:	dropped
Size (bytes):	3301
Entropy (8bit):	5.336651578147088
Encrypted:	false
SSDEEP:	96:DK18tAPy4COl++mu9Dus30bwK18tAnSnWANyH:DK1EAKis+39730bwK1EAtA0H
MD5:	99CF07913E3889BA477BF9A36703B9B4
SHA1:	00F63982629507111CF7BA321F73591937E3BFD8
SHA-256:	14B9E5FF33DC869B968885D05A2738CA28C5519C5BCB4592752E837352E38EB3
SHA-512:	E89588FEBAF123732A940AD332230C2797AEF79A6054758FD1BAB8321039AAC36E215CD8087D6CC5880EDC8413CA9924C2B6B5A66F1D956C39F6F96B70A90302
Malicious:	false
Preview:	Detecting windows culture..Preparing request for featureflag: {"Geo":"US","Partner":"IN240402","Campaign":"21551594541","InstallDate":"20240922","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}..Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklis

C:\Users\user\AppData\Local\Temp\WebCompanion.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	10494317
Entropy (8bit):	7.994463819622281
Encrypted:	true
SSDEEP:	196608:pKZsrAth9Vrdx45WtQbJtXWYxEwsOOXd/XUCv1uGJONYTr9udX6:U+rWVBx3WX7EJONION6f
MD5:	C0A2AAF917E6BC1D951EC481213D4138
SHA1:	56308BC1CF014F507E161B518736CD3D3666387D
SHA-256:	2F87DCD36A114502A3C80ECF8A8C5F5EF60475951F9C142A1A68BDEC6CAA3E23
SHA-512:	43EF07470F33BA0FF6A18E343C55ADAF0CDB2B88C3B37FA53F32608F1F78B6266BFACD2BB3BD92BF56EB0E28C4C20278212E06C1873DEA9098ECE5CDB117B9BC
Malicious:	false
Preview:	PK.........%.X....FF...$......Application/7za.exe.yxTE.8\|{I.YH'@CX.V[..%CP.4h_.MnCG@DQ..h..... .`'..\[...u..yg....QGY\........{..d.....S.......~.}y...N.:u..S.NU...`.......k....~.......e..o.`.......[`._..]U..g.s...?..~..J..:.~.s.t.}..q.>}2l.....u.....#.Y..Mt}.......6z......{.:.:.y^KW.]....ys."..Nu.........C.EB..$..P.k......s.(..zN..K.........iH..Z.....[..x.P.7.iB.6..Ta.,..I...#....g.r...<.wg.....zb......QUw..M.:...L...nHN..r...]#..TA.r...vO..5.'.:B]..p}<.lxU... ...6...........?i...o...g..7H...%E_..B...d.... .f.].&I..Q..G.S..x.o.K......../.~...g.Q_..^(..h^...Dq.J\Y2.....&...........Fo`...........}....98E'..Kne+c........._./..o.o.+g.z..M.6.....D.D.^I9..!..0HJ..?h.7..2"U.;...RY..=b..k.^y....0.l...m...h..9.........f....J-N..KU....HH."......Y...I)8..=s>.)MPH!.L....e...J..`bc(.:.-M=}...v...=..9.:..u.7.X.O...T..%e.)V...rS..s....o...[1.C... ...x7g)P..:............8. .u...lv-a..MB.TyW..D..p$..0.x>..'..K..l./g..U......b{.!_...,....<.....$#zh.e....+.

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.416742368826762
Encrypted:	false
SSDEEP:	3:asLGY8Uo3oMe4yeU+Y:aqGY8N3C4yeUn
MD5:	C93FCE4F40FAD7D90BF08C0B527DFB9E
SHA1:	3B0933782D90770549CDA87FB7E13433771A190A
SHA-256:	76404D15C75C151F677DBE831611B3EC1FB2741B4B2C4DC0AFE347D8D340C701
SHA-512:	AC7E4F6E95CA6E7BAA2ED761C8A5765C56241785F64084E88550F340B3FC84FAF0A6C71390C6D66019291E1FF870C89D839102EA3C4FDE403ACCC7C2BA31D444
Malicious:	false
Preview:	{ "install_id" : "96ef2557-6a7e-404e-9f11-0a66eb467147"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.65366954874114
TrID:	Win32 Executable (generic) a (10002005/4) 99.40% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Setup.exe
File size:	545'352 bytes
MD5:	1586cb9126c49565414bcea085b97366
SHA1:	199111eb1881f8ddb35f1858d0c85737f223c026
SHA256:	9633a7f85713f5a9e685f775860390f000013f377d9ef68e12e1c50f923c5583
SHA512:	e125019e496a64d43709bc1cb886e206a8e62e8d7d8c00ae8561eaea9599638e6193f452989ccb88489a6149b2997987e58f2c170b0fa3cfaf735c0fa85f22ee
SSDEEP:	12288:JG5knZfFKeTbOydwORmV42Y5RBHtf8WS8sejGxUeRx7/q4:JG50ZfFKMbRCa0gDS8geeG4
TLSH:	B9C4F1127DE089B5D5820431CC745FA6A2B6FE560A21887373997E3E7F7F642C232A1D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s..c}...s..Yy...s..w,...s...r./.s..w....s..Yx...s.......s.......s.Zyu...s.Rich..s.................PE..L......M...

File Icon


Icon Hash:	8011090b07071616

Static PE Info

General

Entrypoint:	0x4148d4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4DAC88CE [Mon Apr 18 18:54:06 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e00de6e48b9b06aceb12a81e7bf494c9

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Entrust Extended Validation Code Signing CA - EVCS2, O="Entrust, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	01/05/2024 15:39:26 01/05/2025 15:39:25
Subject Chain	CN=7270356 Canada Inc., SERIALNUMBER=1417258-2, OID.2.5.4.15=Private Organization, O=7270356 Canada Inc., OID.1.3.6.1.4.1.311.60.2.1.3=CA, L=Saint-Laurent, S=Quebec, C=CA
Version:	3
Thumbprint MD5:	0E3940FCE9D8B244F0D82DDEEBE28F5E
Thumbprint SHA-1:	EA06433E6F12D2AADA040F4A6EF7C927404A4CBA
Thumbprint SHA-256:	EB0A666D9DFD790059DF788FBA544ABC93E1690F1425147BA0A6E784AFC6F5B5
Serial:	25D0CB9D7B0D6C700CDAE43D243AB1C6

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0041B9E8h
push 004147FCh
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [0041B078h]
xor edx, edx
mov dl, ah
mov dword ptr [004233F0h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [004233ECh], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [004233E8h], ecx
shr eax, 10h
mov dword ptr [004233E4h], eax
push 00000001h
call 00007F0AC48E04BBh
pop ecx
test eax, eax
jne 00007F0AC48DF62Ah
push 0000001Ch
call 00007F0AC48DF6E8h
pop ecx
call 00007F0AC48DFF6Dh
test eax, eax
jne 00007F0AC48DF62Ah
push 00000010h
call 00007F0AC48DF6D7h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007F0AC48E20DCh
call dword ptr [0041B07Ch]
mov dword ptr [00425A5Ch], eax
call 00007F0AC48E1F9Ah
mov dword ptr [00423360h], eax
call 00007F0AC48E1D43h
call 00007F0AC48E1C85h
call 00007F0AC48E16E0h
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [0041B080h]
call 00007F0AC48E1C16h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F0AC48DF628h
movzx eax, word ptr [ebp+00h]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[ C ] VS2010 build 30319
[ASM] VS2010 build 30319
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e9ac	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0x71d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x81fb0	0x3298
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x200	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x197c0	0x19800	206b62d600beb166f8bf863ad5301f8c	False	0.5831609987745098	DOS executable (COM)	6.60822715389085	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x4490	0x4600	b0314f39355cab7d4674a0928d3b15f2	False	0.312109375	data	4.383775518811042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x5a68	0x3200	8d44c03d32e0c923339cda9fae15827a	False	0.123828125	data	1.3793356235333818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sxdata	0x26000	0x4	0x200	35925cfdc1176bd9ffc634a58b40ec17	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27000	0x71d4	0x7200	cd606fe2fe8a9aaa6244d6a44a46010a	False	0.3919613486842105	data	4.655199945289653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27354	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.37231182795698925
RT_ICON	0x2763c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5472972972972973
RT_ICON	0x27764	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2833 x 2833 px/m			0.3200354609929078
RT_ICON	0x27bcc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2833 x 2833 px/m			0.23688524590163934
RT_ICON	0x28554	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2833 x 2833 px/m			0.1721388367729831
RT_ICON	0x295fc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2833 x 2833 px/m			0.1241701244813278
RT_ICON	0x2bba4	0x1a7b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9648915769287506
RT_DIALOG	0x2d620	0xb8	data	English	United States	0.6684782608695652
RT_STRING	0x2d6d8	0x94	data	English	United States	0.668918918918919
RT_STRING	0x2d76c	0x34	data	English	United States	0.6538461538461539
RT_GROUP_ICON	0x2d7a0	0x4c	data			0.8289473684210527
RT_GROUP_ICON	0x2d7ec	0x22	data	English	United States	1.0
RT_VERSION	0x2d810	0x344	data	English	United States	0.4318181818181818
RT_MANIFEST	0x2db54	0x67f	exported SGML document, ASCII text, with CRLF line terminators	English	United States	0.3692122669873722

Imports

DLL	Import
OLEAUT32.dll	VariantClear, SysAllocString
USER32.dll	SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, GetWindowLongA, SetWindowTextW, LoadIconA, LoadStringW, LoadStringA, CharUpperW, CharUpperA, DestroyWindow, EndDialog, PostMessageA, ShowWindow, MessageBoxW, GetDlgItem, KillTimer, SetWindowTextA
SHELL32.dll	ShellExecuteExA
KERNEL32.dll	GetCurrentDirectoryA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, InterlockedDecrement, GetProcAddress, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, GetFileType, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, HeapSize, GetCurrentProcess, TerminateProcess, IsBadWritePtr, HeapCreate, HeapDestroy, GetEnvironmentVariableA, SetUnhandledExceptionFilter, TlsAlloc, ExitProcess, GetVersion, GetCommandLineA, GetStartupInfoA, GetModuleHandleA, WaitForSingleObject, CloseHandle, CreateProcessA, GetCommandLineW, GetVersionExA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, GetLastError, LoadLibraryA, GetModuleFileNameW, GetModuleFileNameA, LocalFree, FormatMessageW, FormatMessageA, SetFileTime, CreateFileW, SetLastError, SetFileAttributesW, SetFileAttributesA, RemoveDirectoryW, RemoveDirectoryA, CreateDirectoryW, CreateDirectoryA, DeleteFileW, DeleteFileA, GetFullPathNameW, GetFullPathNameA, SetCurrentDirectoryW, SetCurrentDirectoryA, GetCurrentDirectoryW, GetTempPathW, GetTempPathA, GetCurrentProcessId, GetTickCount, GetCurrentThreadId, FindClose, FindFirstFileW, FindFirstFileA, FindNextFileW, FindNextFileA, CreateFileA, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, GetStdHandle, WaitForMultipleObjects, Sleep, VirtualAlloc, VirtualFree, CreateEventA, SetEvent, ResetEvent, InitializeCriticalSection, RtlUnwind, RaiseException, HeapAlloc, HeapFree, HeapReAlloc, CreateThread, TlsSetValue, TlsGetValue, ExitThread

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-22T19:39:06.693470+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49732	104.16.149.130	80	TCP
2024-09-22T19:39:19.253171+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49768	104.16.148.130	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 22, 2024 19:38:46.469587088 CEST	49732	80	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:46.474865913 CEST	80	49732	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:46.475167990 CEST	49732	80	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:46.475716114 CEST	49732	80	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:46.480892897 CEST	80	49732	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:48.000273943 CEST	80	49732	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:48.000793934 CEST	80	49732	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:48.000979900 CEST	49732	80	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:48.001279116 CEST	80	49732	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:48.001456022 CEST	49732	80	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:48.001521111 CEST	80	49732	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:48.001686096 CEST	49732	80	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:48.227685928 CEST	49733	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:48.227777958 CEST	443	49733	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:48.228077888 CEST	49733	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:48.241039038 CEST	49733	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:48.241144896 CEST	443	49733	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:48.826332092 CEST	443	49733	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:48.826603889 CEST	49733	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:48.860192060 CEST	49733	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:48.860268116 CEST	443	49733	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:48.861319065 CEST	443	49733	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:48.912363052 CEST	49733	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:49.145766020 CEST	49733	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:49.191483974 CEST	443	49733	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:49.191574097 CEST	49733	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:49.191626072 CEST	443	49733	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:49.330307007 CEST	443	49733	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:49.330542088 CEST	443	49733	104.16.149.130	192.168.2.4
Sep 22, 2024 19:38:49.330838919 CEST	49733	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:49.332571983 CEST	49733	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:38:49.434072971 CEST	49734	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:49.434175968 CEST	443	49734	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:49.434271097 CEST	49734	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:49.434518099 CEST	49734	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:49.434533119 CEST	443	49734	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:49.927834034 CEST	443	49734	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:49.927956104 CEST	49734	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:49.930664062 CEST	49734	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:49.930711031 CEST	443	49734	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:49.931150913 CEST	443	49734	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:49.932415962 CEST	49734	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:49.975442886 CEST	443	49734	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:49.975613117 CEST	49734	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:49.975626945 CEST	443	49734	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.147768021 CEST	443	49734	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.147977114 CEST	443	49734	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.148055077 CEST	49734	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.148341894 CEST	49734	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.156362057 CEST	49735	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.156449080 CEST	443	49735	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.156554937 CEST	49735	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.156889915 CEST	49735	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.156948090 CEST	443	49735	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.677824020 CEST	443	49735	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.680036068 CEST	49735	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.680094957 CEST	443	49735	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.680176973 CEST	49735	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.680197001 CEST	443	49735	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.832027912 CEST	443	49735	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.832241058 CEST	443	49735	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.832456112 CEST	49735	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.835016012 CEST	49735	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.858402014 CEST	49736	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.858439922 CEST	443	49736	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:50.858541012 CEST	49736	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.858716965 CEST	49736	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:50.858722925 CEST	443	49736	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:51.325373888 CEST	443	49736	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:51.327414989 CEST	49736	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:51.327433109 CEST	443	49736	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:51.327491045 CEST	49736	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:51.327500105 CEST	443	49736	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:51.521574020 CEST	443	49736	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:51.521822929 CEST	443	49736	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:51.521883965 CEST	49736	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:51.523838997 CEST	49736	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:51.614022017 CEST	49737	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:51.614063978 CEST	443	49737	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:51.614161015 CEST	49737	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:51.614388943 CEST	49737	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:51.614402056 CEST	443	49737	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:52.144632101 CEST	443	49737	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:52.146240950 CEST	49737	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:52.146279097 CEST	443	49737	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:52.146553040 CEST	49737	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:52.146581888 CEST	443	49737	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:52.323163986 CEST	443	49737	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:52.323440075 CEST	443	49737	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:52.323632956 CEST	49737	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:52.323909998 CEST	49737	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.055555105 CEST	49738	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.055607080 CEST	443	49738	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:56.055674076 CEST	49738	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.055874109 CEST	49738	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.055881023 CEST	443	49738	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:56.518110991 CEST	443	49738	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:56.521955967 CEST	49738	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.521970034 CEST	443	49738	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:56.522020102 CEST	49738	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.522031069 CEST	443	49738	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:56.722366095 CEST	443	49738	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:56.722587109 CEST	443	49738	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:56.722644091 CEST	49738	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.724544048 CEST	49738	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.732218981 CEST	49741	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.732304096 CEST	443	49741	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:56.732387066 CEST	49741	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.732698917 CEST	49741	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:56.732758999 CEST	443	49741	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:57.218883038 CEST	443	49741	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:57.220673084 CEST	49741	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:57.220732927 CEST	443	49741	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:57.222079992 CEST	49741	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:57.222132921 CEST	443	49741	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:57.396425962 CEST	443	49741	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:57.396656036 CEST	443	49741	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:57.396936893 CEST	49741	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:57.397051096 CEST	49741	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:57.402471066 CEST	49742	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:57.402558088 CEST	443	49742	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:57.402647018 CEST	49742	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:57.402951002 CEST	49742	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:57.403008938 CEST	443	49742	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:57.867901087 CEST	443	49742	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:57.871735096 CEST	49742	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:57.871764898 CEST	443	49742	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:57.871999025 CEST	49742	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:57.872041941 CEST	443	49742	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.029095888 CEST	443	49742	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.029323101 CEST	443	49742	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.030052900 CEST	49742	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.030385017 CEST	49742	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.035121918 CEST	49743	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.035206079 CEST	443	49743	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.035286903 CEST	49743	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.035521030 CEST	49743	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.035541058 CEST	443	49743	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.587270975 CEST	443	49743	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.602421045 CEST	49743	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.602477074 CEST	443	49743	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.602540970 CEST	49743	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.602562904 CEST	443	49743	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.774008036 CEST	443	49743	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.774225950 CEST	443	49743	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.774287939 CEST	49743	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.774530888 CEST	49743	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.811441898 CEST	49745	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.811522007 CEST	443	49745	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:58.811603069 CEST	49745	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.811836004 CEST	49745	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:58.811867952 CEST	443	49745	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:59.303873062 CEST	443	49745	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:59.305876017 CEST	49745	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:59.305941105 CEST	443	49745	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:59.306021929 CEST	49745	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:59.306044102 CEST	443	49745	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:59.679476976 CEST	443	49745	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:59.679708958 CEST	443	49745	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:59.679888010 CEST	49745	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:59.680356979 CEST	49745	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:59.686412096 CEST	49746	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:59.686500072 CEST	443	49746	104.18.27.149	192.168.2.4
Sep 22, 2024 19:38:59.686599970 CEST	49746	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:59.687035084 CEST	49746	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:38:59.687069893 CEST	443	49746	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.157351017 CEST	443	49746	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.158771992 CEST	49746	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:00.158801079 CEST	443	49746	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.158849955 CEST	49746	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:00.158860922 CEST	443	49746	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.340454102 CEST	443	49746	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.340671062 CEST	443	49746	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.340846062 CEST	49746	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:00.341144085 CEST	49746	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:00.348987103 CEST	49748	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:00.349078894 CEST	443	49748	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.349145889 CEST	49748	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:00.349339962 CEST	49748	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:00.349359035 CEST	443	49748	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.814635992 CEST	443	49748	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.816926003 CEST	49748	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:00.816987038 CEST	443	49748	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.817136049 CEST	49748	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:00.817154884 CEST	443	49748	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.981920958 CEST	443	49748	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.982141972 CEST	443	49748	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:00.982228994 CEST	49748	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:00.983237982 CEST	49748	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.035263062 CEST	49750	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.035346031 CEST	443	49750	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:01.035443068 CEST	49750	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.042685032 CEST	49750	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.042757034 CEST	443	49750	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:01.525764942 CEST	443	49750	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:01.527549028 CEST	49750	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.527626991 CEST	443	49750	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:01.527704000 CEST	49750	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.527726889 CEST	443	49750	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:01.755677938 CEST	443	49750	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:01.755917072 CEST	443	49750	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:01.756557941 CEST	49750	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.757067919 CEST	49750	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.764714956 CEST	49754	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.764763117 CEST	443	49754	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:01.764825106 CEST	49754	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.765017986 CEST	49754	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:01.765036106 CEST	443	49754	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:02.238065958 CEST	443	49754	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:02.244513035 CEST	49754	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:02.244571924 CEST	443	49754	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:02.244647026 CEST	49754	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:02.244668007 CEST	443	49754	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:02.422415972 CEST	443	49754	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:02.422540903 CEST	443	49754	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:02.422776937 CEST	49754	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:02.423006058 CEST	49754	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:02.426875114 CEST	49756	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:02.426913977 CEST	443	49756	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:02.427082062 CEST	49756	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:02.427261114 CEST	49756	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:02.427275896 CEST	443	49756	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:02.915915966 CEST	443	49756	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:02.923846960 CEST	49756	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:02.923878908 CEST	443	49756	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:02.924046993 CEST	49756	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:02.924055099 CEST	443	49756	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:03.345197916 CEST	443	49756	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:03.345310926 CEST	443	49756	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:03.345372915 CEST	49756	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:03.345690012 CEST	49756	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:03.355041027 CEST	49758	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:03.355098963 CEST	443	49758	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:03.355237961 CEST	49758	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:03.355518103 CEST	49758	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:03.355535984 CEST	443	49758	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:03.827049971 CEST	443	49758	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:03.828725100 CEST	49758	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:03.828749895 CEST	443	49758	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:03.828895092 CEST	49758	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:03.828902960 CEST	443	49758	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.098658085 CEST	443	49758	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.098762035 CEST	443	49758	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.098910093 CEST	49758	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.099235058 CEST	49758	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.106878996 CEST	49760	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.106914043 CEST	443	49760	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.107258081 CEST	49760	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.108764887 CEST	49760	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.108781099 CEST	443	49760	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.735580921 CEST	443	49760	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.737118006 CEST	49760	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.737135887 CEST	443	49760	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.737270117 CEST	49760	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.737276077 CEST	443	49760	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.943655014 CEST	443	49760	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.943887949 CEST	443	49760	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.944103003 CEST	49760	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.944528103 CEST	49760	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.948616028 CEST	49762	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.948659897 CEST	443	49762	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:04.948966980 CEST	49762	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.949198008 CEST	49762	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:04.949214935 CEST	443	49762	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:05.438009977 CEST	443	49762	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:05.444957972 CEST	49762	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:05.444977045 CEST	443	49762	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:05.445182085 CEST	49762	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:05.445190907 CEST	443	49762	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:05.610301018 CEST	443	49762	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:05.610527039 CEST	443	49762	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:05.610582113 CEST	49762	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:05.610948086 CEST	49762	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:05.615535975 CEST	49763	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:05.615570068 CEST	443	49763	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:05.615637064 CEST	49763	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:05.615858078 CEST	49763	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:05.615871906 CEST	443	49763	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:06.125340939 CEST	443	49763	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:06.174329042 CEST	49763	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:06.174350977 CEST	443	49763	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:06.174416065 CEST	49763	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:06.174423933 CEST	443	49763	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:06.502234936 CEST	443	49763	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:06.502711058 CEST	443	49763	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:06.502772093 CEST	49763	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:06.503123045 CEST	49763	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:06.506990910 CEST	49732	80	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:06.511970997 CEST	80	49732	104.16.149.130	192.168.2.4
Sep 22, 2024 19:39:06.649710894 CEST	80	49732	104.16.149.130	192.168.2.4
Sep 22, 2024 19:39:06.650974035 CEST	49764	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:06.651027918 CEST	443	49764	104.16.149.130	192.168.2.4
Sep 22, 2024 19:39:06.651099920 CEST	49764	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:06.651323080 CEST	49764	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:06.651334047 CEST	443	49764	104.16.149.130	192.168.2.4
Sep 22, 2024 19:39:06.693470001 CEST	49732	80	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:07.358273983 CEST	443	49764	104.16.149.130	192.168.2.4
Sep 22, 2024 19:39:07.359613895 CEST	49764	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:07.359649897 CEST	443	49764	104.16.149.130	192.168.2.4
Sep 22, 2024 19:39:07.359827995 CEST	49764	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:07.359833002 CEST	443	49764	104.16.149.130	192.168.2.4
Sep 22, 2024 19:39:07.574616909 CEST	443	49764	104.16.149.130	192.168.2.4
Sep 22, 2024 19:39:07.574852943 CEST	443	49764	104.16.149.130	192.168.2.4
Sep 22, 2024 19:39:07.574906111 CEST	49764	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:07.575326920 CEST	49764	443	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:07.582964897 CEST	49732	80	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:07.587205887 CEST	49765	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:07.587233067 CEST	443	49765	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:07.587317944 CEST	49765	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:07.587590933 CEST	49765	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:07.587606907 CEST	443	49765	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:07.603725910 CEST	80	49732	104.16.149.130	192.168.2.4
Sep 22, 2024 19:39:07.603837967 CEST	49732	80	192.168.2.4	104.16.149.130
Sep 22, 2024 19:39:08.146625042 CEST	443	49765	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:08.148179054 CEST	49765	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:08.148199081 CEST	443	49765	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:08.148272991 CEST	49765	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:08.148283958 CEST	443	49765	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:08.332705021 CEST	443	49765	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:08.332967043 CEST	443	49765	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:08.333041906 CEST	49765	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:08.333308935 CEST	49765	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:08.338857889 CEST	49766	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:08.338892937 CEST	443	49766	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:08.338978052 CEST	49766	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:08.339168072 CEST	49766	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:08.339180946 CEST	443	49766	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:09.094373941 CEST	443	49766	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:09.096359968 CEST	49766	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:09.096396923 CEST	443	49766	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:09.096463919 CEST	49766	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:09.096476078 CEST	443	49766	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:09.326205969 CEST	443	49766	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:09.326430082 CEST	443	49766	104.18.27.149	192.168.2.4
Sep 22, 2024 19:39:09.326508999 CEST	49766	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:09.326797962 CEST	49766	443	192.168.2.4	104.18.27.149
Sep 22, 2024 19:39:09.378705025 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:09.378736973 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:09.378971100 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:09.379396915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:09.379410028 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.013766050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.014084101 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.019542933 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.019556046 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.020422935 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.021718979 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.067449093 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.155353069 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.155572891 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.155635118 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.155663967 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.155750990 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.155807972 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.155819893 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.155911922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.155966997 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.155975103 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.156068087 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.156119108 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.156126976 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.156323910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.156383991 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.156392097 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.209116936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.209131002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.255990982 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.264301062 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.264441967 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.264511108 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.264532089 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.265018940 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.265074015 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.265081882 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.265708923 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.265768051 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.265775919 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.265851021 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.265903950 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.265911102 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.265995979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.266050100 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.266057014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.266143084 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.266200066 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.266207933 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.266308069 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.266361952 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.266369104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.266762018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.266819000 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.266825914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.267057896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.267116070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.267122984 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.267219067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.267273903 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.267282009 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.267627954 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.267687082 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.267694950 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.267785072 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.267841101 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.267849922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.318598032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.353013992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.353190899 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.353264093 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.353348970 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.353383064 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.353405952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.353429079 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.353447914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.353533983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.353606939 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.353641033 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.353665113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.353682041 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.353682041 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.353943110 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.354100943 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.354123116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.354422092 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.354484081 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.354494095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.354548931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.354731083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.354806900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.355427980 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.355495930 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.355510950 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.355577946 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.356136084 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.356201887 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.419028044 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.419248104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.477196932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.477313995 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.477314949 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.477341890 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.477370024 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.477411985 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.478045940 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.478113890 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.478143930 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.478212118 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.478219986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.478243113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.478283882 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.478955984 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.479020119 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.479031086 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.479053974 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.479145050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.479151011 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.479168892 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.479183912 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.479212046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.479233980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.479274988 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.479345083 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.479370117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.479449034 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.480184078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.480253935 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.480295897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.480361938 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.480382919 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.480447054 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.480828047 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.480891943 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.480928898 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.480997086 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.481017113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.481082916 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.482474089 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.482537031 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.482573986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.482639074 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.482657909 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.482722044 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.483428001 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.483493090 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.531342030 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.531431913 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.564138889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.564204931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.564239025 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.564296961 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.564353943 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.564410925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.564491034 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.564542055 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.564569950 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.564625978 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.564845085 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.564897060 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.565478086 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.565534115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.565608978 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.565664053 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.565696955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.565752029 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.566714048 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.566782951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.566797018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.566840887 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.566854000 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.566883087 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.568026066 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.568078995 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.568099976 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.568108082 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.568136930 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.568164110 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.569065094 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.569114923 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.569144964 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.569152117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.569183111 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.569197893 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.570080042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.570127964 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.570163965 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.570172071 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.570205927 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.570225000 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.571546078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.571587086 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.571624994 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.571630955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.571655989 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.571691036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.678633928 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.678694010 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.678881884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.678904057 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.679128885 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.679744959 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.679790020 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.679831982 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.679852962 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.679871082 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.679915905 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.680202007 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.680243969 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.680277109 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.680283070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.680316925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.680341959 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.681847095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.681895018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.681925058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.681931019 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.681967020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.681993008 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.724540949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.724584103 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.724803925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.724826097 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.724883080 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.725169897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.725212097 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.725249052 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.725255966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.725308895 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.725451946 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.725491047 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.725524902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.725532055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.725557089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.725581884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.728210926 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.728254080 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.728298903 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.728306055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.728352070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.728382111 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.798017979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.798062086 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.798099995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.798108101 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.798141956 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.798165083 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.798849106 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.798888922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.798926115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.798933983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.798979044 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.799002886 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.799474955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.799515963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.799556017 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.799562931 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.799601078 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.799633980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.800159931 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.800201893 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.800245047 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.800251007 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.800296068 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.801105976 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.801147938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.801198006 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.801203966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.801234961 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.801259995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.801337957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.801393986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.801409006 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.801419020 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.801455975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.801481009 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.803179026 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.803219080 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.803257942 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.803267002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.803325891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.805430889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.805474043 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.805516005 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.805521965 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.805567026 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.874123096 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.874188900 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.874527931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.874550104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.874763012 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.880439997 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.880481005 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.880641937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.880642891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.880665064 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.880722046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.885755062 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.885797977 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.885977030 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.885977983 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.885999918 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.886182070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.890656948 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.890698910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.890746117 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.890769005 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.890786886 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.890816927 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.895212889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.895252943 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.895289898 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.895297050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.895329952 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.895356894 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.899868011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.899914980 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.899949074 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.899956942 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.899993896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.900019884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.903634071 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.903676033 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.903709888 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.903717041 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.903753042 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.903779030 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.907279968 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.907332897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.907366037 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.907372952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.907416105 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.907432079 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.984653950 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.984699011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.984854937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.984854937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.984879017 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.985110044 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.988482952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.988523006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.988595009 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.988617897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.988636017 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.988658905 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.992741108 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.992779970 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.992820024 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.992829084 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.992861032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.992887020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.996229887 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.996270895 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.996324062 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.996330976 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.996368885 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.996393919 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.999500036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.999541044 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.999577045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.999583006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:10.999615908 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:10.999646902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.002475977 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.002515078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.002547026 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.002553940 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.002588034 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.002610922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.014910936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.014952898 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.015104055 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.015104055 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.015125990 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.015348911 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.019125938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.019167900 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.019373894 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.019407034 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.019578934 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.078546047 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.078586102 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.078656912 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.078679085 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.078847885 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.078847885 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.082588911 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.082631111 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.082736969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.082753897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.082804918 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.086038113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.086080074 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.086126089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.086133957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.086168051 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.086190939 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.089513063 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.089553118 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.089600086 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.089607000 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.089643955 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.089665890 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.092354059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.092396021 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.092438936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.092444897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.092480898 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.092504025 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.095613003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.095654011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.095701933 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.095707893 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.095741987 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.095769882 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.098711967 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.098764896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.098805904 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.098814964 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.098830938 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.098860979 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.101435900 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.101483107 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.101567030 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.101573944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.101608992 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.101635933 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.176225901 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.176295042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.176568985 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.176593065 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.176793098 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.178776979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.178817987 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.178862095 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.178874016 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.178910017 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.178931952 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.181512117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.181550980 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.181719065 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.181719065 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.181740999 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.182045937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.184281111 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.184319973 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.184361935 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.184376955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.184401035 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.184426069 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.189533949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.189604998 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.189717054 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.189718008 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.189740896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.189937115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.192193985 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.192234993 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.192272902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.192281961 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.192312002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.192346096 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.194118977 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.194159031 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.194199085 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.194207907 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.194242954 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.194268942 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.197909117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.197999001 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.198052883 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.198060989 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.198105097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.198127031 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.283742905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.283791065 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.283955097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.283955097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.283977985 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.285959959 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.289954901 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.289995909 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.290045023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.290057898 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.290079117 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.290124893 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.295651913 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.295692921 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.295732975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.295741081 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.295758963 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.295782089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.300941944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.300982952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.301157951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.301157951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.301181078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.301951885 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.305382013 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.305422068 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.305510998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.305510998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.305546045 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.306032896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.309792042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.309847116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.309895992 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.309910059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.309943914 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.309952021 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.313126087 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.313167095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.313204050 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.313210964 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.313235998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.313256979 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.315651894 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.315695047 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.315851927 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.315860987 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.315912962 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.375241995 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.375289917 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.375380993 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.375408888 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.375427961 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.376808882 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.377912045 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.377953053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.378010035 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.378016949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.378027916 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.378072023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.380942106 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.380983114 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.381009102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.381016016 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.381042957 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.381062031 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.383903980 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.383944988 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.383980989 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.383987904 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.384021044 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.384031057 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.387290001 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.387332916 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.387360096 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.387367010 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.387406111 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.387439013 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.391148090 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.391186953 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.391222954 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.391230106 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.391256094 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.391275883 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.393538952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.393579006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.393613100 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.393619061 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.393646955 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.393666029 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.397355080 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.397397041 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.397439957 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.397447109 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.397475004 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.397496939 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.471580982 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.471685886 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.471829891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.471829891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.471853971 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.473944902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.475126982 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.475172043 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.475188017 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.475198030 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.475219965 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.475234985 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.480866909 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.480909109 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.480945110 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.480954885 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.480984926 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.481000900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.484448910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.484488964 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.484621048 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.484621048 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.484647989 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.485929012 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.488003016 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.488055944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.488091946 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.488101959 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.488135099 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.488151073 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.490045071 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.490087032 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.490108967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.490115881 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.490144968 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.490164995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.495683908 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.495727062 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.495760918 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.495769024 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.495809078 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.495821953 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.498855114 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.498893976 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.498927116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.498934031 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.498961926 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.498977900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.559251070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.559295893 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.559346914 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.559370995 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.559392929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.561137915 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.561203003 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.561211109 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.561243057 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.561279058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.561302900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.564132929 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.564188004 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.564229012 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.564245939 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.564258099 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.565932989 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.567771912 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.567811012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.567850113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.567859888 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.567887068 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.567944050 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.571355104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.571432114 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.571444035 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.571459055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.571502924 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.571512938 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.574495077 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.574541092 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.574561119 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.574570894 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.574636936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.574636936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.577966928 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.578008890 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.578043938 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.578051090 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.578085899 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.578085899 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.580064058 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.580104113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.580144882 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.580154896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.580166101 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.581928015 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.651782036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.651827097 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.651860952 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.651876926 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.651896000 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.653486013 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.653533936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.653542995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.653561115 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.653593063 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.653616905 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.657428980 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.657473087 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.657509089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.657516003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.657542944 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.657542944 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.659473896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.659528971 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.659548044 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.659554958 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.659583092 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.659590006 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.662446022 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.662487030 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.662519932 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.662528038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.662559032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.662585974 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.665160894 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.665200949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.665232897 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.665239096 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.665272951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.665281057 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.668100119 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.668139935 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.668178082 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.668184996 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.668219090 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.668237925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.670958996 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.671000957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.671036005 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.671042919 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.671066046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.671084881 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.752564907 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.752609968 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.752887011 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.752911091 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.753132105 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.754529953 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.754570961 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.754698038 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.754698038 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.754720926 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.754770994 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.756856918 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.756896019 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.756933928 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.756946087 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.756978035 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.756989002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.760164022 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.760204077 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.760240078 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.760246992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.760277033 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.760293961 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.763916969 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.763958931 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.763997078 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.764003992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.764018059 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.765921116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.767297983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.767339945 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.767357111 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.767365932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.767400980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.767400980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.775137901 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.775177956 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.775238037 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.775245905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.775271893 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.775290966 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.779737949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.779800892 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.779829025 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.779840946 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.779872894 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.779894114 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.845510960 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.845573902 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.845926046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.845951080 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.846191883 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.848109961 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.848160982 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.848198891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.848221064 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.848241091 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.848268986 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.850512981 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.850567102 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.850605965 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.850620031 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.850636005 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.850661993 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.854008913 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.854058027 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.854089975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.854096889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.854118109 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.854131937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.857070923 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.857117891 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.857148886 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.857156038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.857170105 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.857192993 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.860306978 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.860346079 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.860383987 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.860392094 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.860416889 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.860447884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.862724066 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.862766981 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.862791061 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.862797976 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.862817049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.862835884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.865569115 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.865617037 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.865643024 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.865649939 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.865668058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.865686893 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.932102919 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.932143927 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.932184935 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.932207108 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.932221889 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.932250023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.935162067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.935201883 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.935230017 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.935236931 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.935250998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.935275078 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.937983990 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.938024998 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.938051939 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.938059092 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.938076019 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.938100100 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.940829039 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.940870047 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.940897942 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.940908909 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.940926075 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.940948009 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.943671942 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.943711042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.943733931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.943739891 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.943761110 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.943783045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.946542025 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.946582079 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.946604967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.946611881 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.946630955 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.946651936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.949439049 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.949479103 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.949501991 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.949507952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.949533939 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.949547052 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.952092886 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.952132940 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.952156067 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.952163935 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:11.952187061 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:11.952194929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.019979954 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.020025015 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.020180941 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.020180941 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.020201921 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.020273924 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.023006916 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.023057938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.023087978 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.023096085 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.023123026 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.023139954 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.025674105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.025715113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.025748014 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.025754929 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.025772095 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.025794029 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.027271032 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.027314901 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.027339935 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.027345896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.027365923 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.027391911 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.029978037 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.030016899 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.030047894 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.030055046 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.030076981 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.030092001 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.031837940 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.031879902 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.031910896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.031917095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.031929016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.031955004 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.034394979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.034435034 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.034461975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.034467936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.034488916 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.034508944 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.036098003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.036138058 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.036164045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.036170959 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.036197901 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.036218882 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.106991053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.107033014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.107078075 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.107099056 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.107114077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.107151031 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.109155893 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.109196901 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.109225988 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.109236956 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.109266043 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.109285116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.111010075 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.111048937 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.111082077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.111088991 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.111114025 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.111139059 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.113495111 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.113535881 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.113563061 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.113569975 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.113598108 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.113621950 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.115186930 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.115227938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.115253925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.115261078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.115288973 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.115297079 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.116251945 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.116291046 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.116322041 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.116328955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.116349936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.116370916 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.118168116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.118206024 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.118237019 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.118243933 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.118271112 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.118300915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.120085001 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.120126009 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.120157003 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.120163918 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.120182991 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.120206118 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.194031954 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.194097042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.194120884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.194144011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.194159031 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.194188118 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.195600033 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.195650101 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.195677042 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.195684910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.195708036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.195734978 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.196909904 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.196964025 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.197020054 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.197027922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.197062969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.197084904 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.198983908 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.199023962 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.199047089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.199054003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.199078083 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.199085951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.200061083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.200107098 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.200135946 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.200143099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.200155973 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.200180054 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.201725006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.201783895 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.201795101 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.201812983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.201839924 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.201852083 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.202792883 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.202835083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.202852011 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.202860117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.202882051 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.202914000 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.204622030 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.204663038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.204689026 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.204694986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.204720974 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.204727888 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.280906916 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.280972958 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.280997992 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.281018972 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.281033039 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.281059980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.282107115 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.282165051 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.282181978 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.282190084 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.282223940 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.282234907 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.283729076 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.283771038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.283795118 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.283802032 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.283829927 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.283852100 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.284796953 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.284836054 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.284868002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.284874916 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.284897089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.284919977 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.286515951 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.286555052 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.286582947 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.286590099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.286622047 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.286638975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.287487984 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.287528992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.287550926 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.287558079 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.287579060 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.287602901 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.289047003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.289088011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.289118052 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.289124012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.289139032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.289163113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.289832115 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.289884090 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.289912939 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.289920092 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.289943933 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.289959908 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.367888927 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.367930889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.367961884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.367978096 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.367993116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.368027925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.369271040 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.369313955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.369333029 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.369340897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.369366884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.369375944 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.371989012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.372026920 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.372051954 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.372071028 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.372212887 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.372212887 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.373231888 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.373270988 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.373295069 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.373306990 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.373325109 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.373352051 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.374233007 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.374270916 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.374293089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.374300003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.374325037 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.374336958 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.375848055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.375901937 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.375910044 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.375926018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.375950098 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.375961065 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.376782894 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.376820087 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.376846075 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.376852036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.376871109 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.376887083 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.378190994 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.378233910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.378256083 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.378262997 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.378276110 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.378376961 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.470685005 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.470740080 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.470864058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.470864058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.470886946 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.471097946 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.472062111 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.472105026 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.472132921 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.472146988 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.472161055 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.472186089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.477714062 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.477761984 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.477879047 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.477879047 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.477904081 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.477950096 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.479276896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.479316950 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.479343891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.479353905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.479377985 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.479402065 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.480859041 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.480897903 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.480920076 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.480927944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.480950117 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.480969906 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.482373953 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.482413054 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.482438087 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.482444048 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.482469082 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.482490063 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.483527899 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.483582020 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.483608961 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.483616114 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.483637094 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.483649015 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.484946012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.484987974 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.485014915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.485021114 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.485048056 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.485069036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.556679964 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.556723118 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.556783915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.556807041 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.556823015 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.556855917 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.558181047 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.558218956 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.558250904 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.558260918 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.558290958 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.558305025 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.564646006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.564687014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.564719915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.564730883 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.564745903 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.564774036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.565987110 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.566029072 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.566056967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.566063881 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.566086054 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.566111088 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.567455053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.567492962 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.567524910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.567532063 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.567557096 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.567570925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.568466902 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.568506956 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.568531990 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.568537951 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.568563938 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.568572998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.569962025 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.570002079 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.570036888 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.570044041 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.570056915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.570085049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.570792913 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.570832014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.570863008 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.570869923 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.570898056 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.570913076 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.643708944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.643749952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.643981934 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.644006014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.644062996 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.645036936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.645077944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.645106077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.645113945 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.645133972 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.645153999 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.655014038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.655056000 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.655085087 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.655107021 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.655122042 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.655150890 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.656112909 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.656152964 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.656182051 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.656188965 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.656212091 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.656232119 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.656949997 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.656989098 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.657021046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.657027960 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.657052040 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.657061100 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.658512115 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.658561945 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.658592939 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.658601046 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.658618927 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.658642054 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.659499884 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.659539938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.659562111 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.659568071 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.659595966 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.659610033 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.660439014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.660479069 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.660507917 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.660515070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.660538912 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.660562992 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.731383085 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.731452942 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.731498957 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.731522083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.731583118 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.731583118 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.733407021 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.733447075 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.733714104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.733736038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.733791113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.742518902 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.742557049 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.742772102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.742772102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.742795944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.742842913 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.743052006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.743093014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.743119001 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.743140936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.743156910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.743184090 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.743875980 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.743922949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.743947029 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.743953943 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.743979931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.743993044 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.745428085 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.745466948 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.745503902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.745511055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.745522022 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.745560884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.746368885 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.746407986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.746438026 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.746443987 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.746463060 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.746484041 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.747312069 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.747351885 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.747371912 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.747379065 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.747395039 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.747412920 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.817914009 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.817959070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.817987919 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.818003893 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.818016052 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.818042994 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.818985939 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.819027901 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.819058895 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.819066048 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.819093943 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.819103956 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.829072952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.829113007 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.829144955 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.829152107 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.829164028 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.829190016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.830132961 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.830171108 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.830281019 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.830287933 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.830331087 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.831247091 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.831299067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.831340075 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.831346035 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.831373930 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.831389904 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.832211018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.832252026 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.832284927 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.832292080 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.832304001 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.832331896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.833195925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.833235979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.833261967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.833268881 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.833290100 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.833303928 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.834184885 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.834223986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.834266901 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.834275961 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.834286928 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.834314108 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.910892963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.910934925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.910998106 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.911021948 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.911032915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.911061049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.911717892 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.911761045 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.911784887 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.911791086 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.911809921 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.911824942 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.915971041 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.916009903 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.916038036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.916043997 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.916060925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.916083097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.916743994 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.916783094 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.916920900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.916928053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.916973114 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.917620897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.917659998 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.917690992 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.917696953 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.917721987 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.917741060 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.918479919 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.918519974 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.918548107 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.918554068 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.918577909 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.918586016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.919042110 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.919084072 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.919107914 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.919114113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.919130087 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.919151068 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.919747114 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.919785023 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.919811010 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.919816971 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.919838905 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.919853926 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.997725010 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.997767925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.997908115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.997908115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.997931004 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.998162031 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.998713017 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.998752117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.998780966 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.998792887 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:12.998807907 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:12.998836994 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.003021955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.003062963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.003096104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.003104925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.003117085 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.003273010 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.003583908 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.003639936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.003673077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.003685951 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.003701925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.003745079 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.004209042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.004251003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.004272938 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.004280090 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.004313946 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.004319906 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.004892111 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.004935980 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.004966974 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.004972935 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.004997969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.005012989 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.005995989 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.006035089 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.006066084 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.006072044 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.006094933 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.006115913 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.006536961 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.006578922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.006609917 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.006616116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.006643057 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.006663084 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.084971905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.085014105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.085089922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.085114002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.085130930 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.085151911 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.085377932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.085416079 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.085541010 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.085541010 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.085563898 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.085778952 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.089996099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.090035915 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.090080976 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.090096951 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.090116024 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.090142012 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.090554953 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.090595007 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.090632915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.090640068 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.090668917 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.090684891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.091262102 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.091301918 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.091334105 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.091342926 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.091373920 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.091397047 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.092263937 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.092303991 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.092333078 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.092339993 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.092365026 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.092379093 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.092952967 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.092992067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.093018055 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.093024015 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.093049049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.093056917 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.093564034 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.093601942 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.093628883 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.093635082 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.093657017 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.093681097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.171531916 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.171574116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.171634912 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.171658039 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.171673059 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.171700001 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.172746897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.172787905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.172823906 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.172831059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.172856092 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.172875881 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.176846027 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.176896095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.176928997 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.176935911 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.176964998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.176979065 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.177493095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.177534103 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.177563906 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.177570105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.177589893 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.177604914 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.178378105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.178421021 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.178447962 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.178455114 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.178495884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.178512096 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.178971052 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.179012060 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.179035902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.179042101 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.179066896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.179081917 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.179781914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.179821014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.179846048 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.179852962 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.179872036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.179896116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.180612087 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.180653095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.180680037 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.180685997 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.180708885 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.180721998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.269294024 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.269335985 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.269382000 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.269403934 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.269418955 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.269942999 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.270378113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.270416975 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.270445108 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.270452023 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.270472050 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.270492077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.273803949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.273843050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.273878098 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.273885012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.273905993 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.273926020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.274637938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.274677038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.274717093 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.274723053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.274748087 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.274761915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.275908947 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.275953054 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.275985956 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.275993109 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.276010036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.276029110 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.276807070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.276846886 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.276882887 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.276887894 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.276915073 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.276927948 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.276989937 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.277029037 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.277055025 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.277061939 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.277090073 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.277098894 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.278402090 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.278440952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.278470993 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.278477907 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.278496981 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.278517962 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.359000921 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.359041929 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.359076023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.359091043 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.359103918 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.359132051 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.360744953 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.360797882 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.360832930 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.360845089 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.360857010 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.361934900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.362257957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.362299919 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.362327099 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.362333059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.362359047 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.362381935 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.362651110 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.362689972 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.362718105 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.362725019 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.362750053 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.362762928 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.363590002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.363629103 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.363646030 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.363653898 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.363677979 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.363687038 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.364434004 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.364474058 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.364500046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.364506006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.364531040 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.364547968 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.365078926 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.365119934 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.365138054 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.365144968 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.365163088 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.365185022 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.365556002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.365593910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.365627050 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.365633011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.365643978 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.365921974 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.465094090 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.465152979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.465202093 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.465223074 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.465251923 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.465770006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.465825081 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.465835094 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.465858936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.465873957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.465939045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.471849918 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.471915007 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.471954107 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.471962929 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.471975088 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.472775936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.472825050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.472837925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.472858906 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.472887993 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.472914934 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.473805904 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.473853111 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.473989964 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.473999023 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.474042892 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.475940943 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.475990057 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.476027966 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.476036072 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.476047993 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.476077080 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.477183104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.477224112 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.477247953 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.477253914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.477282047 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.477294922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.478899002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.478938103 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.478980064 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.478986979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.479016066 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.479029894 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.570837021 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.570905924 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.571052074 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.571074963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.571121931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.573318005 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.573358059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.573390007 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.573396921 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.573419094 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.573441982 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.578468084 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.578507900 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.578541040 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.578548908 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.578574896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.578583956 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.580382109 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.580425024 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.580460072 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.580466986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.580481052 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.580504894 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.581604004 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.581644058 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.581675053 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.581681967 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.581707001 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.581724882 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.584283113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.584323883 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.584357023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.584363937 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.584386110 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.584399939 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.585946083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.585993052 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.586019039 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.586025953 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.586054087 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.586070061 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.587189913 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.587229967 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.587258101 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.587264061 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.587291002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.587311029 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.662662029 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.662719011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.662852049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.662852049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.662875891 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.662924051 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.663561106 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.663609028 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.663640022 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.663649082 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.663665056 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.663691998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.670496941 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.670540094 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.670573950 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.670581102 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.670595884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.670788050 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.671689987 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.671729088 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.671751976 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.671773911 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.671783924 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.671817064 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.672621965 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.672663927 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.672693014 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.672703981 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.672715902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.672744989 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.673862934 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.673907042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.673935890 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.673942089 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.673968077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.673981905 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.675815105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.675856113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.675885916 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.675892115 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.675914049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.675928116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.676840067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.676892042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.676919937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.676927090 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.676942110 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.676964998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.782561064 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.782623053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.782763004 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.782763004 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.782788038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.784567118 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.784612894 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.784656048 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.784656048 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.784678936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.785947084 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.786046982 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.786087036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.786124945 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.786139965 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.786154032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.787244081 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.787767887 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.787808895 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.787844896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.787852049 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.787878990 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.787897110 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.791939020 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.791977882 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.792021990 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.792031050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.792042971 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.793924093 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.794248104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.794289112 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.794322014 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.794327974 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.794361115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.794361115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.795624018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.795664072 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.795696020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.795702934 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.795713902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.797920942 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.803674936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.803720951 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.803760052 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.803781986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.803797007 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.805964947 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.870558977 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.870604992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.870784998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.870784998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.870807886 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.871622086 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.871658087 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.871670008 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.871701002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.871711016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.871735096 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.871773005 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.872850895 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.872890949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.872909069 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.872917891 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.872946024 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.872973919 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.874506950 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.874546051 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.874582052 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.874588966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.874622107 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.874622107 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.878698111 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.878739119 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.878895998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.878917933 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.878937006 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.878994942 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.882106066 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.882143974 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.882180929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.882189035 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.882219076 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.882236958 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.883179903 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.883232117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.883282900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.883290052 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.883310080 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.883325100 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.890459061 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.890497923 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.890536070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.890544891 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.890569925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.890584946 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.977016926 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.977060080 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.977174997 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.977196932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.977247953 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.978959084 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.978996038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.979027033 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.979033947 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.979058027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.979079008 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.980901957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.980940104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.980974913 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.980983019 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.981009007 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.981024027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.982166052 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.982203007 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.982228994 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.982240915 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.982254982 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.982299089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.990006924 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.990046024 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.990111113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.990130901 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.990145922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.990752935 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.990799904 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.990818977 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.990828991 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.990860939 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.990890980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.992615938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.992656946 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.992685080 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.992691994 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.992703915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.992729902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.997991085 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.998029947 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.998070002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.998076916 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:13.998102903 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:13.998115063 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.064197063 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.064239025 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.064363003 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.064363003 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.064387083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.064946890 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.065499067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.065587044 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.065613985 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.065622091 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.065637112 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.065659046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.068792105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.068831921 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.068849087 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.068857908 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.068886995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.068898916 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.069855928 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.069892883 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.069927931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.069935083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.069947004 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.072992086 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.077331066 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.077373028 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.077403069 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.077410936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.077420950 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.077447891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.078458071 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.078507900 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.078527927 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.078533888 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.078563929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.078563929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.079823971 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.079864025 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.079881907 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.079890013 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.079915047 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.079929113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.085279942 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.085338116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.085346937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.085362911 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.085391998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.085410118 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.085686922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.162915945 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.162962914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.163005114 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.163014889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.163054943 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.163064003 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.163955927 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.163995981 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.164020061 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.164026022 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.164055109 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.164066076 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.166637897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.166677952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.166703939 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.166709900 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.166738033 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.166748047 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.167767048 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.167808056 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.167831898 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.167838097 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.167861938 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.167881966 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.171561003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.171602011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.171637058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.171643972 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.171674967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.171688080 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.172807932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.172847033 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.172878981 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.172884941 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.172905922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.172924042 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.174364090 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.174401999 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.174427032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.174432993 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.174458027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.174472094 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.177211046 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.177251101 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.177273989 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.177279949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.177304983 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.177329063 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.177675009 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.436201096 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.436259031 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.436276913 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.436291933 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.436306000 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.436332941 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.437412024 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.437458992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.437482119 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.437489033 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.437520981 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.437582016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.438549995 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.438601017 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.438625097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.438631058 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.438657045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.438664913 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.440195084 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.440237045 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.440257072 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.440263033 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.440289974 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.440306902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.440844059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.440890074 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.440911055 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.440917969 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.440942049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.440962076 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.441544056 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.441587925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.441606045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.441613913 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.441644907 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.441658020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.444196939 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.444238901 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.444267988 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.444274902 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.444302082 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.444315910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.445504904 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.445545912 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.445578098 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.445585012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.445615053 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.445622921 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.446891069 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.446938992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.446964979 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.446970940 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.446990967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.447005033 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.449156046 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.449199915 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.449220896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.449227095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.449254990 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.449265957 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.450149059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.450187922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.450212955 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.450218916 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.450249910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.450249910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.453108072 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.453160048 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.453183889 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.453190088 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.453207016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.453223944 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.454018116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.454057932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.454081059 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.454087973 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.454109907 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.454123020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.456110001 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.456151009 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.456175089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.456181049 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.456204891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.456212997 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.457772017 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.457818031 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.457839012 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.457844973 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.457868099 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.457880020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.458915949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.459014893 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.459037066 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.459043980 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.459064007 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.459096909 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.498229027 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.498270035 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.498298883 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.498310089 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.498322010 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.498347044 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.499644041 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.499686956 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.499707937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.499713898 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.499741077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.499754906 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.526211023 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.526252985 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.526282072 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.526304960 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.526318073 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.526345968 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.527173042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.527214050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.527242899 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.527250051 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.527261972 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.527287960 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.528498888 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.528538942 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.528563976 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.528570890 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.528584003 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.528605938 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.530082941 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.530122042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.530158043 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.530168056 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.530178070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.530203104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.532428980 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.532468081 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.532485962 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.532495022 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.532511950 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.532526970 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.534255028 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.534293890 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.534317970 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.534329891 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.534346104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.534374952 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.585980892 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.586036921 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.586082935 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.586097002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.586127043 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.586144924 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.587589979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.587631941 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.587658882 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.587666035 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.587696075 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.587716103 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.613400936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.613447905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.613500118 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.613522053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.613539934 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.613568068 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.614744902 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.614785910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.614825964 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.614834070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.614856958 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.614876986 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.616602898 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.616643906 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.616681099 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.616688013 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.616714001 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.616729975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.617444992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.617486954 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.617533922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.617561102 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.617655993 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.617690086 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.618907928 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.618962049 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.619002104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.619009018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.619035959 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.619050026 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.620511055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.620552063 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.620588064 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.620594978 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.620615005 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.620635033 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.677318096 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.677362919 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.677505016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.677505016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.677529097 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.677737951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.678622007 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.678662062 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.678693056 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.678715944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.678730011 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.678756952 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.700890064 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.700932026 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.701075077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.701075077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.701102018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.701360941 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.701812029 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.701852083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.701884031 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.701896906 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.701910973 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.701937914 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.703629017 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.703666925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.703691006 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.703697920 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.703783989 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.704832077 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.704869986 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.704883099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.704893112 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.704910994 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.704941034 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.704962969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.706659079 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.706697941 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.706728935 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.706736088 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.706748962 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.706773996 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.708172083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.708211899 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.708240986 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.708247900 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.708260059 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.708287001 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.773863077 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.773904085 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.773987055 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.773987055 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.774008989 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.774055004 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.775178909 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.775218010 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.775336027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.775336027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:14.775358915 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:14.775415897 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.002640963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.002686024 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.002846956 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.002847910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.002870083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.002922058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.003985882 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.004026890 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.004055977 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.004064083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.004085064 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.004095078 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.005791903 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.005835056 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.005862951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.005870104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.005882025 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.005906105 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.006891012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.006932020 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.006954908 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.006962061 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.006983042 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.006995916 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.009764910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.009805918 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.009955883 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.009955883 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.009979963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.010032892 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.011763096 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.011804104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.011831045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.011840105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.011857033 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.011878014 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.013010025 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.013047934 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.013075113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.013082027 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.013094902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.013119936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.015650988 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.015688896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.015714884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.015722036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.015739918 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.015760899 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.017389059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.017430067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.017456055 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.017462969 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.017476082 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.017501116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.021158934 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.021198034 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.021229029 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.021235943 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.021246910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.021266937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.023237944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.023277998 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.023313046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.023319960 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.023348093 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.023355007 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.026366949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.026407957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.026437998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.026443958 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.026458979 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.026484966 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.026937962 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.026976109 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.027111053 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.027118921 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.027162075 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.030409098 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.030450106 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.030483007 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.030488968 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.030517101 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.030524969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.032628059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.032666922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.032687902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.032695055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.032716036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.032735109 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.039329052 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.039375067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.039408922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.039416075 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.039443970 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.039454937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.039735079 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.039776087 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.039803028 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.039809942 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.039835930 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.039843082 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.042735100 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.042779922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.042821884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.042830944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.042841911 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.042867899 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.044248104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.044286966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.044315100 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.044322014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.044336081 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.044358969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.047828913 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.047869921 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.047889948 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.047899008 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.047920942 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.047930002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.051908970 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.051951885 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.051995039 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.052002907 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.052032948 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.052047014 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.053018093 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.053056955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.053081036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.053086996 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.053113937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.053914070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.081691027 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.081729889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.081777096 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.081803083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.081819057 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.081845999 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.082370996 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.082412004 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.082439899 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.082447052 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.082473993 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.082495928 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.099776983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.099816084 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.099855900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.099864006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.099885941 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.099899054 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.102610111 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.102670908 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.102689028 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.102698088 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.102725029 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.102732897 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.105890036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.105937958 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.105962038 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.105968952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.105988979 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.106008053 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.108659983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.108710051 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.108730078 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.108757973 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.108763933 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.108798981 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.111795902 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.111835957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.111860991 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.111867905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.111885071 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.111902952 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.113888025 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.113934994 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.113953114 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.113960981 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.113986969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.114002943 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.172502995 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.172549963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.172595978 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.172605038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.172636032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.172646046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.174731970 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.174772978 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.174804926 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.174812078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.174830914 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.174849987 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.191354036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.191416979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.191461086 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.191469908 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.191499949 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.191520929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.192343950 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.192384958 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.192418098 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.192424059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.192449093 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.192456961 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.193892002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.193933964 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.193963051 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.193968058 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.193996906 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.194008112 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.195626974 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.195669889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.195684910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.195693016 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.195722103 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.195733070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.196556091 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.196597099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.196613073 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.196619987 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.196649075 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.196657896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.198045969 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.198101997 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.198112011 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.198126078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.198152065 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.198185921 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.256879091 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.256927013 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.256989002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.256995916 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.257025957 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.257036924 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.261126995 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.261168003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.261202097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.261209011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.261235952 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.261244059 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.278420925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.278460979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.278505087 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.278512955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.278539896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.278553963 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.279689074 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.279731035 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.279762030 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.279767990 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.279789925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.279810905 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.280980110 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.281018972 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.281054020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.281060934 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.281075954 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.281092882 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.282903910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.282943010 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.282972097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.282979012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.283005953 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.283025980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.283684015 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.283725023 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.283751965 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.283757925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.283785105 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.283813000 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.284972906 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.285020113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.285053015 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.285059929 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.285085917 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.285104036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.380845070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.380909920 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.380919933 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.380937099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.380971909 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.380986929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.381654978 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.381707907 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.381731987 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.381737947 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.381759882 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.381779909 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.395895004 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.395936966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.395968914 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.395976067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.396004915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.396034956 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.397134066 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.397178888 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.397193909 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.397202015 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.397222042 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.397243023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.400764942 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.400825977 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.400827885 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.400857925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.400882959 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.401906967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.402086973 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.402128935 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.402151108 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.402158022 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.402185917 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.402194023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.404655933 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.404696941 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.404721975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.404728889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.404757977 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.404769897 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.408526897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.408574104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.408597946 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.408605099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.408631086 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.408643007 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.466228008 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.466255903 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.466445923 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.466464043 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.466517925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.468929052 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.468955994 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.469105959 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.469114065 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.469158888 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.482606888 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.482666969 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.483035088 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.483059883 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.483256102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.483565092 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.483613014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.483771086 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.483778000 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.483822107 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.484558105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.484622002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.484633923 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.484652042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.484678984 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.484692097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.486257076 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.486300945 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.486320972 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.486346006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.486358881 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.486391068 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.487267017 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.487320900 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.487334967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.487340927 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.487374067 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.488903999 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.488950968 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.488971949 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.488976955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.489001989 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.489017010 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.597722054 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.597785950 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.598098993 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.598129988 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.598193884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.602725029 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.602785110 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.602811098 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.602830887 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.602859020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.602879047 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.619947910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.620019913 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.620131016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.620131016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.620151043 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.620194912 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.620922089 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.620965958 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.620984077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.620997906 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.621021032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.621040106 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.622322083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.622365952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.622392893 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.622402906 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.622421980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.622447014 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.623734951 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.623790026 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.623811960 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.623816967 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.623850107 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.624800920 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.624851942 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.624861002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.624881029 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.624914885 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.624923944 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.625592947 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.625643969 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.625664949 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.625669956 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.625696898 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.625711918 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.690859079 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.690918922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.691145897 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.691167116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.691220999 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.692022085 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.692068100 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.692090034 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.692095041 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.692122936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.692140102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.707479000 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.707539082 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.707564116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.707586050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.707719088 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.707726955 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.708360910 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.708410025 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.708430052 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.708436012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.708467960 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.708487034 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.711420059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.711467028 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.711484909 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.711502075 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.711529970 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.711544991 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.711922884 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.711982012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.711999893 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.712007046 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.712035894 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.712049007 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.713699102 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.713747978 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.713764906 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.713771105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.713800907 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.713819027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.714668036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.714720011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.714741945 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.714745998 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.714772940 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.714788914 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.800221920 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.800285101 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.800492048 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.800492048 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.800512075 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.802081108 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.803831100 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.803904057 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.803927898 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.803946972 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.803963900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.803987980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.832915068 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.832989931 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.833087921 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.833087921 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.833111048 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.833158016 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.836410999 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.836461067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.836479902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.836488008 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.836518049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.836535931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.840225935 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.840290070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.840317011 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.840322018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.840349913 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.840358019 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.841250896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.841305971 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.841317892 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.841336966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.841361046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.841377020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.844960928 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.845006943 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.845029116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.845035076 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.845057964 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.845067024 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.848728895 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.848828077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.848830938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.848855972 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.848884106 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.848898888 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.923731089 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.923803091 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.923927069 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.923928022 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.923949957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.924201965 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.925256014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.925309896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.925333023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.925343037 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:15.925364971 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:15.925384998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.016885996 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.016947031 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.016973972 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.016994953 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.017011881 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.017041922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.022233963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.022304058 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.022325039 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.022345066 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.022358894 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.022378922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.026035070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.026094913 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.026110888 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.026118040 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.026149035 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.026165009 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.030086994 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.030132055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.030158043 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.030163050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.030185938 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.030205011 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.033957958 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.034008980 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.034028053 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.034048080 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.034063101 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.034084082 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.035526037 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.035573959 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.035588026 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.035603046 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.035628080 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.035645962 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.061674118 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.061721087 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.061739922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.061745882 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.061774015 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.061785936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.064501047 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.064544916 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.064579964 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.064584970 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.064614058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.064623117 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.117402077 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.117465973 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.117580891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.117582083 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.117603064 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.117945910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.119013071 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.119060993 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.119080067 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.119086981 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.119116068 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.119132042 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.120693922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.120739937 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.120760918 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.120767117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.120793104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.120806932 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.122834921 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.122884035 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.122908115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.122911930 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.122940063 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.122953892 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.125097036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.125140905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.125164986 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.125169992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.125195980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.125205994 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.126405954 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.126446009 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.126471043 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.126475096 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.126502037 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.126516104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.164396048 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.164463997 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.164609909 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.164609909 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.164616108 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.164664030 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.172614098 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.172682047 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.172699928 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.172705889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.172736883 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.172749043 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.204695940 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.204766035 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.204905987 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.204905987 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.204914093 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.204957962 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.207638979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.207690001 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.207717896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.207721949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.207739115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.207762003 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.210962057 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.211005926 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.211038113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.211041927 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.211072922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.211081982 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.213905096 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.213954926 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.213988066 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.213994026 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.214023113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.214031935 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.216691017 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.216738939 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.216769934 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.216773987 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.216804028 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.216819048 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.218460083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.218503952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.218528986 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.218533039 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.218561888 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.218571901 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.257833004 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.257894993 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.257931948 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.257944107 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.258131027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.258131027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.260405064 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.260473967 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.260485888 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.260509968 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.260540962 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.260555983 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.292308092 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.292366028 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.292423964 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.292429924 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.292459011 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.292467117 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.295269966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.295316935 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.295347929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.295357943 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.295398951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.295398951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.298386097 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.298440933 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.298465014 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.298470020 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.298499107 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.298515081 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.301158905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.301203012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.301238060 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.301243067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.301271915 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.301297903 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.306067944 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.306111097 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.306143999 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.306149006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.306178093 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.306199074 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.308291912 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.308339119 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.308367968 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.308372021 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.308399916 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.308408022 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.346210957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.346273899 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.346394062 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.346394062 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.346407890 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.346457958 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.351373911 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.351444960 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.351453066 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.351475000 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.351507902 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.351521015 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.383049965 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.383116007 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.383244038 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.383244038 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.383260012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.383301020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.387475967 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.387520075 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.387542009 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.387548923 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.387572050 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.387587070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.390904903 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.390949011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.390959978 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.390976906 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.391000032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.391016006 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.395740986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.395790100 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.395809889 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.395816088 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.395840883 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.395858049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.399511099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.399553061 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.399574041 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.399580002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.399602890 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.399621010 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.403520107 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.403563023 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.403578997 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.403584003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.403618097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.442764997 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.442810059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.442929983 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.442929983 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.442941904 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.442984104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.447813988 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.447858095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.447896957 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.447904110 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.447931051 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.447947979 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.483886957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.483952045 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.484097958 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.484097958 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.484123945 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.484312057 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.490636110 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.490679026 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.490711927 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.490734100 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.490751982 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.490770102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.494586945 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.494635105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.494776011 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.494784117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.494822979 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.504102945 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.504147053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.504177094 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.504188061 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.504203081 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.504228115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.508228064 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.508270979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.508306980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.508311987 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.508349895 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.508368969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.511842012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.511902094 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.511930943 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.511936903 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.511955976 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.511977911 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.528753042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.528820992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.528956890 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.528976917 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.529026985 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.534224033 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.534291029 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.534321070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.534342051 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.534359932 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.534387112 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.585067987 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.585135937 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.585158110 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.585175037 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.585190058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.585216045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.592231989 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.592278957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.592314005 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.592319012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.592334032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.592359066 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.596466064 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.596513033 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.596528053 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.596543074 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.596576929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.596599102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.602190018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.602237940 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.602272034 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.602277040 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.602305889 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.602317095 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.609854937 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.609899998 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.609930992 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.609935999 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.609966040 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.609981060 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.618609905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.618654966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.618691921 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.618696928 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.618726969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.618741989 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.631906986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.631957054 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.631983995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.631989002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.632016897 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.632031918 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.638254881 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.638304949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.638325930 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.638331890 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.638361931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.638376951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.693990946 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.694037914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.694052935 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.694065094 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.694088936 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.694104910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.699727058 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.699771881 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.699805975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.699817896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.699836969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.699851990 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.704454899 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.704500914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.704524040 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.704533100 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.704549074 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.704566002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.714673996 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.714720011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.714956999 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.714979887 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.715034962 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.723253012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.723309994 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.723433018 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.723433971 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.723457098 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.723690987 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.733484030 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.733575106 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.733630896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.733652115 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.733670950 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.733685017 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.743379116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.743494987 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.743596077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.743597031 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.743618965 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.743900061 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.749474049 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.749522924 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.749548912 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.749577999 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.749593973 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.749614000 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.781194925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.781258106 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.781506062 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.781529903 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.781584024 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.787133932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.787178040 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.787373066 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.787404060 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.787468910 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.793374062 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.793420076 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.793451071 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.793473959 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.793488026 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.793513060 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.801285028 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.801326036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.801353931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.801358938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.801386118 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.801403999 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.805421114 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.805464983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.805490017 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.805494070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.805519104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.805541992 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.809822083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.809864998 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.809889078 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.809894085 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.809921980 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.809941053 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.816189051 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.816236973 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.816261053 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.816266060 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.816294909 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.816308975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.821641922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.821686983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.821729898 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.821733952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.821763039 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.821777105 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.873461962 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.873543024 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.873552084 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.873574018 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.873605967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.873616934 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.878082991 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.878133059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.878156900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.878161907 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.878190041 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.878209114 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.882904053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.882949114 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.882978916 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.882983923 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.883012056 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.883032084 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.897301912 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.897380114 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.897412062 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.897435904 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.897453070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.897476912 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.903486967 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.903546095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.903583050 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.903604031 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.903620005 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.903645039 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.907087088 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.907144070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.907166004 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.907224894 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.907258034 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.907273054 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.923793077 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.923840046 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.923880100 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.923887014 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.923916101 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.923934937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.935414076 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.935462952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.935508013 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.935513020 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.935550928 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.935570002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.978571892 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.978683949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.978701115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.978723049 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.978740931 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.978761911 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.988111973 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.988162041 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.988195896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.988200903 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.988230944 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.988250017 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.992923975 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.992966890 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.992990971 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.992995977 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.993021965 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.993035078 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.997518063 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.997561932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.997591972 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.997596979 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:16.997620106 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:16.997631073 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.002814054 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.002856016 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.002880096 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.002883911 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.002912045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.002922058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.008775949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.008816957 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.008841991 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.008846045 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.008873940 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.008888960 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.027208090 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.027275085 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.027410030 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.027431965 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.027483940 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.033572912 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.033626080 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.033653975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.033674955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.033690929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.033715963 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.061727047 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.061796904 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.061851978 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.061872959 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.061888933 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.062072992 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.066723108 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.066775084 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.066822052 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.066833019 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.066848040 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.066874027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.069602013 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.069664955 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.069688082 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.069693089 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.069813967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.069813967 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.075743914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.075797081 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.075823069 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.075829983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.075860023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.075877905 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.084476948 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.084521055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.084566116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.084570885 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.084598064 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.084618092 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.092330933 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.092375040 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.092405081 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.092412949 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.092437983 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.092462063 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.109539032 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.109582901 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.109688997 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.109688997 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.109713078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.109893084 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.113111019 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.113162994 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.113178015 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.113190889 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.113217115 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.113224983 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.147486925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.147548914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.147679090 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.147680044 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.147702932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.147751093 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.151540041 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.151601076 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.151608944 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.151629925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.151660919 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.151674986 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.154992104 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.155042887 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.155184984 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.155184984 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.155205965 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.155256987 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.158382893 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.158427954 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.158453941 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.158462048 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.158483982 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.158499002 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.160993099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.161037922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.161060095 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.161066055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.161098003 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.161112070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.163966894 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.164016962 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.164046049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.164050102 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.164071083 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.164092064 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.199326992 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.199403048 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.199413061 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.199449062 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.199475050 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.199496984 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.202533960 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.202584028 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.202599049 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.202605963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.202636957 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.202647924 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.233659983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.233726978 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.233757019 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.233762026 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.233791113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.233808041 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.236479998 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.236541986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.236567974 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.236572981 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.236598015 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.236618996 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.239502907 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.239554882 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.239578962 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.239586115 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.239614964 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.239624977 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.241184950 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.241241932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.241266012 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.241317987 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.241344929 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.241359949 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.244149923 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.244195938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.244230032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.244235039 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.244277954 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.244290113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.246100903 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.246164083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.246179104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.246189117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.246222973 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.246233940 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.311552048 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.311620951 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.311640024 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.311655045 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.311677933 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.311697006 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.315295935 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.315346003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.315365076 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.315371990 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.315409899 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.315498114 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.331688881 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.331732988 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.331759930 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.331764936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.331793070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.331813097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.336752892 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.336802006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.336834908 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.336839914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.336869955 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.336884975 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.341881990 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.341928005 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.341942072 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.341948032 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.341979027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.341991901 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.348537922 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.348581076 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.348593950 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.348611116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.348638058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.348654032 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.350213051 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.350265026 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.350282907 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.350287914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.350317955 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.350332022 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.358253002 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.358299971 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.358319998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.358325958 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.358355045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.358371973 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.398601055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.398680925 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.398699045 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.398705959 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.398736954 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.398756027 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.401300907 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.401345968 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.401371956 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.401376963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.401398897 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.401417971 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.417972088 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.418061972 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.418230057 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.418255091 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.418272018 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.418433905 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.420658112 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.420711040 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.420736074 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.420747995 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.420768023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.420785904 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.423777103 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.423830032 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.423944950 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.423944950 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.423976898 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.424041033 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.426307917 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.426371098 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.426381111 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.426403046 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.426422119 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.426438093 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.428744078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.428793907 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.428900003 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.428900003 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.428922892 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.428966999 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.431996107 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.432049036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.432074070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.432091951 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.432104111 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.432136059 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.485236883 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.485295057 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.485488892 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.485501051 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.485551119 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.487499952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.487544060 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.487576008 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.487580061 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.487610102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.487623930 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.505115032 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.505176067 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.505304098 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.505311966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.505359888 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.507955074 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.508001089 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.508037090 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.508040905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.508069992 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.508076906 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.510525942 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.510575056 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.510588884 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.510603905 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.510632038 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.510647058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.513128042 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.513175011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.513196945 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.513201952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.513231039 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.513250113 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.514734030 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.514779091 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.514801025 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.514806032 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.514849901 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.514849901 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.516350031 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.516398907 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.516443014 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.516454935 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.516463995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.516498089 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.590033054 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.590104103 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.590152025 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.590158939 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.590186119 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.590186119 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.594312906 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.594372988 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.594393015 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.594399929 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.594424963 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.594444036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.608030081 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.608105898 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.608144999 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.608150959 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.608190060 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.609910965 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.611341953 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.611417055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.611423969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.611448050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.611489058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.611495972 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.614804983 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.614849091 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.614883900 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.614890099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.614921093 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.614928961 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.616799116 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.616847038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.616878033 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.616883039 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.616925001 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.620573997 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.620619059 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.620661020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.620666981 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.620680094 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.620712996 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.623522043 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.623574972 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.623594046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.623600006 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.623627901 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.623651028 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.679215908 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.679271936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.679311991 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.679317951 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.679346085 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.679368019 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.682130098 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.682174921 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.682212114 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.682216883 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.682250023 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.682257891 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.695379019 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.695472956 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.695513010 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.695533991 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.695554972 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.695617914 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.697738886 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.697792053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.697829008 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.697834015 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.697863102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.697880983 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.699877024 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.699925900 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.699944019 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.699950933 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.699984074 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.700001001 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.704389095 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.704440117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.704463959 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.704468966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.704495907 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.704518080 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.706402063 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.706454039 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.706475019 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.706486940 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.706511974 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.706526995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.708138943 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.708184004 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.708203077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.708209038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.708235025 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.708256006 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.772664070 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.772762060 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.772816896 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.772882938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.772922039 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.772947073 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.775221109 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.775268078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.775319099 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.775331974 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.775392056 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.775419950 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.802905083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.802988052 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.802992105 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.803020954 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.803059101 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.803251028 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.805191994 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.805241108 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.805253029 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.805267096 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.805305004 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.805320978 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.810537100 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.810589075 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.810627937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.810635090 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.810666084 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.810874939 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.816109896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.816163063 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.816184998 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.816190004 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.816217899 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.816226959 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.818355083 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.818414927 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.818416119 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.818440914 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.818494081 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.823832989 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.823878050 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.823913097 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.823956966 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.824012995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.824012995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.872423887 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.872483015 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.872495890 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.872515917 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.872540951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.872561932 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.875268936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.875323057 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.875360966 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.875366926 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.875394106 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.875412941 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.890496969 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.890543938 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.890584946 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.890602112 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.890614986 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.890645981 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.892560959 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.892604113 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.892693043 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.892699003 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.892738104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.892746925 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.897627115 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.897674084 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.897696018 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.897701025 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.897861958 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.897861958 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.912808895 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.912878036 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.912928104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.912945032 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.912955999 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.912986040 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.914763927 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.914810896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.914846897 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.914851904 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.914880991 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.914894104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.916457891 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.916512012 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.916537046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.916542053 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.916568995 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.916589022 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.966170073 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.966240883 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.966279030 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.966300011 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.966320038 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.966350079 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.968800068 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.968858004 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.968887091 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.968892097 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.968914986 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.968935966 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.989773989 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.989835978 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.989981890 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.989981890 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.990005016 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.990226030 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.993204117 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.993257999 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.993284941 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.993297100 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:17.993313074 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:17.993339062 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.005167961 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.005239964 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.005352020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.005352020 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.005374908 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.005575895 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.026027918 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.026087999 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.026235104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.026235104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.026257038 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.026475906 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.028764963 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.028825998 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.028845072 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.028858900 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.028876066 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.029087067 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.031353951 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.031433105 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.031547070 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.031558990 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.031609058 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.070163965 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.070233107 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.070374966 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.070374966 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.070395947 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.070447922 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.072827101 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.072879076 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.072911978 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.072921991 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.072933912 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.072964907 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.091751099 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.091811895 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.091845036 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.091866016 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.091877937 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.091905117 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.093425989 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.093489885 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.093499899 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.093519926 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.093549013 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.093564034 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.095293045 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.095335960 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.095360994 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.095365047 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.095405102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.095405102 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.113997936 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.114058971 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.114314079 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.114335060 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.114640951 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.116085052 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.116144896 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.116189957 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.116204023 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.116219997 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.116247892 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.117736101 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.117790937 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.117819071 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.117824078 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.117851019 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.117872953 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.168468952 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.168538094 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.168586969 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.168607950 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.168625116 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.168651104 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.171974897 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.172035933 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.172060013 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.172065020 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.172096968 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.172106981 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.191021919 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.191114902 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.191256046 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.191265106 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.191312075 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.192997932 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.193043947 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.193074942 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.193078995 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.193108082 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.193125963 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.194952965 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.195003986 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.195029974 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.195034027 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.195064068 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.195080996 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.215841055 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.215900898 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.215935946 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.215939999 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.215970039 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.215979099 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.217210054 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.217281103 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.217288017 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.217305899 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.217428923 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.217428923 CEST	443	49767	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.217482090 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.217683077 CEST	49767	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.419545889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.419648886 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:18.419753075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.419984102 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:18.420003891 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.123254061 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.124695063 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.124748945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.253211021 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.253331900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.253424883 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.253467083 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.253499031 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.253546000 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.253560066 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.253828049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.253879070 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.253891945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.254993916 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.255153894 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.255161047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.255191088 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.255234003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.256093025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.258383036 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.258438110 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.258450031 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.302918911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.343556881 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.343743086 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.343805075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.343846083 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.343946934 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.344021082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.344037056 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.344137907 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.344197035 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.344209909 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.345058918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.345118046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.345133066 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.345228910 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.345278025 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.345288992 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.345777988 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.345832109 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.345845938 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.346576929 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.346641064 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.346652985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.346731901 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.346784115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.346796989 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.347528934 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.347582102 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.347594976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.347711086 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.347762108 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.347779989 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.348567963 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.348632097 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.348644018 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.396624088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.396639109 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.434263945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.434339046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.434356928 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.434458971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.434519053 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.434531927 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.435236931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.435270071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.435303926 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.435318947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.435347080 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.435422897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.435483932 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.435497046 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.435561895 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.436073065 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.436206102 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.436264992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.436276913 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.436336994 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.436561108 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.436665058 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.437321901 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.437382936 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.437895060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.437956095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.437983990 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.438043118 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.438704967 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.438771963 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.439460993 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.439538002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.439677954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.439749956 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.440112114 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.440171957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.440824986 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.440897942 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.440916061 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.440978050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.525180101 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.525473118 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.525532961 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.525845051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.525887012 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.525948048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.526014090 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.526066065 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.526087046 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.526118040 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.526133060 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.526665926 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.526784897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.526851892 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.526851892 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.526916027 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.526956081 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.526967049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.526992083 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.527020931 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.527081966 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.527141094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.527157068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.527218103 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.527812004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.527877092 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.528614998 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.528687000 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.528706074 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.528774977 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.529459000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.529532909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.529550076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.529604912 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.530328989 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.530389071 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.530426025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.530503035 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.531178951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.531227112 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.531471014 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.531538010 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.531568050 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.531625986 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.532563925 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.532632113 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.532665968 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.532728910 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.532748938 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.532808065 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.533533096 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.533586025 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.533632040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.533699989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.533720016 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.533781052 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.534378052 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.534426928 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.534465075 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.534535885 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.535243034 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.535264015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.535305023 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.535305023 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.535320997 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.535337925 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.535355091 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.584165096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.615940094 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.615972042 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.616019964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.616027117 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.616084099 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.616084099 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.616116047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.616163969 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.617512941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.617568016 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.617619038 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.617619038 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.617635012 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.617676020 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.619251013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.619317055 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.619338036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.619358063 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.619404078 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.619404078 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.621149063 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.621243000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.621243954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.621278048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.621313095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.621920109 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.622931004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.623008013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.623034000 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.623049974 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.623100042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.623100042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.623502016 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.623552084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.623586893 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.623599052 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.623620987 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.623645067 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.624481916 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.624526024 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.624562979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.624578953 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.624603033 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.624620914 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.707945108 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.708019018 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.708059072 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.708085060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.708112001 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.708129883 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.709217072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.709280014 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.709297895 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.709320068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.709343910 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.709361076 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.710535049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.710580111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.710628033 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.710628033 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.710642099 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.710684061 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.711513996 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.711568117 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.711595058 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.711606979 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.711633921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.711633921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.711653948 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.713385105 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.713454962 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.713473082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.713489056 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.713510036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.714363098 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.714406013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.714457989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.714472055 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.714503050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.716087103 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.716129065 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.716162920 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.716178894 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.716202974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.717044115 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.717084885 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.717119932 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.717133045 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.717158079 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.771636009 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.798665047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.798727989 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.798767090 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.798783064 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.798810005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.798830032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.799752951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.799808025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.799839020 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.799850941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.799877882 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.799895048 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.801107883 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.801131010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.801179886 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.801193953 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.801244974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.802150011 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.802171946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.802203894 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.802215099 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.802241087 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.802256107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.803694010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.803715944 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.803765059 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.803776979 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.803803921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.803822041 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.804785013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.804814100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.804867029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.804878950 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.804924965 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.804924965 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.806267977 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.806292057 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.806339979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.806350946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.806375980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.806395054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.807290077 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.807312012 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.807359934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.807372093 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.807420969 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.807420969 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.889457941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.889519930 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.889786959 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.889847994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.889918089 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.891380072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.891503096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.891510010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.891541004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.891573906 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.891593933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.891649961 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.891704082 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.891715050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.891736984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.891772032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.891772032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.893106937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.893171072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.893193007 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.893208981 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.893234015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.893253088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.893898010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.893942118 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.893975019 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.893985987 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.894011974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.894030094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.894926071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.894964933 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.894994020 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.895004034 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.895030022 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.895047903 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.896658897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.896699905 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.896728992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.896739006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.896764994 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.896779060 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.897454023 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.897495985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.897526026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.897536993 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.897562027 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.897578001 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.980587006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.980645895 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.980700016 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.980762959 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.980796099 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.980842113 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.981614113 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.981654882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.981694937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.981713057 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.981738091 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.981755018 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.983026028 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.983067036 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.983098984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.983109951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.983135939 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.983153105 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.983757973 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.983798981 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.983829021 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.983839035 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.983865976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.983880043 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.985160112 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.985199928 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.985230923 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.985241890 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.985265970 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.985280991 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.986157894 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.986197948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.986232042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.986243010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.986288071 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.986288071 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.987835884 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.987874031 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.987906933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.987924099 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.987951040 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.987972021 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.988775969 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.988815069 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.988847971 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.988857985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:19.988879919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:19.988899946 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.071547985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.071593046 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.071779966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.071779966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.071804047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.071852922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.072782040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.072822094 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.072860003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.072870970 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.072901964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.072921038 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.073899984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.073956013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.073975086 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.073991060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.074012995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.074032068 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.074846983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.074886084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.074919939 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.074930906 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.074958086 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.074976921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.075829983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.075874090 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.075906038 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.075917006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.075943947 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.075963974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.076934099 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.076973915 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.077007055 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.077018023 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.077039003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.077055931 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.077764988 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.077802896 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.077836990 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.077847004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.077872992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.077889919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.078717947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.078757048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.078787088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.078797102 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.078824043 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.078836918 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.336771965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.336802959 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.336846113 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.336870909 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.337049961 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.337050915 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.337502003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.337522984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.337579012 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.337591887 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.337668896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.337697983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.339648008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.339714050 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.339726925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.339742899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.339766026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.339791059 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.340970993 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.340991020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.341033936 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.341047049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.341087103 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.342767954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.342787027 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.342828035 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.342840910 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.342881918 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.344175100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.344192028 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.344244957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.344258070 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.344295025 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.345998049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.346018076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.346055984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.346070051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.346097946 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.346113920 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.346342087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.346360922 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.346393108 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.346405029 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.346426964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.346446037 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.347340107 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.347358942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.347420931 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.347434998 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.347460985 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.347475052 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.349416018 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.349433899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.349493980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.349504948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.349529982 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.349558115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.352463007 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.352482080 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.352538109 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.352550983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.352575064 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.352591038 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.352730989 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.352747917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.352778912 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.352788925 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.352814913 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.352833986 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.353993893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.354013920 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.354068995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.354085922 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.354109049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.354125023 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.355632067 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.355649948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.355705023 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.355717897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.355746031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.355765104 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.358906031 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.358926058 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.358977079 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.358988047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.359014988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.359036922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.361718893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.361773014 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.361810923 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.361835957 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.361859083 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.361877918 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.362515926 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.362555027 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.362695932 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.362709045 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.362760067 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.363629103 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.363667965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.363714933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.363732100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.363760948 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.363775015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.365010977 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.365075111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.365082026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.365103006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.365128994 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.365144014 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.366781950 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.366842985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.366873026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.366884947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.366910934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.366926908 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.368287086 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.368333101 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.368367910 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.368380070 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.368402004 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.368419886 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.369286060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.369354010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.369379044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.369395971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.369420052 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.369440079 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.371239901 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.371293068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.371314049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.371330976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.371372938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.371372938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.375188112 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.375237942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.375272989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.375286102 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.375313044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.375328064 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.455459118 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.455528975 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.455570936 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.455585957 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.455727100 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.455727100 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.456286907 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.456356049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.456378937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.456396103 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.456420898 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.456440926 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.456950903 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.456995010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.457017899 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.457035065 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.457057953 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.457076073 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.457895041 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.457942963 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.457979918 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.457992077 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.458017111 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.458034039 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.459042072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.459091902 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.459131002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.459142923 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.459168911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.459187984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.459892035 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.459958076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.459964037 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.459989071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.460020065 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.460041046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.461036921 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.461095095 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.461124897 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.461136103 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.461163044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.461163044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.461183071 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.461842060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.461889982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.461925983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.461939096 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.461960077 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.461977005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.573358059 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.573416948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.573565006 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.573565006 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.573606968 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.573667049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.575546980 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.575614929 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.575649977 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.575664997 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.575690031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.575707912 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.579600096 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.579665899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.579678059 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.579698086 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.579724073 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.579742908 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.581654072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.581713915 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.581756115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.581768036 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.581794024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.581813097 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.585746050 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.585836887 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.585839987 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.585867882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.585891962 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.585915089 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.588044882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.588114977 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.588133097 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.588152885 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.588176966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.588196993 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.591691971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.591758013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.591768026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.591792107 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.591809034 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.591834068 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.594206095 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.594266891 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.594280958 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.594300985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.594325066 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.594342947 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.664508104 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.664546013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.664717913 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.664717913 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.664736032 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.664796114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.665427923 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.665451050 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.665491104 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.665503979 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.665528059 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.665544033 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.666542053 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.666564941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.666610003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.666620970 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.666646957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.666662931 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.669262886 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.669291019 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.669327974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.669341087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.669364929 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.669380903 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.669935942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.669956923 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.669990063 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.670002937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.670023918 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.670039892 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.670793056 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.670851946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.670882940 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.670895100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.670918941 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.670943022 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.671540022 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.671587944 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.671622038 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.671641111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.671673059 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.671693087 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.672445059 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.672496080 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.672527075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.672538042 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.672564983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.672579050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.780067921 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.780132055 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.780297995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.780297995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.780333042 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.780392885 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.781467915 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.781543016 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.781559944 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.781574965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.781609058 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.781625032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.781954050 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.782007933 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.782042980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.782053947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.782080889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.782095909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.784730911 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.784775972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.784806967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.784818888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.784842968 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.784884930 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.785384893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.785446882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.785464048 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.785481930 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.785506964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.785526037 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.788691998 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.788746119 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.788783073 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.788794994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.788820982 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.788840055 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.789407015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.789469004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.789480925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.789503098 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.789536953 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.789558887 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.792468071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.792510986 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.792543888 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.792556047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.792579889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.792598009 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.877477884 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.877549887 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.877574921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.877595901 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.877619028 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.877636909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.879317045 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.879360914 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.879429102 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.879429102 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.879445076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.879497051 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.881443977 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.881490946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.881542921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.881555080 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.881582975 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.881603003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.882656097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.882698059 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.882725000 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.882741928 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.882765055 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.882785082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.884958982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.885014057 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.885047913 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.885060072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.885086060 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.885101080 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.886418104 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.886466980 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.886511087 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.886527061 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.886558056 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.886571884 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.886874914 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.886915922 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.886951923 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.886962891 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.886992931 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.887006998 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.887144089 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.887183905 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.887248039 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.887260914 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.887289047 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.887311935 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.968247890 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.968308926 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.968348026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.968362093 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.968411922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.968411922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.969186068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.969232082 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.969286919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.969286919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.969300985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.969341040 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.970448971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.970491886 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.970520973 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.970532894 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.970554113 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.970571041 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.973473072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.973517895 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.973558903 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.973582983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.973606110 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.973623037 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.974232912 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.974278927 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.974313021 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.974323988 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.974345922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.974364996 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.975231886 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.975279093 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.975315094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.975327015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.975349903 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.975368977 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.975914001 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.975956917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.975979090 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.975995064 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.976037979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.976037979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.977149010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.977197886 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.977226973 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.977243900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:20.977266073 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:20.977283955 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.072263956 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.072325945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.072474003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.072474003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.072494030 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.072539091 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.073190928 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.073234081 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.073266983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.073278904 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.073302984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.073318005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.074920893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.074966908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.074999094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.075011015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.075056076 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.075056076 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.076688051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.076744080 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.076776981 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.076793909 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.076816082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.076843977 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.078361988 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.078408003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.078444004 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.078455925 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.078478098 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.078496933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.080632925 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.080683947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.080715895 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.080728054 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.080751896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.080771923 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.081799984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.081842899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.081899881 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.081912994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.081945896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.081964970 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.083518982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.083559990 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.083756924 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.083772898 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.083935976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.167845011 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.167898893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.167948008 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.167960882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.168000937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.168021917 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.169281006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.169333935 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.169382095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.169393063 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.169421911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.169440031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.169862032 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.169903994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.169943094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.169955969 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.169982910 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.170002937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.171787977 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.171833038 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.171878099 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.171890020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.171919107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.171941042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.171942949 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.171973944 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.172003984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.172023058 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.172038078 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.172054052 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.172091007 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.172131062 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.172890902 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.172939062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.172976971 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.172988892 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.173033953 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.173033953 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.173681974 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.173724890 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.173775911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.173791885 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.173820019 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.173837900 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.174578905 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.174622059 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.174654961 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.174666882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.174691916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.174709082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.258708000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.258763075 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.258817911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.258838892 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.258883953 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.258904934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.259098053 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.259141922 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.259180069 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.259191990 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.259222031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.259241104 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.260303974 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.260366917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.260400057 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.260411978 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.260438919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.260457993 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.260941982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.260987997 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.261024952 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.261038065 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.261065006 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.261292934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.261337996 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.261394978 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.261428118 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.261440039 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.261465073 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.261507034 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.263055086 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.263101101 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.263196945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.263202906 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.263226986 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.263258934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.263272047 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.263278008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.263314009 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.263325930 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.263351917 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.263379097 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.263834000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.263880014 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.263917923 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.263930082 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.263956070 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.263981104 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.369384050 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.369436026 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.369505882 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.369573116 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.369625092 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.369647026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.370431900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.370475054 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.370513916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.370527983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.370564938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.370595932 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.372211933 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.372265100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.372307062 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.372319937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.372359037 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.372392893 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.373527050 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.373570919 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.373610973 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.373622894 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.373651981 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.373677015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.375643015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.375688076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.375724077 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.375736952 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.375766039 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.375787020 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.376805067 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.376852989 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.376883984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.376897097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.376929045 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.376950026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.378698111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.378760099 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.378799915 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.378817081 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.378849030 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.378864050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.379213095 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.379261017 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.379293919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.379307032 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.379332066 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.379353046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.461519003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.461579084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.461683989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.461703062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.461767912 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.462938070 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.463000059 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.463033915 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.463047981 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.463076115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.463118076 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.463134050 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.463187933 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.463202953 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.463217020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.463246107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.463263988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.463371992 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.463464022 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.463484049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.463501930 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.463525057 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.463543892 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.464210033 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.464257002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.464293957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.464306116 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.464339018 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.464378119 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.465265989 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.465316057 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.465334892 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.465353012 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.465377092 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.465394974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.466346025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.466392040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.466430902 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.466443062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.466490984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.466507912 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.467453003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.467494011 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.467530966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.467544079 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.467581034 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.467611074 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.562072039 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.562133074 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.562182903 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.562215090 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.562378883 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.562378883 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.562553883 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.562606096 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.562640905 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.562655926 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.562685966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.562705994 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.563999891 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.564043999 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.564080000 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.564091921 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.564120054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.564137936 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.564166069 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.564208984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.564241886 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.564254045 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.564333916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.564352036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.564997911 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.565046072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.565083027 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.565093994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.565120935 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.565138102 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.566334009 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.566378117 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.566414118 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.566426039 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.566452980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.566473007 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.567070961 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.567115068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.567150116 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.567162037 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.567187071 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.567225933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.567907095 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.567955971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.567991018 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.568002939 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.568028927 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.568048000 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.652710915 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.652782917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.652949095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.652949095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.653012991 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.653080940 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.654565096 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.654613972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.654644966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.654659986 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.654710054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.654710054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.654761076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.654814959 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.654850960 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.654864073 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.654894114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.654911995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.655745983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.655788898 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.655821085 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.655833960 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.655859947 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.655881882 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.656671047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.656728029 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.656764030 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.656775951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.656802893 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.656822920 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.658065081 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.658128023 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.658145905 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.658163071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.658186913 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.658209085 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.659069061 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.659113884 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.659138918 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.659148932 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.659176111 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.659198999 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.659946918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.659987926 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.660022020 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.660032034 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.660058022 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.660079956 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.755100012 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.755142927 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.755223036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.755242109 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.755382061 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.755382061 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.757757902 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.757797003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.757849932 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.757862091 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.757889032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.757910967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.758025885 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.758064032 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.758101940 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.758111954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.758138895 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.758174896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.759083033 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.759123087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.759160042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.759170055 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.759198904 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.759217024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.760232925 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.760271072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.760307074 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.760318041 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.760353088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.760387897 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.761321068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.761359930 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.761394024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.761404991 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.761435986 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.761470079 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.762454033 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.762494087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.762531042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.762541056 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.762571096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.762603045 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.763569117 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.763619900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.763657093 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.763667107 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.763695955 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.763719082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.850678921 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.850722075 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.850892067 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.850893021 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.850914001 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.850976944 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.854389906 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.854429960 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.854470015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.854480982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.854532003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.854556084 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.854562044 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.854588985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.854623079 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.854636908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.854671955 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.854681969 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.854711056 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.854753971 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.856760979 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.856798887 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.856837034 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.856847048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.856900930 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.857640982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.857677937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.857712030 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.857722998 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.857748032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.857767105 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.859782934 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.859823942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.859854937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.859864950 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.859894991 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.859918118 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.860275984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.860315084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.860357046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.860367060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.860390902 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.860423088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.860605955 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.860642910 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.860677958 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.860687971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.860716105 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.860739946 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.940669060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.940709114 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.940826893 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.940845013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.940867901 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.940901995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.944996119 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.945036888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.945075989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.945086002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.945127010 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.945146084 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.945622921 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.945661068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.945696115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.945705891 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.945735931 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.945760012 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.946858883 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.946897984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.946938992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.946949005 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.946975946 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.947005987 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.947088003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.947127104 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.947158098 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.947168112 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.947192907 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.947216034 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.948395967 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.948434114 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.948470116 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.948481083 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.948508024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.948530912 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.948995113 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.949043989 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.949075937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.949085951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.949115038 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.949130058 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.949832916 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.949873924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.949912071 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.949923038 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:21.949951887 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:21.949975014 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.059094906 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.059139013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.059180021 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.059197903 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.059221029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.059256077 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.063478947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.063517094 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.063566923 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.063580036 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.063623905 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.063642979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.064440966 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.064481020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.064519882 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.064531088 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.064570904 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.065094948 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.066560984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.066601992 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.066639900 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.066651106 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.066680908 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.066706896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.068228006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.068265915 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.068303108 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.068315983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.068341970 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.068361044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.069993973 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.070034027 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.070086002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.070099115 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.070135117 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.070158005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.071271896 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.071311951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.071348906 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.071361065 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.071403027 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.071430922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.074491024 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.074529886 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.074564934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.074578047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.074606895 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.074625969 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.151933908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.151977062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.152013063 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.152028084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.152076960 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.152076960 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.154455900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.154496908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.154539108 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.154548883 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.154577017 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.154608011 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.155153990 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.155191898 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.155227900 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.155237913 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.155267954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.155292988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.155900955 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.155941010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.155975103 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.155986071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.156014919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.156033039 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.156892061 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.156934977 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.156970978 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.156980991 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.157130957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.157130957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.159341097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.159410954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.159449100 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.159461021 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.159502029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.159521103 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.159842014 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.159883976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.159919024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.159929991 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.159954071 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.159992933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.160693884 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.160733938 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.160763979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.160774946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.160801888 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.160819054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.248289108 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.248332024 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.248394966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.248414993 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.248445034 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.248467922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.251620054 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.251661062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.251697063 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.251730919 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.251758099 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.251775980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.254622936 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.254662991 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.254705906 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.254766941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.254802942 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.254826069 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.256846905 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.256885052 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.257069111 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.257086039 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.257141113 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.257424116 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.257462025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.257503033 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.257514954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.257555008 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.257575035 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.261379957 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.261419058 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.261507988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.261507988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.261523008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.261576891 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.262115002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.262154102 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.262190104 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.262200117 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.262232065 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.262252092 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.263039112 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.263077021 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.263113976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.263124943 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.263150930 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.263174057 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.354960918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.355017900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.355084896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.355098009 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.355123997 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.355148077 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.355335951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.355401993 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.355422974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.355437994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.355463028 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.355487108 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.357955933 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.357996941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.358036995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.358062029 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.358095884 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.358113050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.360039949 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.360079050 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.360143900 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.360153913 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.360184908 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.360213995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.361229897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.361279964 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.361316919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.361327887 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.361351967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.361387968 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.365262985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.365303040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.365355015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.365365028 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.365396976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.365421057 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.365971088 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.366041899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.366050005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.366066933 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.366095066 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.366117954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.366832018 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.366869926 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.366906881 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.366916895 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.366940022 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.366969109 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.445322037 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.445368052 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.445442915 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.445467949 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.445497036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.445513964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.446208000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.446248055 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.446285009 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.446295023 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.446352959 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.446352959 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.449207067 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.449245930 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.449290037 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.449301004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.449323893 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.449352980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.451299906 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.451338053 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.451379061 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.451411963 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.451442957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.451527119 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.451909065 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.451947927 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.451992035 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.452003002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.452024937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.452044010 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.455928087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.455987930 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.456010103 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.456028938 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.456051111 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.456085920 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.457505941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.457547903 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.457595110 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.457606077 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.457633972 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.457650900 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.458152056 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.458209038 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.458236933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.458247900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.458271980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.458314896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.586755991 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.586817026 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.586880922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.586905003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.586935043 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.586957932 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.587860107 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.587899923 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.587934017 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.587944984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.587970972 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.587991953 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.588531017 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.588571072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.588648081 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.588658094 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.588699102 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.588715076 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.589596987 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.589679003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.590229988 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.590316057 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.590543985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.590588093 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.590624094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.590635061 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.590661049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.590693951 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.591242075 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.591280937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.591315985 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.591326952 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.591351032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.591402054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.592132092 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.592170000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.592207909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.592219114 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.592243910 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.592272043 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.592964888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.593003988 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.593034983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.593044996 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.593074083 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.593110085 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.677474976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.677535057 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.677563906 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.677593946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.677623987 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.677642107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.678337097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.678375006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.678417921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.678426981 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.678469896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.678484917 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.679311037 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.679349899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.679397106 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.679408073 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.679440022 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.679461002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.680109024 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.680147886 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.680181026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.680191040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.680234909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.680257082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.680984974 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.681022882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.681075096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.681085110 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.681119919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.681148052 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.681766033 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.681807995 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.681833982 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.681843996 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.681869984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.681905031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.682492018 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.682534933 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.682564020 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.682574034 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.682616949 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.682616949 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.683428049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.683466911 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.683562040 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.683573961 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.683623075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.768337011 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.768379927 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.768522978 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.768548965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.768573046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.768609047 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.769224882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.769263983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.769298077 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.769324064 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.769351959 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.769367933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.770172119 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.770219088 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.770251989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.770262957 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.770289898 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.770308971 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.770879030 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.770921946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.770947933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.770957947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.770987988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.771008015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.771923065 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.771967888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.772005081 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.772015095 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.772048950 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.772070885 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.772952080 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.772989988 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.773025990 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.773036003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.773062944 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.773087025 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.773128033 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.773169994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.773200989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.773211002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.773235083 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.773257971 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.774138927 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.774178982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.774214029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.774224997 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.774254084 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.774275064 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.805385113 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.858814955 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.858865976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.858901024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.858920097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.858944893 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.858967066 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.859751940 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.859792948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.859819889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.859829903 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.859853983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.859883070 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.860423088 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.860464096 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.860490084 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.860500097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.860522032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.860553026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.861560106 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.861617088 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.861644983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.861655951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.861681938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.861702919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.862313032 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.862355947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.862385988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.862396002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.862418890 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.862452984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.862915993 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.862955093 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.862982988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.862993002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.863019943 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.863038063 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.863953114 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.863992929 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.864012957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.864028931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.864054918 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.864068985 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.864767075 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.864805937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.864836931 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.864846945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.864876986 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.864893913 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.865487099 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.949821949 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.949865103 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.949901104 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.949913979 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.949963093 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.949980974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.950460911 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.950512886 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.950545073 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.950555086 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.950577021 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.950593948 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.951102972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.951143980 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.951172113 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.951183081 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.951205015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.951226950 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.952378035 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.952421904 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.952454090 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.952464104 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.952491999 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.952516079 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.952714920 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.952780008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.952805996 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.952816010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.952838898 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.952860117 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.953582048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.953624010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.953649998 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.953660011 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.953685045 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.953708887 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.954435110 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.954474926 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.954502106 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.954511881 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.954540014 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.954559088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.955178976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.955216885 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.955245018 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.955259085 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:22.955281973 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.955303907 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:22.955746889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.040663958 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.040707111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.040841103 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.040865898 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.040915966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.040915966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.041662931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.041701078 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.041737080 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.041753054 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.041780949 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.041804075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.041995049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.042033911 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.042061090 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.042072058 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.042098999 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.042117119 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.042481899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.042521000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.042546988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.042557955 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.042579889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.042604923 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.043065071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.043102026 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.043128967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.043138981 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.043162107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.043184042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.043505907 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.043545008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.043572903 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.043585062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.043612003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.043631077 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.044123888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.044162989 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.044189930 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.044200897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.044224977 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.044248104 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.044660091 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.044698954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.044719934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.044738054 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.044759989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.044784069 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.048403025 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.131510019 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.131656885 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.131803989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.131803989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.131844997 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.131902933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.132035971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.132076025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.132107019 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.132117987 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.132148027 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.132177114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.133105040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.133146048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.133181095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.133193016 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.133224010 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.133249044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.133407116 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.133449078 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.133476019 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.133486986 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.133507967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.133537054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.134407043 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.134448051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.134480953 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.134491920 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.134521008 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.134546995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.134855986 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.134912014 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.134932995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.134948015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.134972095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.134989023 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.135699034 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.135736942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.135766029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.135776043 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.135802031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.135823011 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.136276007 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.136317015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.136342049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.136352062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.136374950 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.136403084 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.222479105 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.222522020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.222634077 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.222655058 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.222830057 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.222868919 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.222909927 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.222946882 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.222963095 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.222990990 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.223009109 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.223572969 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.223613024 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.223644018 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.223654985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.223685980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.223704100 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.224287033 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.224325895 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.224358082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.224366903 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.224395037 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.224417925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.224982023 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.225022078 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.225055933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.225065947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.225121975 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.225142002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.225686073 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.225725889 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.225758076 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.225769043 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.225797892 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.225821972 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.226706028 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.226744890 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.226779938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.226790905 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.226819038 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.226846933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.227062941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.227112055 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.227144957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.227155924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.227191925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.227215052 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.313031912 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.313097954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.313163996 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.313177109 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.313203096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.313230991 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.313726902 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.313765049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.313802004 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.313812017 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.313841105 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.313879013 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.314671040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.314711094 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.314738035 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.314748049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.314786911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.314809084 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.315011978 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.315051079 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.315083981 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.315094948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.315145969 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.315145969 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.315793037 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.315834999 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.315854073 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.315869093 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.315900087 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.315963030 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.316782951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.316821098 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.316854954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.316864967 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.316891909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.316927910 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.317174911 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.317213058 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.317249060 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.317259073 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.317310095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.317342997 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.358170033 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.358211040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.358246088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.358273029 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.358303070 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.358319044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.403846979 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.403892040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.403935909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.403947115 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.404002905 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.404414892 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.404457092 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.404489040 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.404500008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.404522896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.404556036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.405198097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.405237913 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.405273914 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.405288935 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.405318975 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.405339003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.406244040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.406282902 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.406318903 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.406328917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.406352997 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.406377077 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.406728029 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.406768084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.406800985 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.406811953 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.406838894 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.406862974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.407376051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.407434940 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.407449961 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.407516003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.408204079 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.408253908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.408291101 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.408307076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.408329964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.408363104 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.449404955 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.449448109 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.449485064 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.449497938 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.449546099 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.449564934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.494560003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.494601965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.494683981 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.494702101 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.494740009 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.494777918 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.494925022 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.494962931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.495083094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.495083094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.495150089 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.495213032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.496537924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.496578932 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.496613979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.496629000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.496661901 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.496678114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.496988058 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.497028112 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.497111082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.497122049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.497167110 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.497167110 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.498075008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.498112917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.498143911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.498156071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.498184919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.498208046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.498318911 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.498358011 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.498392105 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.498402119 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.498428106 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.498446941 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.499228954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.499265909 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.499296904 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.499306917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.499438047 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.499469995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.540412903 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.540452003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.540505886 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.540518999 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.540550947 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.540568113 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.594464064 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.594501019 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.594556093 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.594593048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.594625950 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.594649076 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.596059084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.596097946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.596141100 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.596159935 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.596188068 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.596223116 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.596441031 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.596478939 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.596504927 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.596518040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.596545935 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.596573114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.596632957 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.596671104 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.596704006 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.596714020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.596740961 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.596757889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.598275900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.598314047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.598341942 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.598360062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.598386049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.598404884 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.598825932 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.598887920 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.598905087 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.598923922 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.598949909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.598969936 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.600678921 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.600718021 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.600755930 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.600771904 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.600801945 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.600820065 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.631257057 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.631299973 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.631474972 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.631527901 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.631583929 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.685276031 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.685328960 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.685370922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.685398102 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.685424089 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.685445070 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.685745955 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.685784101 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.685817003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.685827971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.685854912 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.685880899 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.686460018 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.686497927 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.686530113 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.686539888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.686569929 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.686583996 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.687378883 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.687453985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.687463999 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.687475920 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.687501907 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.687521935 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.687776089 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.687813997 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.687843084 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.687891006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.687920094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.687943935 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.688533068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.688570976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.688620090 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.688637018 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.688663006 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.688683033 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.689183950 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.689222097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.689251900 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.689263105 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.689290047 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.689308882 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.721995115 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.722034931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.722199917 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.722220898 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.722280025 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.776287079 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.776329041 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.776376009 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.776384115 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.776408911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.776434898 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.776940107 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.776998043 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.777009964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.777015924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.777059078 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.777612925 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.777652025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.777684927 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.777689934 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.777704000 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.777731895 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.778476000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.778513908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.778542042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.778547049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.778582096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.778605938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.779195070 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.779244900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.779273033 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.779278994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.779310942 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.779330969 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.779795885 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.779836893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.779867887 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.779872894 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.779898882 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.779927015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.780039072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.780078888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.780106068 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.780111074 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.780143023 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.780162096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.813713074 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.813755989 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.813853979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.813879967 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.813908100 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.813947916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.867043972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.867085934 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.867180109 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.867193937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.867244959 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.867264986 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.867618084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.867659092 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.867693901 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.867705107 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.867738962 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.867763042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.868387938 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.868426085 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.868462086 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.868472099 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.868515015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.868534088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.869164944 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.869203091 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.869235992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.869246006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.869297981 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.869585037 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.869621992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.869633913 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.869656086 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.869663000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.869694948 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.869741917 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.870675087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.870713949 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.870748997 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.870759010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.870784044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.870805979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.871228933 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.871265888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.871300936 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.871310949 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.871340036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.871381044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.909511089 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.909552097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.909616947 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.909630060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.909693956 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.909723043 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.958102942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.958142996 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.958246946 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.958259106 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.958283901 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.958304882 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.958518982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.958555937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.958590031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.958600044 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.958632946 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.958657026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.959659100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.959698915 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.959738016 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.959748030 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.959781885 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.959809065 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.959964037 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.960016012 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.960047007 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.960057974 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.960086107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.960103989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.960669994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.960710049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.960742950 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.960752964 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.960783958 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.960802078 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.961296082 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.961335897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.961371899 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.961383104 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.961407900 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.961435080 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.962091923 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.962129116 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.962181091 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.962191105 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:23.962218046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:23.962234020 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.000667095 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.000708103 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.000897884 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.000910997 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.000968933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.048640013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.048681021 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.048752069 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.048789024 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.048815966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.048837900 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.049206018 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.049247026 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.049283028 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.049293995 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.049320936 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.049352884 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.050153971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.050190926 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.050226927 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.050237894 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.050267935 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.050292015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.050405979 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.050462008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.050492048 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.050502062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.050538063 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.050556898 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.051294088 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.051332951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.051371098 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.051381111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.051433086 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.051433086 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.051914930 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.051955938 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.051990986 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.052000999 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.052031040 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.052050114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.052630901 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.052686930 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.052705050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.052731991 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.052757978 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.052776098 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.091309071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.091350079 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.091423035 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.091434002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.091485977 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.091501951 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.139362097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.139441013 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.139441013 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.139467001 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.139594078 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.140039921 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.140078068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.140115023 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.140126944 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.140157938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.140209913 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.140557051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.140609026 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.140640974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.140651941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.140680075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.140697956 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.141333103 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.141375065 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.141407013 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.141417980 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.141444921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.141469002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.141957045 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.141999006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.142030001 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.142040968 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.142083883 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.142102003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.142858982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.142899990 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.142936945 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.142949104 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.142990112 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.143012047 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.143347025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.143408060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.143414021 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.143430948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.143457890 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.143495083 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.144768953 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.181781054 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.181823015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.181859016 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.181873083 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.181900024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.181919098 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.229926109 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.229973078 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.230016947 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.230036020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.230063915 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.230079889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.230667114 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.230721951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.230873108 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.230885029 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.230937958 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.231564999 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.231606007 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.231641054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.231652021 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.231677055 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.231715918 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.231770039 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.231807947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.231834888 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.231846094 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.231867075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.231887102 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.232575893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.232615948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.232654095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.232654095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.232666969 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.232702971 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.233222961 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.233263016 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.233290911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.233302116 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.233325005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.233325005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.233350992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.233838081 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.233875990 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.233903885 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.233920097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.233942032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.233961105 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.272887945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.272929907 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.272979021 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.272989988 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.273020029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.273034096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.320652008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.320692062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.320725918 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.320738077 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.320760965 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.320784092 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.321619987 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.321671009 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.321701050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.321711063 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.321732998 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.321748972 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.321818113 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.321861982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.321892023 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.321902037 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.321944952 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.321944952 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.322455883 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.322499990 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.322527885 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.322539091 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.322561979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.322581053 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.323179960 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.323219061 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.323251963 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.323267937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.323290110 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.323307991 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.324017048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.324058056 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.324086905 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.324096918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.324122906 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.324141026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.324520111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.324563026 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.324594975 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.324605942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.324629068 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.324641943 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.363704920 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.363744020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.363782883 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.363794088 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.363822937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.363842964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.411690950 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.411747932 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.411780119 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.411792040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.411818981 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.411838055 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.411912918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.411957026 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.411976099 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.412007093 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.412035942 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.412049055 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.412595987 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.412636995 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.412826061 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.412826061 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.412838936 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.412902117 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.413443089 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.413480043 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.413507938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.413518906 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.413542032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.413561106 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.414011002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.414052963 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.414082050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.414092064 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.414113998 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.414133072 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.414630890 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.414669991 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.414696932 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.414707899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.414731026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.414752960 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.415326118 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.415429115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.415457010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.415520906 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.454153061 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.454199076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.454355001 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.454355001 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.454374075 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.454421997 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.502253056 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.502304077 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.502350092 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.502365112 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.502393007 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.502412081 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.502644062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.502687931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.502722979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.502739906 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.502764940 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.502784967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.503307104 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.503353119 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.503379107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.503405094 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.503433943 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.503459930 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.503927946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.503967047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.504019976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.504019976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.504031897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.504069090 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.504606962 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.504646063 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.504674911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.504684925 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.504708052 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.504724026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.505243063 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.505285978 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.505314112 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.505325079 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.505348921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.505362988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.505976915 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.506016970 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.506053925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.506067991 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.506097078 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.506125927 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.544958115 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.544998884 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.545031071 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.545042038 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.545123100 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.545142889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.594908953 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.594952106 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.594993114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.595004082 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.595031023 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.595053911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.595253944 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.595290899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.595339060 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.595340014 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.595351934 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.595419884 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.595860004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.595900059 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.595931053 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.595941067 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.595964909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.595985889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.596477032 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.596518040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.596544981 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.596554995 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.596580029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.596596003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.597548008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.597585917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.597619057 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.597629070 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.597655058 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.597671032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.597821951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.597876072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.597903013 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.597913027 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.597938061 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.597956896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.598510981 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.598551035 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.598578930 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.598588943 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.598609924 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.598630905 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.635842085 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.635896921 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.636053085 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.636074066 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.636127949 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.685755968 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.685796022 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.685954094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.685954094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.685967922 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.686012983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.686052084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.686090946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.686124086 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.686134100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.686157942 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.686173916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.686671019 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.686711073 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.686742067 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.686752081 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.686773062 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.686789036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.687704086 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.687742949 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.687773943 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.687783957 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.687808990 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.687822104 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.688293934 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.688333035 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.688364983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.688374996 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.688397884 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.688416004 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.688484907 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.688524961 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.688554049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.688564062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.688587904 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.688606024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.689609051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.689665079 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.689676046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.689692974 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.689718008 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.689732075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.726476908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.726519108 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.726547003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.726558924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.726581097 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.726598978 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.776257038 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.776299953 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.776335001 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.776349068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.776376963 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.776391983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.776751041 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.776792049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.776878119 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.776878119 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.776890039 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.776941061 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.777527094 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.777566910 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.777611971 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.777621984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.777647972 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.777666092 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.778112888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.778156996 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.778179884 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.778194904 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.778218031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.778234005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.778862000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.778901100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.778935909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.778944969 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.778970957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.778985023 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.779033899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.779074907 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.779092073 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.779123068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.779150963 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.779165030 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.779997110 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.780050039 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.780076027 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.780086994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.780107021 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.780122995 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.817011118 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.817054033 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.817086935 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.817106962 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.817135096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.817152977 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.867252111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.867295980 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.867332935 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.867360115 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.867402077 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.867402077 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.867733955 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.867773056 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.867813110 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.867829084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.867851973 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.867872000 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.868364096 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.868402004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.868438005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.868448973 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.868473053 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.868489027 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.869237900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.869280100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.869318962 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.869328976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.869354010 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.869396925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.869786978 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.869824886 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.869858027 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.869868040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.869894028 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.869910002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.870192051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.870230913 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.870260000 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.870270014 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.870332003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.870332956 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.871049881 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.871144056 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.871177912 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.871184111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.871201038 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.871217966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.910612106 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.910650969 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.910676003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.910685062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.910701036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.910727978 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.957700014 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.957741022 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.957818031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.957840919 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.957864046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.957880974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.958287954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.958343983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.958358049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.958374977 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.958395958 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.958415031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.959141970 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.959181070 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.959206104 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.959216118 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.959235907 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.959253073 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.959402084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.959460020 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.959461927 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.959490061 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.959508896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.959528923 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.960176945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.960216999 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.960232973 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.960248947 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.960272074 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.960273027 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.960297108 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.960599899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.960647106 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.960675001 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.960690022 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.960711002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.960726976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.961421967 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.961461067 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.961489916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.961499929 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:24.961519957 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:24.961539984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.001243114 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.001286983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.001343966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.001359940 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.001385927 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.001405954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.048230886 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.048270941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.048326015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.048338890 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.048372030 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.048376083 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.048945904 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.048989058 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.049014091 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.049031973 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.049057007 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.049072027 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.049489021 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.049529076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.049542904 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.049561024 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.049582005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.049597979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.050585985 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.050623894 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.050649881 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.050661087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.050683975 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.050704002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.050986052 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.051024914 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.051068068 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.051068068 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.051079988 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.051120996 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.051172972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.051212072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.051253080 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.051253080 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.051265001 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.051302910 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.052120924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.052160025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.052181005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.052211046 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.052237988 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.052252054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.092010975 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.092052937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.092113972 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.092125893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.092154026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.092169046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.138951063 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.138993025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.139044046 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.139054060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.139098883 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.139098883 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.139583111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.139621973 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.139657974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.139698029 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.139736891 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.140177965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.140218973 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.140247107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.140256882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.140280008 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.140280008 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.140302896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.140847921 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.140888929 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.140921116 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.140930891 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.140954971 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.140974045 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.141612053 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.141663074 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.141695023 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.141705990 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.141731024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.141745090 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.141820908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.141860962 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.141889095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.141900063 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.141922951 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.141938925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.142906904 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.142951965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.142982006 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.142992020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.143013954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.143013954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.143035889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.182917118 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.182965040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.183012962 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.183031082 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.183060884 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.183080912 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.230034113 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.230076075 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.230117083 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.230135918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.230173111 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.230729103 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.230777979 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.230796099 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.230813026 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.230840921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.230875015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.231215954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.231254101 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.231286049 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.231297970 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.231318951 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.231334925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.231489897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.231532097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.231566906 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.231583118 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.231609106 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.231622934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.232568979 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.232610941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.232644081 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.232654095 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.232677937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.232700109 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.233156919 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.233196020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.233230114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.233239889 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.233263969 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.233285904 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.234153032 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.234189987 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.234230042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.234240055 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.234266043 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.234287024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.274060965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.274107933 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.274163961 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.274188042 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.274216890 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.274235964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.320770025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.320811987 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.320859909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.320879936 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.320905924 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.320924044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.321235895 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.321274042 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.321306944 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.321316957 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.321345091 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.321368933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.321919918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.321962118 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.321990013 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.322020054 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.322042942 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.322061062 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.322613955 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.322664976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.322684050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.322695017 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.322726965 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.322741032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.322911978 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.322954893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.322983980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.322993994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.323015928 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.323031902 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.323803902 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.323846102 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.323884964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.323884964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.323896885 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.323936939 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.324594021 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.324632883 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.324723005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.324733019 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.324754953 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.324770927 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.364139080 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.364181042 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.364221096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.364236116 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.364263058 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.364281893 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.411570072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.411614895 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.411663055 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.411684990 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.411709070 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.411982059 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.412029028 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.412039042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.412060976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.412091017 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.412108898 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.412633896 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.412673950 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.412702084 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.412712097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.412734032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.413506031 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.413549900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.413597107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.413609028 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.413638115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.413692951 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.413731098 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.413750887 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.413769007 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.413790941 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.413790941 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.413815975 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.414804935 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.414844990 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.414880037 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.414890051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.414916992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.415205002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.415251970 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.415267944 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.415282965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.415311098 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.415328979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.436961889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.455077887 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.455122948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.455195904 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.455225945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.455250978 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.455269098 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.502315998 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.502357960 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.502420902 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.502435923 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.502465963 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.502466917 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.502937078 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.502978086 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.503005028 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.503015041 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.503041983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.503061056 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.503988028 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.504040003 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.504071951 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.504082918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.504103899 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.504122019 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.504177094 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.504220009 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.504236937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.504261017 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.504262924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.504272938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.504303932 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.504776955 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.504815102 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.504834890 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.504849911 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.504873037 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.504892111 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.505645037 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.505712032 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.505732059 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.505747080 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.505770922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.505770922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.505795002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.506190062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.506228924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.506258011 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.506268978 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.506292105 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.506308079 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.506586075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.545605898 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.545645952 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.545701981 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.545743942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.545773029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.545794964 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.593096018 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.593151093 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.593189955 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.593225002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.593250990 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.593523026 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.593569040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.593584061 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.593596935 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.593631029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.593650103 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.594515085 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.594556093 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.594571114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.594588041 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.594610929 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.594628096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.595573902 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.595618010 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.595635891 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.595654011 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.595674992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.595694065 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.596029997 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.596071005 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.596086979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.596103907 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.596131086 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.596144915 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.597259045 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.597297907 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.597327948 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.597340107 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.597368002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.597387075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.597403049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.597443104 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.597459078 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.597475052 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.597496033 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.597512007 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.702930927 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.702980042 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.703027010 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.703067064 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.703099966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.703635931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.703700066 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.703711987 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.703732967 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.703757048 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.703780890 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.704354048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.704404116 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.704432011 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.704443932 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.704466105 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.704482079 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.705035925 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.705079079 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.705096960 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.705113888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.705137014 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.705509901 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.705554008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.705568075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.705584049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.705606937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.705651045 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.706314087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.706355095 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.706393003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.706409931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.706437111 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.706454992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.706851959 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.706888914 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.706919909 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.706931114 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.706954956 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.707556963 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.707600117 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.707664967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.707680941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.707706928 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.709958076 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.793849945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.793889046 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.793930054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.793946028 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.793973923 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.794182062 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.794598103 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.794640064 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.794672966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.794683933 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.794706106 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.794771910 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.795447111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.795485973 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.795519114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.795547009 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.795576096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.795589924 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.796149015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.796186924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.796219110 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.796230078 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.796253920 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.796272993 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.796493053 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.796538115 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.796556950 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.796571970 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.796597958 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.796696901 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.796916008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.796956062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.796988010 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.796998024 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.797043085 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.797043085 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.797760963 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.797797918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.797828913 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.797838926 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.797868013 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.797885895 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.798401117 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.798439980 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.798472881 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.798484087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.798510075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.798583031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.884314060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.884335995 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.884428024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.884448051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.884572029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.885242939 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.885270119 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.885330915 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.885344028 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.885422945 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.885957956 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.885974884 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.886028051 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.886039019 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.886131048 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.886440992 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.886459112 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.886514902 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.886526108 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.886604071 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.887248993 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.887265921 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.887319088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.887331009 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.887471914 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.887950897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.887970924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.888014078 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.888027906 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.888117075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.888562918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.888580084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.888624907 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.888637066 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.888662100 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.888679028 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.889060020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.889076948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.889111042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.889122009 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.889148951 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.889256954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.976160049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.976201057 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.976239920 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.976254940 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.976278067 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.976929903 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.976975918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.977005005 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.977015972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.977046967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.977849007 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.977886915 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.977924109 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.977936029 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.977967024 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.977994919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.978626966 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.978667021 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.978701115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.978712082 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.978734970 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.979298115 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.979341984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.979374886 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.979403019 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.979433060 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.980247974 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.980287075 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.980329037 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.980340958 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.980367899 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.980386972 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.980889082 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.980931044 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.980959892 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.980969906 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.980995893 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.981019974 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.981081963 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.981123924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.981148958 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.981158972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:25.981184006 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:25.981935978 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.066098928 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.066152096 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.066180944 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.066210032 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.066234112 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.066252947 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.066760063 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.066801071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.066828966 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.066840887 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.066864967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.066942930 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.067354918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.067425013 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.067439079 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.067509890 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.068074942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.068114042 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.068140984 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.068150997 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.068176985 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.068177938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.068197012 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.068658113 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.068696976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.068731070 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.068741083 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.068826914 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.068845034 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.069420099 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.069458008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.069510937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.069520950 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.069550991 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.069574118 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.070162058 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.070204020 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.070244074 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.070254087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.070276976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.070295095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.070769072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.070815086 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.070833921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.070848942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.070872068 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.070889950 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.295358896 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.295440912 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.295448065 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.295478106 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.295504093 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.295525074 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.295800924 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.295841932 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.295876980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.295893908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.295970917 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.295989990 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.296297073 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.296339035 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.296367884 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.296379089 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.296417952 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.296417952 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.296827078 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.296869993 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.296899080 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.296909094 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.296933889 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.296951056 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.297826052 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.297864914 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.297899961 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.297914982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.297936916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.297956944 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.298862934 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.298903942 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.298934937 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.298945904 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.298970938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.298993111 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.299061060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.299102068 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.299129963 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.299139977 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.299161911 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.299180031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.299771070 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.299860001 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.299863100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.299889088 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.299921036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.299937010 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.300725937 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.300766945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.300782919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.300798893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.300822973 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.300842047 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.300931931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.300976038 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.301002979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.301018000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.301042080 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.301078081 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.301348925 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.301388025 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.301418066 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.301428080 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.301453114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.301474094 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.301940918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.302007914 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.302032948 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.302098036 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.302963972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.303008080 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.303026915 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.303041935 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.303065062 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.303082943 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.303142071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.303181887 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.303199053 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.303215027 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.303236961 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.303275108 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.303883076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.303925037 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.303956985 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.303967953 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.303987980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.304007053 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.304302931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.304344893 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.304373026 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.304382086 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.304410934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.304425955 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.343837976 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.343878984 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.344024897 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.344043970 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.344099045 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.345083952 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.345122099 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.345155954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.345166922 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.345191002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.345206976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.346330881 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.346368074 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.346421003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.346431017 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.346462011 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.346462011 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.347639084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.347677946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.347708941 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.347718954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.347739935 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.347773075 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.348193884 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.348232031 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.348264933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.348279953 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.348301888 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.348320007 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.348819017 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.348855972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.348887920 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.348897934 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.348923922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.348958969 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.350879908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.350931883 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.350966930 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.350976944 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.351003885 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.351022959 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.351331949 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.351372004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.351428032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.351428032 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.351440907 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.351506948 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.435152054 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.435190916 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.435242891 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.435256004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.435281992 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.435298920 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.437711000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.437751055 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.437778950 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.437789917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.437813044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.437832117 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.438318968 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.438357115 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.438383102 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.438393116 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.438416958 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.438432932 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.438821077 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.438877106 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.438890934 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.438905954 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.438932896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.438947916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.439445972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.439483881 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.439512968 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.439522982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.439548969 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.439567089 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.440418959 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.440457106 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.440485954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.440512896 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.440541029 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.440555096 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.442337036 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.442378044 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.442409039 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.442419052 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.442447901 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.442461967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.442878008 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.442918062 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.442949057 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.442959070 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.442986965 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.443002939 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.574352980 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.574394941 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.574547052 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.574548006 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.574570894 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.574630976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.574760914 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.574826002 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.574836016 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.574862957 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.574892044 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.574909925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.575193882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.575232983 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.575251102 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.575265884 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.575288057 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.575309038 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.576019049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.576057911 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.576087952 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.576097965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.576124907 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.576143980 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.576904058 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.576973915 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.576983929 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.577007055 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.577034950 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.577054977 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.577188015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.577233076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.577261925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.577276945 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.577302933 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.577322006 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.577914000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.577955961 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.577984095 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.577994108 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.578016996 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.578044891 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.578155994 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.578196049 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.578223944 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.578233957 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.578254938 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.578275919 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.664865971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.664910078 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.664958000 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.664980888 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.665010929 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.665024042 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.665282965 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.665323019 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.665355921 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.665365934 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.665390968 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.665409088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.666008949 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.666049004 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.666081905 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.666093111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.666119099 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.666156054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.666749001 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.666786909 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.666817904 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.666827917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.666853905 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.666877031 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.667098045 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.667136908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.667170048 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.667181015 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.667207003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.667226076 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.667855024 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.667896032 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.667932034 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.667942047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.667967081 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.667985916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.668543100 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.668581009 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.668612003 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.668622017 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.668647051 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.668663979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.669183969 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.669225931 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.669254065 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.669264078 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.669290066 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.669290066 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.669316053 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.755731106 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.755772114 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.755846977 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.755873919 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.755901098 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.755923986 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.756381035 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.756419897 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.756450891 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.756463051 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.756510019 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.756510019 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.756891966 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.756932974 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.756963015 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.756973028 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.756995916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.757013083 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.757267952 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.757306099 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.757334948 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.757344961 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.757368088 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.757388115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.757875919 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.757929087 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.757956982 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.757966995 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.757996082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.757996082 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.758016109 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.758651972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.758691072 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.758718014 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.758728981 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.758755922 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.758769989 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.759515047 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.759552956 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.759584904 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.759594917 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.759620905 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.759634972 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.759651899 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.759691000 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.759721041 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.759731054 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.759754896 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.759768963 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.846260071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.846299887 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.846357107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.846369982 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.846400976 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.846420050 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.846843958 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.846880913 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.846918106 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.846927881 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.846954107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.846972942 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.847259998 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.847301006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.847330093 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.847340107 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.847363949 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.847379923 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.847657919 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.847697973 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.847724915 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.847735882 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.847760916 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.847774982 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.848691940 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.848731995 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.848758936 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.848769903 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.848793983 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.848813057 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.849412918 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.849450111 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.849478960 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.849488974 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.849509954 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.849528074 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.849590063 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.849631071 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.849658012 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.849668026 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.849693060 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.849735022 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.850339890 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.850379944 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.850414991 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.850425005 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.850452900 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.850466967 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.936866999 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.936912060 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.936944962 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.936964035 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.936988115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.937007904 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.937535048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.937577009 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.937608004 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.937618971 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.937642097 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.937661886 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.938066006 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.938103914 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.938132048 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.938142061 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.938165903 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.938182116 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.938574076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.938625097 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.938649893 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.938661098 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.938684940 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.938703060 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.939117908 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.939157963 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.939188004 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.939198017 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.939219952 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.939235926 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.939671040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.939728022 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.939738035 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.939749002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.939778090 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.939796925 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.940433979 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.940474033 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.940502882 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.940512896 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.940537930 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.940551996 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.940582037 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.940623999 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.940640926 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.940656900 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:26.940680027 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:26.940700054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.027729988 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.027776957 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.027874947 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.027892113 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.027923107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.027923107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.028181076 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.028222084 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.028249979 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.028260946 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.028314114 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.028315067 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.028785944 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.028825045 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.028857946 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.028867960 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.028906107 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.028928041 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.029237986 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.029278040 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.029309034 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.029319048 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.029340982 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.029369116 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.029742002 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.029812098 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.029824972 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.029885054 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.029896975 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.029988050 CEST	443	49768	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.030039072 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.030141115 CEST	49768	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.214782953 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.214874983 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.214967012 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.215282917 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.215307951 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.775186062 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.776698112 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.776758909 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.894844055 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.895143986 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.895230055 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.895335913 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.895371914 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.895421028 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.895430088 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.895462990 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.895637989 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.895762920 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.895811081 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.895843983 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.896497965 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.896553993 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.896569014 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.899800062 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.900017023 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.900078058 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.943604946 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.981880903 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.982059956 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.982130051 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.982155085 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.982182026 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.982229948 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.982287884 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.982729912 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.982779980 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.982810020 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.983262062 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.983313084 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.983328104 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.983490944 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.983541965 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.983556032 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.984076023 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.984133959 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.984147072 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.984239101 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.984287977 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.984302998 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.984401941 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.984457970 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.984471083 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.985018015 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.985073090 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.985085011 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.985174894 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.985228062 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.985240936 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.985817909 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:27.985878944 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:27.985892057 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.037297010 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.037358046 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069133043 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069221973 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069293022 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.069312096 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069339037 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069365978 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.069492102 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069511890 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069554090 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.069595098 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069626093 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069628000 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.069681883 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.069696903 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069755077 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.069767952 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069792032 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069843054 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.069855928 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069885015 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.069931030 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.069931030 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.069947004 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.070235968 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.070322037 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.070386887 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.070388079 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.070420027 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.070446968 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.070477962 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.070508957 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.070580959 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.070640087 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.070708990 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.070772886 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.070853949 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.070910931 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.071082115 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.071149111 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.071261883 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.071332932 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.071459055 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.071520090 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.156014919 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.156164885 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.156217098 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.156234980 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.156260014 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.156267881 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.156291008 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.156316042 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.156487942 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.156558037 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.156651974 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.156651974 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.156716108 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.156795979 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.156822920 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.156883001 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.157170057 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.157231092 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.157279968 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.157341957 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.157375097 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.157454014 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.157515049 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.157573938 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.157622099 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.157691002 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.157715082 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.157782078 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.157824039 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.157895088 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.158015966 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.158101082 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.158108950 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.158133030 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.158186913 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.158349991 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.158416033 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.158436060 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.158503056 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.158621073 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.158682108 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.158778906 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.158845901 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.159049034 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.159112930 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.159148932 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.159208059 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.159243107 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.159307957 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.160892010 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.160959005 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.161012888 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.161071062 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.200149059 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.200331926 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.200392962 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.200462103 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.242961884 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.243002892 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.243278027 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.243278980 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.243343115 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.243441105 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.243582010 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.243619919 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.243752956 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.243752956 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.243870020 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.243937016 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.244225025 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.244263887 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.244407892 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.244409084 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.244472980 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.244530916 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.244896889 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.244940996 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.244985104 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.245001078 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.245027065 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.245047092 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.245160103 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.245198965 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.245234966 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.245249033 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.245285034 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.245301962 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.246130943 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.246169090 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.246207952 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.246226072 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.246251106 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.246267080 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.246270895 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.246290922 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.246320963 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.246340990 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.246345997 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.246365070 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.246393919 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.246417999 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.522670031 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.522690058 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.522783041 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.522845984 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.522931099 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.523247957 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.523288012 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.523427010 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.523427963 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.523493052 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.523566008 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.523869991 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.523910999 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.524003029 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.524003029 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.524099112 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.524168968 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.524600983 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.524640083 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.524743080 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.524796963 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.524796963 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.524862051 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.524919033 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.525522947 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.525563002 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.525593042 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.525656939 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.525696039 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.526490927 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.526535034 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.526556969 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.526576996 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.526607037 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.526662111 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.526700974 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.526719093 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.526738882 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.526763916 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.527477026 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.527522087 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.527549982 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.527581930 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.527617931 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.528376102 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.528413057 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.528436899 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.528454065 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.528481007 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.528542995 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.528593063 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.528599977 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.528620958 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.528651953 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.529439926 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.529479027 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.529509068 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.529522896 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.529551983 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.529656887 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.529704094 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.529723883 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.529742002 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.529769897 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.530376911 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.530416012 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.530450106 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.530462980 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.530492067 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.530702114 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.530747890 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.530771017 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.530782938 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.530811071 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.531500101 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.531550884 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.531582117 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.531594992 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.531622887 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.531681061 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.531725883 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.531740904 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.531761885 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.531786919 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.532411098 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.532448053 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.532483101 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.532510042 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.532540083 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.532576084 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.532620907 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.532628059 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.532648087 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.532681942 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.533315897 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.533353090 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.533375025 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.533391953 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.533417940 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.533480883 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.533524990 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.533548117 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.533565044 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.533591032 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.534264088 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.534302950 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.534339905 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.534357071 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.534383059 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.534404039 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.534447908 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.534468889 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.534486055 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.534511089 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.535121918 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.535159111 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.535190105 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.535222054 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.535249949 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.584403992 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.590137005 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.590178967 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.590338945 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.590338945 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.590403080 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.590472937 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.590821981 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.590859890 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.591001034 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.591001987 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.591001987 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.591056108 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.591063023 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.591120005 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.591626883 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.591670036 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.591706038 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.591767073 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.591810942 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.592262983 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.592313051 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.592427969 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.592426062 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.592426062 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.592467070 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.592492104 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.592494011 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.592525005 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.592550039 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.592998981 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.593051910 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.593091011 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.593127966 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.593163013 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.593184948 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.593671083 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.593713999 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.593743086 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.593755960 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.593780994 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.593801022 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.677696943 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.677759886 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.677874088 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.677874088 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.677938938 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.677994013 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.678153038 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.678193092 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.678358078 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.678359032 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.678422928 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.678514957 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.680254936 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.680299044 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.680332899 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.680398941 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.680435896 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.680457115 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.680615902 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.680660009 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.680695057 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.680707932 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.680731058 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.680767059 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.681344032 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.681385994 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.681415081 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.681430101 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.681457996 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.681477070 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.681742907 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.681786060 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.681818008 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.681828976 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.681874990 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.681874990 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.682295084 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.682338953 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.682368994 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.682379961 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.682411909 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.682430983 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.682642937 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.682684898 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.682715893 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.682727098 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.682754040 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.682771921 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.764705896 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.764750004 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.764858007 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.764889002 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.765110970 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.765110970 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.765114069 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.765142918 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.765172005 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.765187979 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.765202999 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.765223980 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.765244007 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.765269041 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.767019987 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.767061949 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.767086983 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.767095089 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.767112017 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.767134905 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.767640114 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.767682076 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.767708063 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.767714977 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.767734051 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.767750978 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.768105984 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.768147945 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.768176079 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.768183947 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.768204927 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.768228054 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.768656015 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.768711090 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.768734932 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.768744946 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.768763065 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.768786907 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.769150972 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.769196033 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.769222975 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.769229889 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.769249916 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.769268036 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.769601107 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.769649029 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.769665956 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.769675970 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.769690037 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.769716978 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.851579905 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.851622105 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.851793051 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.851814032 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.851814985 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.851878881 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.851932049 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.853807926 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.853844881 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.853986025 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.853986025 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.854053974 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.854430914 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.854476929 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.854598045 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.854598045 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.854664087 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.854866028 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.854904890 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.854939938 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.854959011 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.854984999 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.855325937 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.855372906 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.855406046 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.855424881 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.855454922 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.855863094 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.855902910 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.855940104 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.855958939 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.855984926 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.856482029 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.856528997 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.856547117 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.856565952 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.856591940 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.896867990 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.938540936 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.938581944 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.938750982 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.938750982 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.938817024 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.938880920 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.938903093 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.938942909 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.938975096 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.938997030 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.939023018 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.939049959 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.941104889 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.941144943 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.941184998 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.941198111 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.941226959 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.941248894 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.941587925 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.941627026 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.941664934 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.941678047 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.941711903 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.941730022 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.941910982 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.941966057 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.942001104 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.942013025 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.942043066 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.942061901 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.942298889 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.942341089 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.942375898 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.942389965 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.942420959 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.942439079 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.942740917 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.942781925 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.942816973 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.942833900 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.942859888 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.942878962 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.943042994 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.943083048 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.943118095 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.943129063 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:28.943154097 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:28.943172932 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.025501966 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.025541067 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.025656939 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.025657892 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.025722027 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.025782108 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.025913000 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.025959015 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.026078939 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.026078939 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.026144028 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.026242018 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.027961016 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.028031111 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.028028011 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.028096914 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.028135061 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.028157949 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.028405905 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.028444052 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.028606892 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.028608084 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.028671980 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.028738976 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.028739929 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.028764963 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.028796911 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.028814077 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.028820992 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.028839111 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.028866053 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.028891087 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.029143095 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.029184103 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.029213905 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.029230118 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.029257059 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.029274940 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.029743910 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.029783964 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.029822111 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.029839993 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.029867887 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.029882908 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.030268908 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.030308962 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.030348063 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.030365944 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.030390978 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.030407906 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.112989902 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.113038063 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.113199949 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.113198042 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.113281965 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.113342047 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.113367081 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.115051985 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.115091085 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.115243912 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.115243912 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.115308046 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.115458012 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.115520954 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.115648031 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.115648985 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.115715027 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.115856886 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.115895987 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.115912914 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.115938902 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.115972042 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.116195917 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.116242886 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.116277933 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.116291046 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.116314888 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.117434025 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.117472887 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.117502928 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.117516994 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.117542028 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.117707014 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.117750883 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.117763996 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.117789984 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.117819071 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.162421942 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.200011015 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.200052023 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.200181961 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.200182915 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.200246096 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.200292110 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.200309992 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.200331926 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.200362921 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.200381041 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.200412989 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.200423002 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.200452089 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.200467110 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.201636076 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.201687098 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.201786041 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.201786041 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.201849937 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.201909065 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.202625036 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.202662945 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.202760935 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.202809095 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.202809095 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.202873945 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.202928066 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.203315020 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.203353882 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.203372002 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.203396082 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.203450918 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.203624964 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.203671932 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.203697920 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.203711033 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.203741074 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.204282999 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.204322100 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.204351902 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.204366922 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.204399109 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.256118059 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.287234068 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.287273884 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.287444115 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.287444115 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.287508011 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.287575960 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.287642956 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.287684917 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.287725925 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.287746906 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.287772894 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.287791014 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.288496017 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.288548946 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.288685083 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.288685083 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.288784027 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.288847923 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.289082050 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.289127111 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.289267063 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.289268017 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.289333105 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.289390087 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.289573908 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.289618015 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.289654970 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.289669037 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.289695024 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.289714098 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.290241957 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.290282011 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.290312052 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.290326118 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.290359020 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.290373087 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.290632963 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.290673971 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.290709972 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.290726900 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.290754080 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.290772915 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.291059017 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.291100979 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.291126013 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.291136980 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.291168928 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.291188955 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.373675108 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.373717070 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.373883009 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.373883009 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.373946905 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.373986959 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.374006033 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.374027014 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.374052048 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.374058008 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.374075890 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.374094963 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.374151945 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.374151945 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.375571012 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.375612020 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.375751972 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.375751972 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.375814915 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.375874043 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.375879049 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.375905991 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.375935078 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.375951052 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.375953913 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.375989914 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.376023054 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.376045942 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.376292944 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.376332998 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.376396894 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.376398087 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.376461029 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.376543045 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.376846075 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.376885891 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.376920938 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.376943111 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.376970053 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.376990080 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.378065109 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.378104925 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.378139019 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.378150940 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.378179073 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.378200054 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.378452063 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.378492117 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.378526926 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.378544092 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.378567934 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.378592968 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.460741043 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.460783005 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.460928917 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.460998058 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.461066008 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.461078882 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.461132050 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.461138010 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.461174965 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.461190939 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.461220026 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.462460995 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.462505102 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.462553978 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.462620020 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.462656975 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.462708950 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.462898970 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.462940931 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.462975025 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.462996006 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.463025093 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.463040113 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.463309050 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.463351011 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.463382006 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.463418961 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.463455915 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.463455915 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.463845968 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.463887930 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.463924885 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.463937044 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.463964939 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.463982105 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.464624882 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.464664936 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.464701891 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.464713097 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.464739084 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.465305090 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.465353966 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.465389967 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.465403080 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.465431929 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.465445995 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.547574997 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.547616005 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.547777891 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.547777891 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.547842979 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.547930956 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.548162937 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.548202038 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.548360109 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.548361063 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.548455954 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.548536062 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.548978090 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.549117088 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.549179077 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.549405098 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.549443960 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.549491882 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.549514055 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.549541950 CEST	49769	443	192.168.2.4	104.16.148.130
Sep 22, 2024 19:39:29.549851894 CEST	443	49769	104.16.148.130	192.168.2.4
Sep 22, 2024 19:39:29.549890995 CEST	443	49769	104.16.148.130	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 22, 2024 19:38:46.455199003 CEST	192.168.2.4	1.1.1.1	0x83c8	Standard query (0)	geo.lavasoft.com	A (IP address)	IN (0x0001)	false
Sep 22, 2024 19:38:48.115080118 CEST	192.168.2.4	1.1.1.1	0x1777	Standard query (0)	featureflags.lavasoft.com	A (IP address)	IN (0x0001)	false
Sep 22, 2024 19:38:49.422056913 CEST	192.168.2.4	1.1.1.1	0xe17	Standard query (0)	flwadw.com	A (IP address)	IN (0x0001)	false
Sep 22, 2024 19:39:09.335370064 CEST	192.168.2.4	1.1.1.1	0xd999	Standard query (0)	wcdownloadercdn.lavasoft.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 22, 2024 19:38:46.465076923 CEST	1.1.1.1	192.168.2.4	0x83c8	No error (0)	geo.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Sep 22, 2024 19:38:46.465076923 CEST	1.1.1.1	192.168.2.4	0x83c8	No error (0)	geo.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Sep 22, 2024 19:38:48.226912022 CEST	1.1.1.1	192.168.2.4	0x1777	No error (0)	featureflags.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Sep 22, 2024 19:38:48.226912022 CEST	1.1.1.1	192.168.2.4	0x1777	No error (0)	featureflags.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Sep 22, 2024 19:38:49.433538914 CEST	1.1.1.1	192.168.2.4	0xe17	No error (0)	flwadw.com	104.18.27.149	A (IP address)	IN (0x0001)	false
Sep 22, 2024 19:38:49.433538914 CEST	1.1.1.1	192.168.2.4	0xe17	No error (0)	flwadw.com	104.18.26.149	A (IP address)	IN (0x0001)	false
Sep 22, 2024 19:39:09.376140118 CEST	1.1.1.1	192.168.2.4	0xd999	No error (0)	wcdownloadercdn.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Sep 22, 2024 19:39:09.376140118 CEST	1.1.1.1	192.168.2.4	0xd999	No error (0)	wcdownloadercdn.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	104.16.149.130	80	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
Sep 22, 2024 19:38:46.475716114 CEST	66	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com Connection: Keep-Alive
Sep 22, 2024 19:38:48.000273943 CEST	310	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:46 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412130df67d1e-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Sep 22, 2024 19:38:48.000793934 CEST	310	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:46 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412130df67d1e-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Sep 22, 2024 19:38:48.001279116 CEST	310	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:46 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412130df67d1e-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Sep 22, 2024 19:38:48.001521111 CEST	310	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:46 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412130df67d1e-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Sep 22, 2024 19:39:06.506990910 CEST	42	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com
Sep 22, 2024 19:39:06.649710894 CEST	310	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:06 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74128df8af7d1e-EWR Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.16.149.130	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:38:49 UTC	143	OUT	POST /api/feature/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 194 Connection: Keep-Alive
2024-09-22 17:38:49 UTC	194	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 31 35 35 31 35 39 34 35 34 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 30 39 32 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 69 6e 73 74 61 6c 6c 65 72 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 66 65 61 74 75 72 65 77 70 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 7d Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"21551594541","InstallDate":"20240922","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
2024-09-22 17:38:49 UTC	249	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:49 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412217b294340-EWR
2024-09-22 17:38:49 UTC	884	IN	Data Raw: 33 36 64 0d 0a 5b 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 49 63 6f 6e 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 5c 22 2c 20 5c 22 41 70 70 4e 61 6d 65 5c 22 3a 20 5c 22 57 65 62 20 43 6f 6d 70 61 6e 69 6f 6e 5c 22 2c 20 5c 22 53 65 74 74 69 6e 67 73 5c 22 3a 20 5b 5c 22 57 43 41 75 74 6f 55 70 64 61 74 65 5c 22 2c 20 5c 22 45 6e 61 62 6c 65 47 72 61 6e 75 6c 61 72 69 74 79 5c 22 2c 20 5c 22 50 6f 73 74 52 75 6e 56 32 41 63 74 69 6f 6e 5c 22 2c 20 5c 22 50 6f 73 74 52 75 6e 54 69 6d 65 72 41 63 74 69 6f 6e 5c 22 2c 20 5c 22 45 6e 61 Data Ascii: 36d[{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"Ena
2024-09-22 17:38:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:38:49 UTC	166	OUT	POST /v1/event-stat?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 447 Connection: Keep-Alive
2024-09-22 17:38:49 UTC	447	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 54 72 69 67 67 65 72 22 3a 20 22 69 6e 73 74 61 6c 6c 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "Trigger": "install", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId"
2024-09-22 17:38:50 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:50 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412267f738c0f-EWR
2024-09-22 17:38:50 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:38:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:38:50 UTC	145	OUT	POST /v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 398
2024-09-22 17:38:50 UTC	398	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 54 72 69 67 67 65 72 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","Trigger":"install","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402"
2024-09-22 17:38:50 UTC	235	IN	HTTP/1.1 400 Bad Request Date: Sun, 22 Sep 2024 17:38:50 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74122b29dfc404-EWR
2024-09-22 17:38:50 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 49 6e 76 61 6c 69 64 20 66 6f 72 6d 61 74 2f 64 61 74 61 22 7d 0d 0a Data Ascii: 21{"message":"Invalid format/data"}
2024-09-22 17:38:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:38:51 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 508
2024-09-22 17:38:51 UTC	508	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-09-22 17:38:51 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:51 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74122f48395e71-EWR
2024-09-22 17:38:51 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:38:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:38:52 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 646
2024-09-22 17:38:52 UTC	646	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 31 35 35 31 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"21551
2024-09-22 17:38:52 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:52 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412347c3717e5-EWR
2024-09-22 17:38:52 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:38:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:38:56 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 515
2024-09-22 17:38:56 UTC	515	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-09-22 17:38:56 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:56 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74124fba37236a-EWR
2024-09-22 17:38:56 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:38:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:38:57 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 482
2024-09-22 17:38:57 UTC	482	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 31 35 35 31 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"21551
2024-09-22 17:38:57 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:57 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412541edc7d08-EWR
2024-09-22 17:38:57 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:38:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:38:57 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 515
2024-09-22 17:38:57 UTC	515	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-09-22 17:38:58 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:57 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c741258397319df-EWR
2024-09-22 17:38:58 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:38:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49743	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:38:58 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 488
2024-09-22 17:38:58 UTC	488	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 31 35 35 31 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"21551
2024-09-22 17:38:58 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:58 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74125ccb2f334e-EWR
2024-09-22 17:38:58 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:38:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:38:59 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 527
2024-09-22 17:38:59 UTC	527	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-09-22 17:38:59 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:38:59 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412612d1c7cfc-EWR
2024-09-22 17:38:59 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:38:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:00 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 466
2024-09-22 17:39:00 UTC	466	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 31 35 35 31 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"21551
2024-09-22 17:39:00 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:00 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412668d6f8ccc-EWR
2024-09-22 17:39:00 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49748	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:00 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 527
2024-09-22 17:39:00 UTC	527	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-09-22 17:39:00 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:00 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74126a8d950f9c-EWR
2024-09-22 17:39:00 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49750	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:01 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 458
2024-09-22 17:39:01 UTC	458	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 31 35 35 31 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"21551
2024-09-22 17:39:01 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:01 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74126f086f0f5b-EWR
2024-09-22 17:39:01 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:02 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 520
2024-09-22 17:39:02 UTC	520	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-09-22 17:39:02 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:02 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412737af680dc-EWR
2024-09-22 17:39:02 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49756	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:02 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 460
2024-09-22 17:39:02 UTC	460	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 31 35 35 31 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"21551
2024-09-22 17:39:03 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:03 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c741277da9c8cd7-EWR
2024-09-22 17:39:03 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49758	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:03 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 520
2024-09-22 17:39:03 UTC	520	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-09-22 17:39:04 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:04 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74127d885c429e-EWR
2024-09-22 17:39:04 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49760	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:04 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 475
2024-09-22 17:39:04 UTC	475	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 31 35 35 31 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"21551
2024-09-22 17:39:04 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:04 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412833c9b42b0-EWR
2024-09-22 17:39:04 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49762	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:05 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 520
2024-09-22 17:39:05 UTC	520	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-09-22 17:39:05 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:05 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412877be1443e-EWR
2024-09-22 17:39:05 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49763	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:06 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 491
2024-09-22 17:39:06 UTC	491	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 31 35 35 31 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"21551
2024-09-22 17:39:06 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:06 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74128befd9421d-EWR
2024-09-22 17:39:06 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49764	104.16.149.130	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:07 UTC	118	OUT	POST /api/Update/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 194
2024-09-22 17:39:07 UTC	194	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 31 35 35 31 35 39 34 35 34 31 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 30 39 32 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 69 6e 73 74 61 6c 6c 65 72 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 66 65 61 74 75 72 65 77 70 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 7d Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"21551594541","InstallDate":"20240922","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
2024-09-22 17:39:07 UTC	249	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:07 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c741293887e1885-EWR
2024-09-22 17:39:07 UTC	327	IN	Data Raw: 31 34 30 0d 0a 7b 22 63 6f 64 65 22 3a 22 55 50 44 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 20 5c 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 5c 22 2c 20 5c 22 49 6e 73 74 61 6c 6c 65 72 45 78 65 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 31 33 2e 30 2e 30 2e 31 30 38 30 2f 57 43 49 6e 73 74 61 6c 6c 65 72 5f 4e 6f 6e 41 64 6d 69 6e 2e 65 78 65 5c 22 2c 20 5c 22 49 6e 73 74 61 6c 6c 65 72 5a 69 70 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 2f 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2d 31 33 2e 39 30 Data Ascii: 140{"code":"UPD","configuration":"{\"Version\": \"13.900.0.1080\", \"InstallerExe\": \"https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe\", \"InstallerZip\": \"https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.90
2024-09-22 17:39:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49765	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:08 UTC	176	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 517 Connection: Keep-Alive
2024-09-22 17:39:08 UTC	517	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-09-22 17:39:08 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:08 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c7412987b060f43-EWR
2024-09-22 17:39:08 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49766	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:09 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 485
2024-09-22 17:39:09 UTC	485	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 31 35 35 31 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"21551
2024-09-22 17:39:09 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:09 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74129e8cb48c95-EWR
2024-09-22 17:39:09 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49767	104.16.148.130	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:10 UTC	127	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com Connection: Keep-Alive
2024-09-22 17:39:10 UTC	381	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:10 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "4139849418" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 1431 Expires: Sun, 22 Sep 2024 21:39:10 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8c7412a42acc03d5-EWR
2024-09-22 17:39:10 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-09-22 17:39:10 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-09-22 17:39:10 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-09-22 17:39:10 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-09-22 17:39:10 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-09-22 17:39:10 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-09-22 17:39:10 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-09-22 17:39:10 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-09-22 17:39:10 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-09-22 17:39:10 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49768	104.16.148.130	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:19 UTC	103	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com
2024-09-22 17:39:19 UTC	381	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:19 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "4139849418" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 1440 Expires: Sun, 22 Sep 2024 21:39:19 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8c7412dcfb10c484-EWR
2024-09-22 17:39:19 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-09-22 17:39:19 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-09-22 17:39:19 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-09-22 17:39:19 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-09-22 17:39:19 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-09-22 17:39:19 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-09-22 17:39:19 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-09-22 17:39:19 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-09-22 17:39:19 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-09-22 17:39:19 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49769	104.16.148.130	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:27 UTC	127	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com Connection: Keep-Alive
2024-09-22 17:39:27 UTC	381	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:27 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "4139849418" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 1448 Expires: Sun, 22 Sep 2024 21:39:27 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8c741312ede5428b-EWR
2024-09-22 17:39:27 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-09-22 17:39:27 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-09-22 17:39:27 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-09-22 17:39:27 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-09-22 17:39:27 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-09-22 17:39:27 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-09-22 17:39:27 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-09-22 17:39:27 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-09-22 17:39:27 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-09-22 17:39:27 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49770	104.16.148.130	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:36 UTC	127	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com Connection: Keep-Alive
2024-09-22 17:39:36 UTC	381	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:36 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "4139849418" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 1457 Expires: Sun, 22 Sep 2024 21:39:36 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8c741346abbd0f9b-EWR
2024-09-22 17:39:36 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-09-22 17:39:36 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-09-22 17:39:36 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-09-22 17:39:36 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-09-22 17:39:36 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-09-22 17:39:36 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-09-22 17:39:36 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-09-22 17:39:36 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-09-22 17:39:36 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-09-22 17:39:36 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49772	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:44 UTC	173	OUT	POST /v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 728 Connection: Keep-Alive
2024-09-22 17:39:44 UTC	728	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "96ef2557-6a7e-404e-9f11-0a66eb467147", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-09-22 17:39:44 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:44 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c741379c9376a5c-EWR
2024-09-22 17:39:44 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49773	104.18.27.149	443	6488	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-22 17:39:44 UTC	152	OUT	POST /v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 674
2024-09-22 17:39:44 UTC	674	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 39 36 65 66 32 35 35 37 2d 36 61 37 65 2d 34 30 34 65 2d 39 66 31 31 2d 30 61 36 36 65 62 34 36 37 31 34 37 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 31 35 35 31 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"96ef2557-6a7e-404e-9f11-0a66eb467147","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"21551
2024-09-22 17:39:45 UTC	479	IN	HTTP/1.1 200 OK Date: Sun, 22 Sep 2024 17:39:44 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c74137ddc084251-EWR
2024-09-22 17:39:45 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-09-22 17:39:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:38:43
Start date:	22/09/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	545'352 bytes
MD5 hash:	1586CB9126C49565414BCEA085B97366
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	13:38:43
Start date:	22/09/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe
Wow64 process (32bit):	true
Commandline:	.\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=21551594541 --version=13.900.0.1080
Imagebase:	0x900000
File size:	438'936 bytes
MD5 hash:	A27F9713DB1688D03D2082BFA1827803
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe, Author: Joe Security
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	16

Executed Functions

Function 004148D4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 004148FA

Part of subcall function 004157C8: HeapCreate.KERNELBASE(00000000,00001000,00000000,00414932,00000001), ref: 004157D9
Part of subcall function 004157C8: HeapDestroy.KERNEL32 ref: 00415818

GetCommandLineA.KERNEL32 ref: 0041495A
GetStartupInfoA.KERNEL32(?), ref: 00414985
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004149A8

Part of subcall function 00414A01: ExitProcess.KERNEL32 ref: 00414A1E

Strings

`&, xrefs: 00414974
@%k, xrefs: 00414960

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID: @%k$`&
API String ID: 2057626494-157460863
Opcode ID: d0b0bc6d91067fd433c2cc4b1856fc531dfd5f25a3beb9f48f66dbad23e013fe
Instruction ID: fb65514f2d73941f5fb5fe300876562abb5c146ee9b99336205dd39c2cb12ef3
Opcode Fuzzy Hash: d0b0bc6d91067fd433c2cc4b1856fc531dfd5f25a3beb9f48f66dbad23e013fe
Instruction Fuzzy Hash: BD219EB19407159FDB14EFB6DC46AEE7BB8EF44704F10412FF910AB291DB3C89818A58

Function 00405434 Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405414: FindClose.KERNELBASE(?,000000FF,00405445,000000FF), ref: 0040541F

FindFirstFileW.KERNELBASE(?,?,000000FF), ref: 00405497

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

FindFirstFileA.KERNEL32(?,?,000000FF), ref: 00405467

Part of subcall function 0040551C: __EH_prolog.LIBCMT ref: 00405521

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$FileFirstH_prolog$Close
String ID:
API String ID: 3335342080-0
Opcode ID: 01ff4a9bc94c78cd279a0d863a54892268cf469c718bfc53d66ce16def007dff
Instruction ID: 44fa9ff84b7e7cb6f1e8d7f9ea47a8a098aa0700a3472251c04f15a334366322
Opcode Fuzzy Hash: 01ff4a9bc94c78cd279a0d863a54892268cf469c718bfc53d66ce16def007dff
Instruction Fuzzy Hash: 33014830401505ABCF20AF64DC456EE7779DF51329F20827AE855672D1D73C9A85CF98

Function 00401014 Relevance: 48.0, APIs: 8, Strings: 19, Instructions: 715
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401A7B: GetVersionExA.KERNEL32(?), ref: 00401A95

GetCommandLineW.KERNEL32(00000003,00000003,00000003,00000003,?,00000000), ref: 0040108B

Part of subcall function 004038D7: __EH_prolog.LIBCMT ref: 004038DC

Part of subcall function 0040460B: __EH_prolog.LIBCMT ref: 00404610
Part of subcall function 0040460B: GetModuleFileNameA.KERNEL32(00400000,?,00000105,00000000,00000000), ref: 00404649

Part of subcall function 0040237B: __EH_prolog.LIBCMT ref: 00402380

Part of subcall function 00402340: __EH_prolog.LIBCMT ref: 00402345

Part of subcall function 00403DE4: __EH_prolog.LIBCMT ref: 00403DE9

MessageBoxW.USER32(00000000,?,?,00000010), ref: 004015DE
ShellExecuteExA.SHELL32(0000003C,?,00000001,?,?,00000003,?,00000003,00420240,;!@InstallEnd@!,?,00000003,00000000,00000002,00420278,00000003), ref: 004016D5
MessageBoxW.USER32(00000000,?,?,00000024), ref: 004012FF

Part of subcall function 00410EC0: MessageBoxW.USER32(00000000,?,7-Zip,00000010), ref: 00410EC9

Part of subcall function 00402EFE: __EH_prolog.LIBCMT ref: 00402F03

CloseHandle.KERNEL32(?,?,00000000), ref: 004019A8
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 004019C7
CloseHandle.KERNEL32(?,?,00000000), ref: 004019CE

Strings

D, xrefs: 00401886
Can not create temp folder archive, xrefs: 004014DD
Directory, xrefs: 004012A2
%%T\, xrefs: 00401803
%%T, xrefs: 00401832
Can't load config info, xrefs: 00401185
Config failed, xrefs: 004011F7
setup.exe, xrefs: 004017B9
<, xrefs: 0040166A
;!@InstallEnd@!, xrefs: 0040116D
;!@Install@!UTF-8!, xrefs: 00401172
RunProgram, xrefs: 0040139A
Can not open file, xrefs: 004016ED
ExecuteFile, xrefs: 004013DA
Title, xrefs: 0040120B
, xrefs: 004016DB
Can not find setup.exe, xrefs: 004017DB
ExecuteParameters, xrefs: 0040141A
Can not load codecs, xrefs: 00401529

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$Message$CloseHandle$CommandExecuteFileLineModuleNameObjectShellSingleVersionWait
String ID: $%%T$%%T\$;!@Install@!UTF-8!$;!@InstallEnd@!$<$Can not create temp folder archive$Can not find setup.exe$Can not load codecs$Can not open file$Can't load config info$Config failed$D$Directory$ExecuteFile$ExecuteParameters$RunProgram$Title$setup.exe
API String ID: 785510900-2114487665
Opcode ID: 8fd5f8ab937932ae6757a318f5051f0329dcea0d0da6af97c6c1f875a1e9e091
Instruction ID: f92d1a5b025e5f1856d93d01be2b226abe75c3e6546c85d9ed47549f0c040395
Opcode Fuzzy Hash: 8fd5f8ab937932ae6757a318f5051f0329dcea0d0da6af97c6c1f875a1e9e091
Instruction Fuzzy Hash: 485228719002199ACF25EFA5DC82AEDBB75AF04308F1040BFE156721F2DA395B86CF58

Function 0040AB05 Relevance: 14.2, APIs: 9, Instructions: 682
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040AB0A

Part of subcall function 0040D5A3: __EH_prolog.LIBCMT ref: 0040D5A8

Part of subcall function 004130E0: InitializeCriticalSection.KERNEL32(?,?,?,00000000,00000000), ref: 0041310E

DeleteCriticalSection.KERNEL32(?), ref: 0040AD3E
DeleteCriticalSection.KERNEL32(?), ref: 0040AFCB
DeleteCriticalSection.KERNEL32(?), ref: 0040B036
DeleteCriticalSection.KERNEL32(?), ref: 0040B093
DeleteCriticalSection.KERNEL32(?), ref: 0040B1A2
DeleteCriticalSection.KERNEL32(?), ref: 0040B1FC
DeleteCriticalSection.KERNEL32(?,?,?,00000004,00000004), ref: 0040B271
DeleteCriticalSection.KERNEL32(?), ref: 0040B303

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$Delete$H_prolog$Initialize
String ID:
API String ID: 3452124646-0
Opcode ID: 53ff4eaa71f930fd4966fc49476664da3d82c19ee4ae63da8a12ea1bfaad2ad0
Instruction ID: 4c9a54a47b38b58bbaef36bcc828af5c6ca02983ed7c574d3216c54edcd042c8
Opcode Fuzzy Hash: 53ff4eaa71f930fd4966fc49476664da3d82c19ee4ae63da8a12ea1bfaad2ad0
Instruction Fuzzy Hash: FC627E7090024ADFDB14DFA5C944BDEBBB4FF14308F1080AEE805B7291DB789A49DB99

Function 004051B7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 004051C5
GetTickCount.KERNEL32 ref: 004051D0
GetCurrentProcessId.KERNEL32(?,00000000,?,?,00405334,?,00000000,?,00000003,00000003,00000000,00000000,00000003,?,00000000), ref: 004051DB
GetTickCount.KERNEL32 ref: 00405240
SetLastError.KERNEL32(000000B7,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00405273
GetLastError.KERNEL32(00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00405299

Part of subcall function 004049F4: CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A13

Strings

d, xrefs: 004052AE
.tmp, xrefs: 00405257

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountCurrentErrorLastTick$CreateDirectoryProcessThread
String ID: .tmp$d
API String ID: 3074393274-2797371523
Opcode ID: 2fda1539db0041318063c64b288010cc5c4c3aedaa5e381c7d8f696092406eab
Instruction ID: 4fab17955b769304b7d1cf71853489b42ead9ac2cf2e2055059d54e7646dac87
Opcode Fuzzy Hash: 2fda1539db0041318063c64b288010cc5c4c3aedaa5e381c7d8f696092406eab
Instruction Fuzzy Hash: CC31C1326506009BDB10ABA098897EF7760EFA5315F14807FE902BB2D2D77C9842CF99

Function 00404908 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000078,.@,00000000,00402AB0,00000000,?,?,?,?), ref: 00404918
CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,?,.@,00000000,00402AB0,00000000,?,?,?,?), ref: 00404934
SetFileTime.KERNELBASE(00000000,00000000,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000,?,.@,00000000,00402AB0,00000000), ref: 0040494B
CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,?,.@,00000000,00402AB0,00000000,?,?,?), ref: 00404957

Strings

.@, xrefs: 00404911

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID: .@
API String ID: 2291555494-2582305824
Opcode ID: 134b82ee1bee937397c61f831c6e8a998fcbb54d8f51f8998ece3d2421389dbd
Instruction ID: b13e78268552c33248838deebc4f257ca571263cc4fefdaa9dfe176c52576776
Opcode Fuzzy Hash: 134b82ee1bee937397c61f831c6e8a998fcbb54d8f51f8998ece3d2421389dbd
Instruction Fuzzy Hash: 66F0E2B12812107BE2201B74BC48F9B6E5CDBCA715F108135B661A21E0C3284D19D7B8

Function 004083AB Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004083B0

Strings

Unknown error, xrefs: 00408671, 00408676
X3B, xrefs: 004086A4

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID: Unknown error$X3B
API String ID: 3519838083-1496835351
Opcode ID: 47f253f86f2cbe6f5ea7b7729e7e95f0c02779c145a6591478a86d185b5344b5
Instruction ID: 10ffca09dccd2053a4a89f972bfe6bbc607f2b880b0d523777cfa28ffc571443
Opcode Fuzzy Hash: 47f253f86f2cbe6f5ea7b7729e7e95f0c02779c145a6591478a86d185b5344b5
Instruction Fuzzy Hash: 89D16070900219EFCF05DFA4C984ADEBB74BF48304F14846EE846BB2D1DB78AA45CB95

Function 00405620 Relevance: 4.6, APIs: 3, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00405625

Part of subcall function 00405434: FindFirstFileA.KERNEL32(?,?,000000FF), ref: 00405467

GetLastError.KERNEL32(?,?,00000000,?,00000001), ref: 00405653

Part of subcall function 00405414: FindClose.KERNELBASE(?,000000FF,00405445,000000FF), ref: 0040541F

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseErrorFileFirstH_prologLast
String ID:
API String ID: 364955512-0
Opcode ID: e39f0d4d85096f3cd882782c1d04852b930387ce9b142e76bb949cb0f7f9728b
Instruction ID: 04b13d9487752735ca5a27f2fc382c225ef0a6c39b2ce108fc8834fd1c85259b
Opcode Fuzzy Hash: e39f0d4d85096f3cd882782c1d04852b930387ce9b142e76bb949cb0f7f9728b
Instruction Fuzzy Hash: F0418E36900519AACF14FBA5D942AEFBB75EF14308F10403AE412772E1DB795E41DEA8

Function 0040280E Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00402813

Part of subcall function 00402D81: EnterCriticalSection.KERNEL32(?,?,?,00409336), ref: 00402D86
Part of subcall function 00402D81: LeaveCriticalSection.KERNEL32(?,?,?,?,00409336), ref: 00402D90

Strings

.@, xrefs: 00402A17, 00402C0B, 00402C67

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID: .@
API String ID: 367238759-2582305824
Opcode ID: 577924c8c0bac586da650f1e85d0a83bbc87ffed532ab8f3eca2ba2db10ea84e
Instruction ID: fb4838387da9abac6519c3a0e173b295c4de01f89ec6b6ed0d4ee3fc8d60aaac
Opcode Fuzzy Hash: 577924c8c0bac586da650f1e85d0a83bbc87ffed532ab8f3eca2ba2db10ea84e
Instruction Fuzzy Hash: F3F1DF70900248DFCF14EFA5C985ADEBBB4AF54308F10807EE446B72E1DB785A85DB19

Function 004030FC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00403101

Part of subcall function 00405620: __EH_prolog.LIBCMT ref: 00405625

Part of subcall function 00404A3E: __EH_prolog.LIBCMT ref: 00404A43

Part of subcall function 004092E6: __EH_prolog.LIBCMT ref: 004092EB

Strings

Default, xrefs: 00403213

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID: Default
API String ID: 3519838083-753088835
Opcode ID: 0fc91ddac6c1b16fe72a6cc7b41e2781a7216c9bd00a9ca8bd5645336c638fb0
Instruction ID: 203c82e13c85383a660d5cb73dbb10af46e9aa8c77eacbcc0267a4e11568a844
Opcode Fuzzy Hash: 0fc91ddac6c1b16fe72a6cc7b41e2781a7216c9bd00a9ca8bd5645336c638fb0
Instruction Fuzzy Hash: E4514E75900209EFDB14EFA5D8819EEBBB8FF18308F00456EE556772D1DB38AA06CB14

Function 00404A3E Relevance: 3.2, APIs: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00404A43
GetLastError.KERNEL32(?,?,?,00000000), ref: 00404ACB

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID:
API String ID: 1057991267-0
Opcode ID: cf2054507fd1ee53753d2eae408e5b803be4a538542d8802e2091fe77905cd97
Instruction ID: 397979b183d08822f23b565ee303c4952bc02ec102e27be1c48eee89bea9c2ad
Opcode Fuzzy Hash: cf2054507fd1ee53753d2eae408e5b803be4a538542d8802e2091fe77905cd97
Instruction Fuzzy Hash: 1E5105719441099ACF10EBA5C942AFEBB75AF91308F11017FE602731E1DB3DAE46CB99

Function 00408755 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040875A
GetLastError.KERNEL32(?,00000000,?,?,00000000,?,?,0040893F,?,?,00000000,004149B4,?,?,?,00000000), ref: 004087E8

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID:
API String ID: 1057991267-0
Opcode ID: 9241e159634e285d8ed2c067ddd4a586d7e54c47a3761db9d9a9d26607b46551
Instruction ID: 0128b321cd566d1ceb50e896689a501b942dab3b414a73cd3b5e456030195100
Opcode Fuzzy Hash: 9241e159634e285d8ed2c067ddd4a586d7e54c47a3761db9d9a9d26607b46551
Instruction Fuzzy Hash: EE317C719012499FCB10DF95CE849AEBBB0FF44314B24817FE496B7292CB388D40DB69

Function 0041468E Relevance: 3.0, APIs: 2, Instructions: 45
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416CCC: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00416DC2

CreateThread.KERNELBASE(00000000,00000003,004146F9,00000000,00000000,?), ref: 004146CF
GetLastError.KERNEL32(?,?,?,00413009,00000000,00000000,004032CA,?,00000000,00000000,?,00402FAB,?,00000000,?), ref: 004146D9

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocCreateErrorHeapLastThread
String ID:
API String ID: 3580101977-0
Opcode ID: 0374611688ca75c4551dea276e5d424cbadff3ac534dbe24837146ca9d20d13e
Instruction ID: 928dc59a5e1d7113ba94efa25a55b36d47ae035f635b84aed830f8a2a3c61c12
Opcode Fuzzy Hash: 0374611688ca75c4551dea276e5d424cbadff3ac534dbe24837146ca9d20d13e
Instruction Fuzzy Hash: D6F02D362006156BCB209F66EC019DB3BA5EF81375F10402EF958C2290DF3DC8914BAC

Function 00405892 Relevance: 3.0, APIs: 2, Instructions: 45
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405905: CloseHandle.KERNELBASE(00000000,000000FF,004058A0,?,?,00000000), ref: 00405910

CreateFileW.KERNELBASE(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004058EF

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

CreateFileA.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004058CB

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateFile$CloseH_prologHandle
String ID:
API String ID: 449569272-0
Opcode ID: 34b674e9a04a5ff3e8c8923f5916708bcc46c4f31befc859c171c75614de22e6
Instruction ID: 7cb04d8d1853a58e30318ad4c29bda14cf4b58fee7e46fc4002fe1391b6e6e2b
Opcode Fuzzy Hash: 34b674e9a04a5ff3e8c8923f5916708bcc46c4f31befc859c171c75614de22e6
Instruction Fuzzy Hash: 4F01287240020AFFCF11AFA4DC45C9B7F6AEF08364B10853AF991661A1D73699A1EF94

Function 00404965 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNELBASE(?,00000000,?,00000003,?,00000000), ref: 0040499C

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

SetFileAttributesA.KERNEL32(?,00000000,?,00000003,?,00000000), ref: 00404985

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AttributesFile$H_prolog
String ID:
API String ID: 3790360811-0
Opcode ID: 5366c93646a32060bc4a1fe11ea500c12b8b92d1211a98e2b8e7846322785de3
Instruction ID: f078d443d6654451da1bdd33dee3a4941b810ca2709c1c0422ffd448cadfd8b3
Opcode Fuzzy Hash: 5366c93646a32060bc4a1fe11ea500c12b8b92d1211a98e2b8e7846322785de3
Instruction Fuzzy Hash: 12E0E5B19002106BCB302B749C08AD73F6CCB82314B108177E816B72D0DA388E06C6D9

Function 004049F4 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A2C

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A13

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateDirectory$H_prolog
String ID:
API String ID: 2325068607-0
Opcode ID: a1e0d02f5bfc64bfc09281de4819c2c8931d1b3daee1640bd6a36795e0d5f738
Instruction ID: e8b418caba4fa0c83fd0f6cce2293bab18ef6c4fa53c548cc4c0ebfda5fe1645
Opcode Fuzzy Hash: a1e0d02f5bfc64bfc09281de4819c2c8931d1b3daee1640bd6a36795e0d5f738
Instruction Fuzzy Hash: 3CE0E570B002006BDB206B64AC05B977B68CB41709F104176E902F71D0DA78DE01DA9C

Function 004157C8 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00414932,00000001), ref: 004157D9

Part of subcall function 00415680: GetVersionExA.KERNEL32 ref: 0041569F

HeapDestroy.KERNEL32 ref: 00415818

Part of subcall function 00415825: HeapAlloc.KERNEL32(00000000,00000140,00415801,000003F8), ref: 00415832

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 0d18dfc85a1640e6673d81f03e6c6359104a03ea7de3319d0e450716895a192f
Instruction ID: ed3d0d0d9fb025b00032fbfed5580f0a7fafafb3549905f7ec75d8b7e0a93aa3
Opcode Fuzzy Hash: 0d18dfc85a1640e6673d81f03e6c6359104a03ea7de3319d0e450716895a192f
Instruction Fuzzy Hash: 6CF06530A54B01EEDF207B706C867EA2B90EB84795F60483BF401D81A0EB7884D1D659

Function 00405970 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 0040598B
GetLastError.KERNEL32(?,?,?,?), ref: 00405999

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 4eb004f5f0e538f15da8fb4a4b1192dc0e26d9ca4b62000b247bbe798b79ae76
Instruction ID: b27308c8a3af6e3091502473baf333c9532b4c6e1f366657fcb3ad1a7c3590d9
Opcode Fuzzy Hash: 4eb004f5f0e538f15da8fb4a4b1192dc0e26d9ca4b62000b247bbe798b79ae76
Instruction Fuzzy Hash: 93F0B7B4500208EFDF04CF94D9458AE7BB5EF49364B208169F815E7390D7359E00DFA9

Function 00404F2C Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,?,00000000), ref: 00404F62

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

SetCurrentDirectoryA.KERNEL32(00000000,00000000,?,00000000), ref: 00404F48

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CurrentDirectory$H_prolog
String ID:
API String ID: 3531555294-0
Opcode ID: 37bd0973ac103fd303293487a19168a5ccebfcf95a8c4f288a103cb7951a30b5
Instruction ID: 9edf083e53dd0555a3085cbe496080ff7240eda39e21aa363a26468641b3ea5b
Opcode Fuzzy Hash: 37bd0973ac103fd303293487a19168a5ccebfcf95a8c4f288a103cb7951a30b5
Instruction Fuzzy Hash: 75E02630B400093FDF112F78EC4A9AA3BB89B40309F10427AB403E20E1EF38CA48CA48

Function 0040B98F Relevance: 2.0, APIs: 1, Instructions: 515COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B994

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6c23f50496e65b3ca560bc6ad6661ef703fabc81de4c7ebfafbc0beace10094d
Instruction ID: 4fbed39282daa38b1d3be95d0829f5567439209fdd6a1d56e89862dfcbe45c3a
Opcode Fuzzy Hash: 6c23f50496e65b3ca560bc6ad6661ef703fabc81de4c7ebfafbc0beace10094d
Instruction Fuzzy Hash: 05324B70904249DFDB10DFA8C584BDEBBB0AF58304F1441AEE845B7382DB78AE45CB99

Function 0040EB99 Relevance: 2.0, APIs: 1, Instructions: 500COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040EB9E

Part of subcall function 0040E770: __EH_prolog.LIBCMT ref: 0040E775

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 93af7643a127ff2c8fcf7066a9c121e1979c0be22eb581a0e33d5eb75e035ebc
Instruction ID: 765616d13d330a71392781af4293cea344630bd2be9376268a28767dce44cac6
Opcode Fuzzy Hash: 93af7643a127ff2c8fcf7066a9c121e1979c0be22eb581a0e33d5eb75e035ebc
Instruction Fuzzy Hash: F6325C70900249DFCB24DFA5C880BEEBBB5BF55308F14847ED549B7282DB386A89CB55

Function 0040888F Relevance: 1.9, APIs: 1, Instructions: 374COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408894

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f8f61f009d3daf8c2db6a732b574bcd6eafb3dea196858b7c2c201f5376d76a6
Instruction ID: dff2ad87a4df39db6f8fa6ff6a697358cee08fb6a23258ae47e5232e80a59da3
Opcode Fuzzy Hash: f8f61f009d3daf8c2db6a732b574bcd6eafb3dea196858b7c2c201f5376d76a6
Instruction Fuzzy Hash: FFE16E70904249DFDF10DFA4C988AAEBBB4AF48314F2444AEE556F7391CB389E45CB25

Function 0040E7F4 Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E7F9

Part of subcall function 0040F836: __EH_prolog.LIBCMT ref: 0040F83B

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 498aaecf194758b2187a7f377388585577334c9b398a12de9558ebeea3154d22
Instruction ID: 639e188e3e769c4c76ba7ddc7be71c767d86a570cac8f7036ff280b2304c1e48
Opcode Fuzzy Hash: 498aaecf194758b2187a7f377388585577334c9b398a12de9558ebeea3154d22
Instruction Fuzzy Hash: 5DC13670900259DFDB14DFA5C985BDEBBB4BF14308F1480AEE945B7282CB786A48CF65

Function 0040F449 Relevance: 1.7, APIs: 1, Instructions: 207COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F44E

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7053a18d867c794380ddb73d5154a26bfb4cc56ca4d452b1cbce9de2fd1904e6
Instruction ID: 37dc011919f3b1358f9a833e213d0996983958fb9ee029613f358e4c9ba25a45
Opcode Fuzzy Hash: 7053a18d867c794380ddb73d5154a26bfb4cc56ca4d452b1cbce9de2fd1904e6
Instruction Fuzzy Hash: 3C815C70E00605ABCB24DFA5C881AEEFBB1BF48304F14453EE445B3791D739A949CB99

Function 00408D5E Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408D63

Part of subcall function 00408F0B: __EH_prolog.LIBCMT ref: 00408F10

Part of subcall function 00402635: __EH_prolog.LIBCMT ref: 0040263A

Part of subcall function 00403981: __EH_prolog.LIBCMT ref: 00403986

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fe4f4b855b35ad50f10ad9ecf2bf615057988214f71ae465a5f778489ccae84a
Instruction ID: 2e5fef73c4a961ecd91826de13bda49669b7ee5ae1afd1ab178ba291f64b6413
Opcode Fuzzy Hash: fe4f4b855b35ad50f10ad9ecf2bf615057988214f71ae465a5f778489ccae84a
Instruction Fuzzy Hash: E5516D7190060AEFCF11DFA5C984A9EBBB4BF08314F10462EE556B72D1CB789A45CFA4

Function 0040DB62 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040DB67

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6102bc3ab49ae424949eee4761875b821dd30f392df23a536a372274e60046df
Instruction ID: 67e57bbcfb5e62c28ba97e2c762051c7e2fb602a8ee489b014dcb5d1e96c76cd
Opcode Fuzzy Hash: 6102bc3ab49ae424949eee4761875b821dd30f392df23a536a372274e60046df
Instruction Fuzzy Hash: DA419EB1E042059BEB14DF99C985ABEB7B5FF48304F14453EE402B7381D7B8A945CBA8

Function 0040CD84 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CD89

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 305c79b04e93cb02db0d94eb430663c97d837b050eba01e1428f85ec3b32050d
Instruction ID: 716710645470f9cf712b82a1641bf3e3a23618a4fc30be00c3c641d866b01c52
Opcode Fuzzy Hash: 305c79b04e93cb02db0d94eb430663c97d837b050eba01e1428f85ec3b32050d
Instruction Fuzzy Hash: 3151C531804146DFCB15CB68C4D4AEE7771EF48348F14827BE8167B2D2D6399A06DBEA

Function 00401B11 Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401B16

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4a7b8dc75b00dab3078b6f2c0b685c16519ae0cc3006f02a661cb725d39e4b70
Instruction ID: dc66995ee082b2e59fd72de07b50a9d1ecefa8465c91578acc64d6d85ae5b981
Opcode Fuzzy Hash: 4a7b8dc75b00dab3078b6f2c0b685c16519ae0cc3006f02a661cb725d39e4b70
Instruction Fuzzy Hash: 7A51D071C042499FDF21DFA4C940BEEBBB4AF05394F14416AE851732E2E7789A41CB68

Function 00402EFE Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402F03

Part of subcall function 0040335F: __EH_prolog.LIBCMT ref: 00403364

Part of subcall function 004034CC: __EH_prolog.LIBCMT ref: 004034D1

Part of subcall function 00403086: __EH_prolog.LIBCMT ref: 0040308B
Part of subcall function 00403086: ShowWindow.USER32(004149B4,00000001,000001F4,00000000,?,?,00000000,00000003,00000000,00000000), ref: 004030E4

Part of subcall function 00412FB0: CloseHandle.KERNEL32(00000000,00000000,0040301E,?,?,00000000,00000003,?,00000000,?,?,00000003,00000000,00000000), ref: 00412FBA
Part of subcall function 00412FB0: GetLastError.KERNEL32(?,00000003,00000000,00000000), ref: 00412FC4

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$CloseErrorHandleLastShowWindow
String ID:
API String ID: 2740091781-0
Opcode ID: 2da83f7b0348b558eb037d8fcbbe5e82633db5724e115f0790e5db2222500163
Instruction ID: 576321bfec054c9ee934bf83a6d4a944d332aa9064831fab6676e01313dc7821
Opcode Fuzzy Hash: 2da83f7b0348b558eb037d8fcbbe5e82633db5724e115f0790e5db2222500163
Instruction Fuzzy Hash: FF419C71900248DBCB11EFA5C991AEDBBB4AF04304F1080BFE90AB72D2DA785B45CB59

Function 0040C557 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C55C

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 039900a8d840d8f65cf18cf377fd5bff5d9e595a8fad608146d0eb9be483e555
Instruction ID: 41554ca9dc53ee1e5d6d797d633c48513fe02739bc2a4d97afccdd4c6a3ff44e
Opcode Fuzzy Hash: 039900a8d840d8f65cf18cf377fd5bff5d9e595a8fad608146d0eb9be483e555
Instruction Fuzzy Hash: 89416C71A00645DFCB24CF68C48486ABBF1FF48314B244AAED096AB791C731ED46CF91

Function 0040CF82 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CF87

Part of subcall function 0040F6E0: __EH_prolog.LIBCMT ref: 0040F6E5

Part of subcall function 0040D0A6: __EH_prolog.LIBCMT ref: 0040D0AB

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 247e6e783af1532b670e604df5ee4666ee67329ca8b2db34e45a1f618534d241
Instruction ID: 59bb91874275df73172cd70bf395014d1b371f9bee4586dc4e729df687399cc5
Opcode Fuzzy Hash: 247e6e783af1532b670e604df5ee4666ee67329ca8b2db34e45a1f618534d241
Instruction Fuzzy Hash: 87319630D01248DFCB11DFA9C548BEDBBB5AF15308F14406EE8457B381C7789A49DB66

Function 004061BF Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004061C4

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0a32dfb97eb38f68acb4646e97dd4d13ceed46f781b2d933bb6fe13a2a73ca49
Instruction ID: a24cbab5944e5cd80d4d0b45cab95027a2511e7323fd1c0fe5e5f9bfcab47c11
Opcode Fuzzy Hash: 0a32dfb97eb38f68acb4646e97dd4d13ceed46f781b2d933bb6fe13a2a73ca49
Instruction Fuzzy Hash: 97218F71A05246DBCB24FFA5C44046FB7A1AB4130472285BFE053772C1C738AE61CB6A

Function 00413C73 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 00413D5A

Part of subcall function 004154DA: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415517
Part of subcall function 004154DA: EnterCriticalSection.KERNEL32(?,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415532

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: cdeed90e400f99c9328ec8b59033d7a90e074e0a5ab5361bfbc3574a04fde8a1
Instruction ID: 026ee179866774db734838c78619ddc809868a86b22b68076f663e2312d1f49b
Opcode Fuzzy Hash: cdeed90e400f99c9328ec8b59033d7a90e074e0a5ab5361bfbc3574a04fde8a1
Instruction Fuzzy Hash: D4219772A00605EBDB10DF69EC42BDA7764FB00765F20411BF421EB6D0D77CAAC28A9C

Function 00413D6F Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,00000000,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074), ref: 00413E43

Part of subcall function 004154DA: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415517
Part of subcall function 004154DA: EnterCriticalSection.KERNEL32(?,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415532

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapInitialize
String ID:
API String ID: 641406236-0
Opcode ID: 841176424f551508ca039d1f5d574a0052902f767b8dc575c65ddda1a9f22b4e
Instruction ID: 5a14261a50f2f4ae8fe925cd7ff68077a924e970bbdc1eb83d0c2eed9fb11c58
Opcode Fuzzy Hash: 841176424f551508ca039d1f5d574a0052902f767b8dc575c65ddda1a9f22b4e
Instruction Fuzzy Hash: 2421C272901705FADB10AF96DC02BDE7BB8EB04725F24012BF414B21C0D77C9AC08AA9

Function 004052CF Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004052D4

Part of subcall function 004050EE: __EH_prolog.LIBCMT ref: 004050F3
Part of subcall function 004050EE: GetTempPathA.KERNEL32(00000105,?,00000000,?,00000000), ref: 00405127

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$PathTemp
String ID:
API String ID: 3652545363-0
Opcode ID: 1ef5fa40e20091595c8a07c7add8e04f0ea87ba7b14c6b9ab7bd2a47fc7370d7
Instruction ID: 884fa5787797a708672a5e156f09df22a5f972d3b51e26f7068c24b8b673b68a
Opcode Fuzzy Hash: 1ef5fa40e20091595c8a07c7add8e04f0ea87ba7b14c6b9ab7bd2a47fc7370d7
Instruction Fuzzy Hash: 5211A3759401059ACF00EFA5C552AEFBBB8EF95348F14402FE841732D1C7B90A49DE54

Function 00409DFC Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409E01

Part of subcall function 004099F1: __EH_prolog.LIBCMT ref: 004099F6

Part of subcall function 00409A39: __EH_prolog.LIBCMT ref: 00409A3E

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e2be988a2ed4eac1d18d94ffb3dcbee280352d40f72ce7d9b7b55f505c73744e
Instruction ID: 728224cdcdeea9a50de84ff331f734dd83e0a6071a74e90d77f9a4778d081c57
Opcode Fuzzy Hash: e2be988a2ed4eac1d18d94ffb3dcbee280352d40f72ce7d9b7b55f505c73744e
Instruction Fuzzy Hash: 931182B0A01254DADB09EBAAC1153DDFBF59FA1318F54415F9552732C2CBF82B0487A6

Function 00409070 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409075

Part of subcall function 00402635: __EH_prolog.LIBCMT ref: 0040263A

Part of subcall function 00405620: __EH_prolog.LIBCMT ref: 00405625

Part of subcall function 00413B0D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413B3B

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$ExceptionRaise
String ID:
API String ID: 2062786585-0
Opcode ID: 17dae63e629c91cb1e915b62325b494edd8ae92648c1e9e6482c4593510b450f
Instruction ID: c87fc69b1ce411278b5c4cd36917e57d7785db396d8ca4da128de4c157d2198f
Opcode Fuzzy Hash: 17dae63e629c91cb1e915b62325b494edd8ae92648c1e9e6482c4593510b450f
Instruction Fuzzy Hash: 1601D2B5A402049ECB10EF26C451ADEBBB1FF84314F10852FE896A32E1CB796649CB54

Function 004027A7 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004027AC

Part of subcall function 004049F4: CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A13

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateDirectoryH_prolog
String ID:
API String ID: 3554458247-0
Opcode ID: 1d6ed87279fcce4dfaa36ce39d8da3d177537eb6a1ece7d61f11b0fb4062048b
Instruction ID: aa96bd448e9fa33173a2259148c0e22656dcd3e9b7c7d25cba760d9f6e75f00f
Opcode Fuzzy Hash: 1d6ed87279fcce4dfaa36ce39d8da3d177537eb6a1ece7d61f11b0fb4062048b
Instruction Fuzzy Hash: 55F03C729005069BCB05EB5AC8429EEBBB5EF94308F10403FE152775E2DA786986DB94

Function 00406297 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040629C

Part of subcall function 004061BF: __EH_prolog.LIBCMT ref: 004061C4

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6c2e6a82ad44a3596cf000a5615c5b739901b0aaac1cec813de11ba17f646bcd
Instruction ID: d002f29cd99a7d9c36b9a014c837f136803fcb54798139eb5382dd41199f51d8
Opcode Fuzzy Hash: 6c2e6a82ad44a3596cf000a5615c5b739901b0aaac1cec813de11ba17f646bcd
Instruction Fuzzy Hash: 2BF03A72A00218EFDB15DF94CC01BEEB779FB48315F10816AB422E72D0C7798A10CB14

Function 0040C96C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C971

Part of subcall function 0040C9E3: __EH_prolog.LIBCMT ref: 0040C9E8

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 97d13476a1578dbbb8b7321e23e8bd518515a52fd3c7649a69e8943f484a5e8b
Instruction ID: 180fbe891bab88941c19a906eef3a01802dada044b7360aafa1ebd8752043cfb
Opcode Fuzzy Hash: 97d13476a1578dbbb8b7321e23e8bd518515a52fd3c7649a69e8943f484a5e8b
Instruction Fuzzy Hash: 66F0FCB0911640DEC719EB74D1153DDFBB4AF55308F50419E9956736C2CFB81708C765

Function 0040F7B7 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F7BC

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 878411d95e43fbc0e8f99baadd22453587100e877feed7db7451d64bbab71619
Instruction ID: ac64c31c834abe54e412618b162bf05c7167bd146dfe5a37d1803cc4d2d3be92
Opcode Fuzzy Hash: 878411d95e43fbc0e8f99baadd22453587100e877feed7db7451d64bbab71619
Instruction Fuzzy Hash: 94E012B1A00155ABCB58EF69D80669DBAA5AB09318F10863FB026F36C1DB784A418B59

Function 00405BFB Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00405C13

Part of subcall function 00413B0D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413B3B

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocExceptionRaiseString
String ID:
API String ID: 1415472724-0
Opcode ID: 585828f0663470c28d012fa7c31560623ec32af21cf032640c5ea50ac41654d0
Instruction ID: bf266c775eafc0cd132ea201270a7534faa964ceb55315cc87c56e89072e7831
Opcode Fuzzy Hash: 585828f0663470c28d012fa7c31560623ec32af21cf032640c5ea50ac41654d0
Instruction Fuzzy Hash: B7E06D32200708A7CB20AF65D84198B7BE8FF00385B10C43FF949DA240E779E9808BD8

Function 00405800 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405805

Part of subcall function 00405620: __EH_prolog.LIBCMT ref: 00405625

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d031f65d966fd76414b5e485b8cf5b0e5999cd66b44c505832369a9b765ef076
Instruction ID: a0f610f1b5e032532ed1cec3649959bf66a41b4e8af70f58d5593db508bcf515
Opcode Fuzzy Hash: d031f65d966fd76414b5e485b8cf5b0e5999cd66b44c505832369a9b765ef076
Instruction Fuzzy Hash: 46E04FB3D410049ACB05EB65E9527EDB378EF61319F50407FE412735D18B381F09CA58

Function 00405B29 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00405B4C

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f685ec6030a7cae57bc9182c2f64f11e19c4f82e6ad9756b6e5eb0af141a467c
Instruction ID: fda623b9c22c7fd134ddab0a411968f0e63156441233f4ee367e8c40c556ab77
Opcode Fuzzy Hash: f685ec6030a7cae57bc9182c2f64f11e19c4f82e6ad9756b6e5eb0af141a467c
Instruction Fuzzy Hash: 17E0E575640208FBCB11CFA5C801B8E7BF9EB08354F20C169F914AA260D739EA11DF54

Function 0040C931 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C936

Part of subcall function 0040C96C: __EH_prolog.LIBCMT ref: 0040C971

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2f93a48584fc243b76bceec8380402125645ced17a7c1bf7a60211c0ce45116c
Instruction ID: 8adf79bcf0a25fb823e60414124b99f072840e3085735b9c49c9779a3d641231
Opcode Fuzzy Hash: 2f93a48584fc243b76bceec8380402125645ced17a7c1bf7a60211c0ce45116c
Instruction Fuzzy Hash: 6EE01A71811620EBC724EF58C4456DEB7B4EF08725F00875EA4E6B36D1C7B8AE40CB94

Function 004147B4 Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 004147E9

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 6c939c18724e7789034020813005a1b29b75e21fb5f5d6c1b381c2503cc8d902
Instruction ID: 835638d51d7e690d80ddf8f11569568d1c7a5f433119f1d0283a2071334468ba
Opcode Fuzzy Hash: 6c939c18724e7789034020813005a1b29b75e21fb5f5d6c1b381c2503cc8d902
Instruction Fuzzy Hash: CDE08C32900925AADB223BA1DC06AEE3620AF81394F00002BF8146A5A0DBA88CD186D9

Function 0040F6E0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F6E5

Part of subcall function 0040F449: __EH_prolog.LIBCMT ref: 0040F44E

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0c00a6b9b995e6d122d0d1e5645fdc19a4d57d2469026a55dc4bfd6035115874
Instruction ID: 32d4a89d334c2aba7f1f5d27adfa0c04a02a885b7174eb98eed18e47b0b867f7
Opcode Fuzzy Hash: 0c00a6b9b995e6d122d0d1e5645fdc19a4d57d2469026a55dc4bfd6035115874
Instruction Fuzzy Hash: 1DD012B2515104FBD7109F45D842BDEBBB8EB51369F10813BF00171540D37D5644966A

Function 00405A1D Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(000000FF,00000000,?,?,00000000,000000FF,?,00405A68,00000000,?,00000000,?,00405A8E,00000000,?,00000000), ref: 00405A33

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7899785fd51540d5028ce756fcdedcbfaef9db2fe3ec3db1f53401f618f66a8a
Instruction ID: 33e006b7c7266c94de2827aaddd493f3c8d551b448fa911b85e4ce9a1db514e9
Opcode Fuzzy Hash: 7899785fd51540d5028ce756fcdedcbfaef9db2fe3ec3db1f53401f618f66a8a
Instruction Fuzzy Hash: A4E0EC75200208FBCB01CF91CC05FCE7BB9FB49754F208058E90596160C375AA14EB54

Function 004147BF Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 004147E9

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 24773d02a99502e401f88b35345ffc50176b794b148236fecf9e645f2ac90187
Instruction ID: b4e95b568d212fcbc8e7df7edbfd3446e029e3f46d4ca6baaecf21535c38ed65
Opcode Fuzzy Hash: 24773d02a99502e401f88b35345ffc50176b794b148236fecf9e645f2ac90187
Instruction Fuzzy Hash: 2AD0A732600E25AAD6223771DC467EF2244AF81795B04012BF818895A0DFA8CDC145DD

Function 00405414 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,000000FF,00405445,000000FF), ref: 0040541F

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: f0ce2bef5821c107b9489e8e4dd061de71a9af92eaf728c2451e2811c290832d
Instruction ID: ad963fc5273d8b9d86916b47fb17bcd605870b12c06d71a74b716dd917e87850
Opcode Fuzzy Hash: f0ce2bef5821c107b9489e8e4dd061de71a9af92eaf728c2451e2811c290832d
Instruction Fuzzy Hash: D4D0123151453157CA641E7C7848AD333D99A1637537157AAF4B4D32E0D3749CC34A98

Function 00405AFC Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,00405B26,00000000,00000000,?,00402E13,?), ref: 00405B0A

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 2b6a10e293fa4a8bd52839064a41e39e160aca85d3804aec240939be71bd967c
Instruction ID: 4beff7ba357006865f39a04876becaa9faf69e640e246345c6c1d8862761ec95
Opcode Fuzzy Hash: 2b6a10e293fa4a8bd52839064a41e39e160aca85d3804aec240939be71bd967c
Instruction Fuzzy Hash: 29C04C36159106FF8F120F70CC04D1ABFA2EF99311F10C958B165C5070C7328024EB52

Function 00406F81 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 00406FB2

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: f2ff9836336f67d9ff12deaf62cc92e2eac5b33916cf9d308384194b51d8e0a8
Instruction ID: f67714d9ecc1d8948c13ee62ab2841b601ff43f092b08abc37504173b9cf6405
Opcode Fuzzy Hash: f2ff9836336f67d9ff12deaf62cc92e2eac5b33916cf9d308384194b51d8e0a8
Instruction Fuzzy Hash: B7F0BE32A001459FCF119FA0D80898ABF65EF55314B0184ABF9169B251C338C820DF60

Function 00412FF0 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 0041468E: CreateThread.KERNELBASE(00000000,00000003,004146F9,00000000,00000000,?), ref: 004146CF
Part of subcall function 0041468E: GetLastError.KERNEL32(?,?,?,00413009,00000000,00000000,004032CA,?,00000000,00000000,?,00402FAB,?,00000000,?), ref: 004146D9

GetLastError.KERNEL32(?,?,00000003,00000000,00000000), ref: 00413018

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast$CreateThread
String ID:
API String ID: 665435222-0
Opcode ID: fdfffcc17890bcc66e85f81167f5a4f4e376ab203a2f001e3d39f9f51099ce04
Instruction ID: 8241f09584fde1b7b47d6c8a5a56a0c389c2bf5d01a37efb599b640c9bda9e89
Opcode Fuzzy Hash: fdfffcc17890bcc66e85f81167f5a4f4e376ab203a2f001e3d39f9f51099ce04
Instruction Fuzzy Hash: 4EE086B22042126AE310DF509C05FE76ADCDB94B05F00443EB944C6184EB64CA40C3A9

Function 00405905 Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,000000FF,004058A0,?,?,00000000), ref: 00405910

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9cbe10086181c6cf337a739c26a2519d1510d6718cc7d35307e3d92904545fb4
Instruction ID: c924a9121967eb2c43d42ee71539138ee39fbcc7c8c6d5ba34c486a20a6e0004
Opcode Fuzzy Hash: 9cbe10086181c6cf337a739c26a2519d1510d6718cc7d35307e3d92904545fb4
Instruction Fuzzy Hash: 93D0127151456197CE742E7C78445C337D8DA463303311B6BF4B0D32E0D3748D835A98

Function 00410F40 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00020000,00001000,00000004,004103C8), ref: 00410F51

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 91e70fcb83806e64083a323eb2e3944731c0f93bc5a264736d7e7e867113384b
Instruction ID: 07720a170ef6d50c918e2da5ca2fe5f7ddfb2e687cae5d42b3df39ad5892c3a5
Opcode Fuzzy Hash: 91e70fcb83806e64083a323eb2e3944731c0f93bc5a264736d7e7e867113384b
Instruction Fuzzy Hash: DDB012B039138075FF7843208C1FFE71200A340B87F0080A8BB05D81C4E7D064C0501C

Function 00410F60 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,0040664A,?,00406624), ref: 00410F6C

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1327e01bd96d07ee7a5a75ed87afd8ac78764046635013dfe708143c48cadece
Instruction ID: a132bef15ba7b425f1065e5a097c2bb543b957559febc4b94616fea76008790a
Opcode Fuzzy Hash: 1327e01bd96d07ee7a5a75ed87afd8ac78764046635013dfe708143c48cadece
Instruction Fuzzy Hash: 3BB0123424120031ED7807200C1AB5711005701701F10C1183102642C087D4B440450C

Non-executed Functions

Function 004180F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0041772A,?,Microsoft Visual C++ Runtime Library,00012010,?,0041BD34,?,0041BD84,?,?,?,Runtime Error!Program: ), ref: 00418102
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041811A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041812B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00418138

Strings

GetLastActivePopup, xrefs: 0041812D
GetActiveWindow, xrefs: 00418125
MessageBoxA, xrefs: 00418114
user32.dll, xrefs: 004180FD

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 595171f737e70550edc5abd38f068ead7bf618b78638dd3ba3c6e0fb0d2712e4
Instruction ID: 415fa372477fd235fe75ca2ef0ffa9dc0df8c28a9075a0eab2fce08d3bc4b09a
Opcode Fuzzy Hash: 595171f737e70550edc5abd38f068ead7bf618b78638dd3ba3c6e0fb0d2712e4
Instruction Fuzzy Hash: F5012572700241BF87219FB5AD849DBBAE9EB49751354443FB504C2220DB7CC9C39B69

Function 0040E38E Relevance: 1.7, APIs: 1, Instructions: 246COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E393

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ef3f0dd97c369c2370b5d413364e2112772f158c67037ae1847bc74799d93c78
Instruction ID: 6f1b27b05ce828494dcdc0ca2a3df983f9883c238a6bb878f092976797e95433
Opcode Fuzzy Hash: ef3f0dd97c369c2370b5d413364e2112772f158c67037ae1847bc74799d93c78
Instruction Fuzzy Hash: 68A1EB70E002099BCB18DF96C8919AEB7B2FF94318F14883FE915A7391D738AD52CB55

Function 0041561A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000155D4), ref: 0041561F

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c73d5215fbd9f9fa44ce3c8db65af6300706d886bcb472667e49ab47f89b2735
Instruction ID: 5929198a1c1d143ebb6d47ac1dc9c369120d6613942f0ebcbf50c4dd8c3cbf29
Opcode Fuzzy Hash: c73d5215fbd9f9fa44ce3c8db65af6300706d886bcb472667e49ab47f89b2735
Instruction Fuzzy Hash: 57A001B5A41605DA8A209F60A8095C5BE62A689B42B608166A811E5268DFB812419A69

Function 0041562C Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00415631

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 80fdf592cfe35f6ca0a49e156fc06359dfcc477da488757324292bdf2a3d88f1
Instruction ID: 3aa75b883a8314cf8793ebdd48d7cbf343a2d53b1036c531b3b3a2656884bc9f
Opcode Fuzzy Hash: 80fdf592cfe35f6ca0a49e156fc06359dfcc477da488757324292bdf2a3d88f1
Instruction Fuzzy Hash:

Function 00412480 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction ID: f7c307c9948f0502eef9bcc932476d7ce99f20ff48e31f419bd1d6f291c9dace
Opcode Fuzzy Hash: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction Fuzzy Hash: BD023A72A042114BC71DCE18C6902B9BBE2FBD5350F110A3FE496D7A84D7B8D8E5CB99

Function 00416076 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 6f6e9ae2f3605818a2c8e7767e34e4a9399a597c595f09bc79f2493b2d2310b3
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: 3EB17C7590120ADFDB15CF04C5D0AE9BBA1FF58318F25C1AEC85A4B382C735EA86CB94

Function 004039C8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1b8b3e4e9aa519cc0883e8f2e9399227ae21cf5f78173f93e12a8e0ced7762
Instruction ID: 7f21fa5966f3e8744179bfb474c2758024c7c669c00a9d4920a80f5d7b425c19
Opcode Fuzzy Hash: 8b1b8b3e4e9aa519cc0883e8f2e9399227ae21cf5f78173f93e12a8e0ced7762
Instruction Fuzzy Hash: D621427E370D0607A71C8B6AAD336B921D1E38430A7C8A03DE64BC53C1EE6DD595C60D

Function 00418CC1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction ID: 99a347de7b16eca0cbeab8721e5afb4e5ad46217b84f2e64c48f172e38bf97ef
Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction Fuzzy Hash: 2B21C83290062547C702DE6DF4845A7F391FBD4369F134727ED8467291C629A854D6E0

Function 00418D9B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction ID: 71e75c779d64757812c6fa0593de5e91038406040dd0a6985e9d44633d38c26d
Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction Fuzzy Hash: BC2137725105258BC701DF2DF4886B7B3E1FFD4319F638A3BD8818B1C1CA29D881D694

Function 004185ED Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0041BE00,00000001,00000000,00000000,74DEE860,004256E4,?,?,?,0041848E,?,?,?,00000000), ref: 0041862F
LCMapStringA.KERNEL32(00000000,00000100,0041BDFC,00000001,00000000,00000000,?,?,0041848E,?,?,?,00000000,00000001), ref: 0041864B
LCMapStringA.KERNEL32(?,?,?,0041848E,?,?,74DEE860,004256E4,?,?,?,0041848E,?,?,?,00000000), ref: 00418694
MultiByteToWideChar.KERNEL32(?,VB,?,0041848E,00000000,00000000,74DEE860,004256E4,?,?,?,0041848E,?,?,?,00000000), ref: 004186CC
MultiByteToWideChar.KERNEL32(00000000,00000001,?,0041848E,?,00000000,?,?,0041848E,?), ref: 00418724
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0041848E,?), ref: 0041873A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,0041848E,?), ref: 0041876D
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,0041848E,?), ref: 004187D5

Strings

VB, xrefs: 004186BD, 004186C8

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: VB
API String ID: 352835431-2416070386
Opcode ID: 003663a998c404720e509784b904756e9dc21287fecc91c3ae78f0538cf30181
Instruction ID: 75fdc42d4ca3b2d5695a32d80f34dcfea13c9c9e1b2be43f5f9a41df7731755a
Opcode Fuzzy Hash: 003663a998c404720e509784b904756e9dc21287fecc91c3ae78f0538cf30181
Instruction Fuzzy Hash: A6515F31900609EFCF218F65CC45EEF7FB5FB48754F20412AF925A12A0D7398991DBA9

Function 004172DF Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 004172FA
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 0041730E
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 0041733A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0041496A), ref: 00417372
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0041496A), ref: 00417394
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,0041496A), ref: 004173AD
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 004173C0
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004173FE

Strings

jIA, xrefs: 004173A8, 0041739A

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: jIA
API String ID: 1823725401-2590053038
Opcode ID: dcd9eacb03994a91aa73d6441958e3731b9086dbddb026e1bfa459d91ea586b1
Instruction ID: 8edd1d2af646b02ed721f394ba4169bf36ee68eca66066dd640126c456dfff16
Opcode Fuzzy Hash: dcd9eacb03994a91aa73d6441958e3731b9086dbddb026e1bfa459d91ea586b1
Instruction Fuzzy Hash: 7631D47250C219AFD7317F689C888FB7ABCE649354715053BFD66C3201E6288CC1E2AD

Function 00417606 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00417673
GetStdHandle.KERNEL32(000000F4,0041BD34,00000000,00000000,00000000,?), ref: 00417749
WriteFile.KERNEL32(00000000), ref: 00417750

Strings

..., xrefs: 004176C5
Microsoft Visual C++ Runtime Library, xrefs: 0041771F
Runtime Error!Program: , xrefs: 004176D9
<program name unknown>, xrefs: 00417683
x*B, xrefs: 00417614

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $x*B
API String ID: 3784150691-2083536112
Opcode ID: 9f3ee68eedca8c04870b7c4ba6519361572a149120d3a6d5458ca0bba870cf42
Instruction ID: d3223577c50248063a34d8f4d7298abe086d5d3d0ee639c6b3bd3f24b9ad2996
Opcode Fuzzy Hash: 9f3ee68eedca8c04870b7c4ba6519361572a149120d3a6d5458ca0bba870cf42
Instruction Fuzzy Hash: 5931D2726002186FDF20DA60DD46FDA377DEF89304F5005ABF544D6181EB78AAC48B5D

Function 0041883C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0041BE00,00000001,?,74DEE860,004256E4,?,?,0041848E,?,?,?,00000000,00000001), ref: 0041887B
GetStringTypeA.KERNEL32(00000000,00000001,0041BDFC,00000001,?,?,0041848E,?,?,?,00000000,00000001), ref: 00418895
GetStringTypeA.KERNEL32(?,?,?,?,0041848E,74DEE860,004256E4,?,?,0041848E,?,?,?,00000000,00000001), ref: 004188C9
MultiByteToWideChar.KERNEL32(?,VB,?,?,00000000,00000000,74DEE860,004256E4,?,?,0041848E,?,?,?,00000000,00000001), ref: 00418901
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,0041848E,?), ref: 00418957
GetStringTypeW.KERNEL32(?,?,00000000,0041848E,?,?,?,?,?,?,0041848E,?), ref: 00418969

Strings

VB, xrefs: 004188F2, 004188FD

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: VB
API String ID: 3852931651-2416070386
Opcode ID: f366ae1a1c4feb3856e7e49d67d86268e533ee02966d98845c911f14f75699a6
Instruction ID: 0deb4df31157d4fbbd2276260d368b45192e758527c12e7bc8b96f729eb23429
Opcode Fuzzy Hash: f366ae1a1c4feb3856e7e49d67d86268e533ee02966d98845c911f14f75699a6
Instruction Fuzzy Hash: 85418FB2A00209BFCF209F94DC86EEF7F79EB08754F10452AF915D2250C7389991DB99

Function 00417411 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0041746F
GetFileType.KERNEL32(?,?,00000000), ref: 0041751A
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 0041757D
GetFileType.KERNEL32(00000000,?,00000000), ref: 0041758B
SetHandleCount.KERNEL32 ref: 004175C2

Strings

$YB, xrefs: 004174A9

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID: $YB
API String ID: 1710529072-867103119
Opcode ID: 0f20f78b1d243ceb825b791af9b59c2038ed572102f9f62c4ccf998fd163e942
Instruction ID: 9157860cf2e7af3a35f89051d0ae9de0bf945cd889ae2d4a6076f2c4651d7c80
Opcode Fuzzy Hash: 0f20f78b1d243ceb825b791af9b59c2038ed572102f9f62c4ccf998fd163e942
Instruction Fuzzy Hash: B75135716086019FC720CF28D8897B63BB1EB05338F64466EC566CB6E0DB38C986C75D

Function 00415680 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0041569F
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 004156D4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00415734

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 0041570E
__MSVCRT_HEAP_SELECT, xrefs: 004156CF

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 352f7edc9f3896d13c070371f2d33d0b51665e116eb32c5a0d287e401f1eefe3
Instruction ID: 6eb182bd46f731c3af8b1d07a07b8df2d0194a1b299ff80343aa6f034c3c884c
Opcode Fuzzy Hash: 352f7edc9f3896d13c070371f2d33d0b51665e116eb32c5a0d287e401f1eefe3
Instruction Fuzzy Hash: 56312671945648EDEB3186706C87BDF3B788B46704F6400DBD199D52C2E6398ECA8B2D

Function 00403A90 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

CharUpperW.USER32(00000000,00000000,?,00000000,00000000,?,00403B58), ref: 00403AAB
GetLastError.KERNEL32(?,00000000,00000000,?,00403B58), ref: 00403AB7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000,?,00000000,00000000,?,00403B58), ref: 00403AD2
CharUpperA.USER32(?,?,00000000,00000000,?,00403B58), ref: 00403AEB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,00000000,00000000,?,00403B58), ref: 00403AFE

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 7c2300f256f82e2aee6372cd28c35fbf20af8ddddc15953858da8d33bcd8cfd2
Instruction ID: dd72d820dddc2be4d64e736f5eaa813d5c8cd4bb6d440344005d5656a272e87c
Opcode Fuzzy Hash: 7c2300f256f82e2aee6372cd28c35fbf20af8ddddc15953858da8d33bcd8cfd2
Instruction Fuzzy Hash: D60144B64002187ADB10ABE49C89DEBBE7CEB04259F014472F952E2281E2796E4487A8

Function 004152F3 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,00416CBF,0041798E,00000000,?,?,00000000,00000001), ref: 004152F5
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00415303
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0041534F

Part of subcall function 00416CCC: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00416DC2

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00415327
GetCurrentThreadId.KERNEL32 ref: 00415338

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 9020ed6c5573c52789434ca8060b3935b73b18465b1892a80f2ba475462c6b54
Instruction ID: c348f308811c55cc6791f5f2c72cac7d5a6c02788d8c3db17f30136ca92006f7
Opcode Fuzzy Hash: 9020ed6c5573c52789434ca8060b3935b73b18465b1892a80f2ba475462c6b54
Instruction Fuzzy Hash: B4F09632600615ABC6312B70AC096DB3A51EB857E1B15413AF951972A0DB78888197DD

Function 0041843D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(004256E4), ref: 00418463
InterlockedDecrement.KERNEL32(004256E4), ref: 00418478

Strings

VB, xrefs: 0041845C

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: VB
API String ID: 2172605799-2416070386
Opcode ID: 3f0e7dfc381ab69d5717ddb5ba06b4fa70db5411652d110c580bb33579a080f3
Instruction ID: b2465ecea32c92352f716010131fb348419f683e9d2febfe3e70f5b1b578e6df
Opcode Fuzzy Hash: 3f0e7dfc381ab69d5717ddb5ba06b4fa70db5411652d110c580bb33579a080f3
Instruction Fuzzy Hash: 35F0C232201612EBD720AF56ECC19CF6755EB81326F50843FF00989190DF7899C2995E

Function 0041435F Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56ffb8a6685455f091880630799685eddd8ac587d3428563be9e88dd716d36c
Instruction ID: 1ac5c9ddcf095474d6e2a383ff06e8771fc838f6ee07df02b13506851481717d
Opcode Fuzzy Hash: d56ffb8a6685455f091880630799685eddd8ac587d3428563be9e88dd716d36c
Instruction Fuzzy Hash: C891F671D01618ABCF21AB69CC41ADE7BB9EB857A4F240127F814B6290D73D8DC18A6C

Function 0041636C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,00420838,00420838,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000), ref: 0041638D
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000), ref: 004163B1
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000), ref: 004163CB
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000,?), ref: 0041648C
HeapFree.KERNEL32(00000000,00000000,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000,?,00000000), ref: 004164A3

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 61edb7c5b2a57b73fa0373c8b0061bfd64d3e4def081ef99dbe098b98f3bc666
Instruction ID: 1d273cd761051d77879f543994291e2c1f364a84a1ace75b4c6a1ba38ea4645d
Opcode Fuzzy Hash: 61edb7c5b2a57b73fa0373c8b0061bfd64d3e4def081ef99dbe098b98f3bc666
Instruction Fuzzy Hash: 1D310370640711EFD3309F24DC85BA6B7E4EB84764F12823AE56997791E778E881CB8C

Function 00409504 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409509

Part of subcall function 0040935A: EnterCriticalSection.KERNEL32(?,?,?,00409680), ref: 0040935F
Part of subcall function 0040935A: LeaveCriticalSection.KERNEL32(?,?,?,00409680), ref: 00409369

EnterCriticalSection.KERNEL32(?), ref: 00409536
LeaveCriticalSection.KERNEL32(?), ref: 00409552
__aulldiv.LIBCMT ref: 004095A1

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$H_prolog__aulldiv
String ID:
API String ID: 3848147900-0
Opcode ID: a31f7f313dfc0da48c948196a335c5e8fea939b4dae7cffcd2385e59b1d35c73
Instruction ID: 81a485ad15cb22f282f6c018201ee4179c2b1d1cd2674c5f201a60282c37c453
Opcode Fuzzy Hash: a31f7f313dfc0da48c948196a335c5e8fea939b4dae7cffcd2385e59b1d35c73
Instruction Fuzzy Hash: C6315076A00215AFCB11EF65C8819EFBBB5FF88704F00442AE51673692D779AD41CB64

Function 004047A8 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004047AD
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,00000000), ref: 004047D1
FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,00000000), ref: 00404814
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000,?,00000000), ref: 0040482F

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FormatMessage$FreeH_prologLocal
String ID:
API String ID: 3392428314-0
Opcode ID: d8114c00c851820dfd69355ab4a5a7d10c3f97c7ff5c1a94d174072509a20bce
Instruction ID: b23ee79e455563f0a2b187c1bc8aea4849c6785c5b1f5abfa42b55bee9ed31b8
Opcode Fuzzy Hash: d8114c00c851820dfd69355ab4a5a7d10c3f97c7ff5c1a94d174072509a20bce
Instruction Fuzzy Hash: 451170B5A00159AFDF01BFA59C419FFBB7DEF44349F00847AE112721E2DB391A01DA68

Function 00409374 Relevance: 6.0, APIs: 4, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00413030: SetEvent.KERNEL32(00000000,0040756D), ref: 00413033

GetDlgItem.USER32(?,000003E8), ref: 00409397
LoadIconA.USER32(00000000), ref: 004093B1
SendMessageA.USER32(?,00000080,00000001,00000000), ref: 004093C2
SetTimer.USER32(?,00000003,00000064,00000000), ref: 004093D1

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: EventIconItemLoadMessageSendTimer
String ID:
API String ID: 2758541657-0
Opcode ID: 426d8240eb7a06a459b3f470407d996c0274358d2b71b1374ad8138c79f04d47
Instruction ID: 34d2fc59b34559bed7d893ef409eb69d6d7528a9cba69d030baf66432b50efa3
Opcode Fuzzy Hash: 426d8240eb7a06a459b3f470407d996c0274358d2b71b1374ad8138c79f04d47
Instruction Fuzzy Hash: 4D015A30100B00AFD3319F21DD5AB66BBA1FB04721F008A2DF5A7959F0CB75B942CB48

Function 0040D5A3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D5A8

Strings

, xrefs: 0040D75F
, xrefs: 0040D787

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: 74feb26567ea79c8fd9d5f3f589634721b0a9a4a518abdc39c0b6b7ccedab932
Instruction ID: 116f94ee193b6a60a58d4aec76a07daa8eefdeb27c95ac76265691768f75313a
Opcode Fuzzy Hash: 74feb26567ea79c8fd9d5f3f589634721b0a9a4a518abdc39c0b6b7ccedab932
Instruction Fuzzy Hash: CB712431D0020A9FCB24DF99D981AAEB7B1FF48314F20467ED416B7691D734AA8ACF54

Function 00417E5D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00417E71

Strings

, xrefs: 00417EBA
, xrefs: 00417E96

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: be8999de8ad5c30073bbd0379d60ad0f54c653f5d04d814f41e486670cb2e0db
Instruction ID: 669041dcfce0968cbe3c51124f50cac4b21f3f9a56807733dc4743f672ff05a2
Opcode Fuzzy Hash: be8999de8ad5c30073bbd0379d60ad0f54c653f5d04d814f41e486670cb2e0db
Instruction Fuzzy Hash: 65417C312482585AEB219714CC49FFB7FF9DB02714F5404E6D149C7153C2794AC6C7BA

Function 00417092 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Setup.exe,00000104,?,00000000,?,?,?,?,00414974), ref: 004170B5

Strings

C:\Users\user\Desktop\Setup.exe, xrefs: 004170A9, 004170B3, 004170D8, 0041710E
@%k, xrefs: 004170BB

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileModuleName
String ID: @%k$C:\Users\user\Desktop\Setup.exe
API String ID: 514040917-4001849264
Opcode ID: 84d053b036df48e784d9c40d8f72a4f01e20f52c816047791c4f4213c32035a1
Instruction ID: bf09e70cde018ed4875ba2e87c80884ade2fb8340569e7ccc03294431e74d33e
Opcode Fuzzy Hash: 84d053b036df48e784d9c40d8f72a4f01e20f52c816047791c4f4213c32035a1
Instruction Fuzzy Hash: 591151B6A00219BFC721EF94DCC1CDBBBBCEB08758B5100ABF50597201EA745F4587A8

Function 00415ECA Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,00415C92,00000000,00000000,00000000,00413CC1,00000000,00000000,?,00000000,00000000,00000000), ref: 00415EF2
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00415C92,00000000,00000000,00000000,00413CC1,00000000,00000000,?,00000000,00000000,00000000), ref: 00415F26
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00415F40
HeapFree.KERNEL32(00000000,?), ref: 00415F57

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 712f9e2f9eec85a92a3a672498402ffd9fd7e765c5a6c8233a1a124cbc29739c
Instruction ID: 8f6381cf99308f7e34b2c2e49534b1224184cafd179dea44f4322364d011a6a4
Opcode Fuzzy Hash: 712f9e2f9eec85a92a3a672498402ffd9fd7e765c5a6c8233a1a124cbc29739c
Instruction Fuzzy Hash: A6114C31300A01EFC7308F59EC86DA6BBB5FB85760791462AF156D69B0D3719887CF58

Function 004154B1 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154BE
InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154C6
InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154CE
InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154D6

Memory Dump Source

Source File: 00000000.00000002.4176670713.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4176642028.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176729980.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176749424.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176766886.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176788108.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4176806988.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: ec7037d00a0fc94f488d53f3a91d2e26ae03bdd42e29aafad6c46e686e3ec5a2
Instruction ID: a8e831e61b8b61633fe4a4176da74b0e9d16ee726bcd83620c475df078586321
Opcode Fuzzy Hash: ec7037d00a0fc94f488d53f3a91d2e26ae03bdd42e29aafad6c46e686e3ec5a2
Instruction Fuzzy Hash: 0AC00231A11138ABCF312B55FC048463FA6EB852A03518072A1045203186612C12EFD8

Analysis Process: WebCompanion-Installer.exePID: 6488, Parent PID: 6292COMMON

Executed Functions

Function 06AF546A Relevance: 6.7, Strings: 5, Instructions: 466COMMON

Download Yara Rule

Strings

Pl^q, xrefs: 06AF58C5
Pl^q, xrefs: 06AF5701
Pl^q, xrefs: 06AF57BA
Pl^q, xrefs: 06AF584E
Pl^q, xrefs: 06AF555D

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: Pl^q$Pl^q$Pl^q$Pl^q$Pl^q
API String ID: 0-2405877317
Opcode ID: 317f307884a0629dcde82624e83486d422b79481baa0543dfa1961faa2f02a55
Instruction ID: c63b143310258695f80d5d720d2c112819cb7782fde1fcbe5630602b2d960bd5
Opcode Fuzzy Hash: 317f307884a0629dcde82624e83486d422b79481baa0543dfa1961faa2f02a55
Instruction Fuzzy Hash: 96F1D430B547458FC716EB78C99466BBBE6BF89300B1448A9E582CB372DB34EC45C791

Function 054382A0 Relevance: 3.2, Strings: 2, Instructions: 721COMMON

Download Yara Rule

Strings

fcq, xrefs: 05438986
fcq, xrefs: 05438651

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: fcq$ fcq
API String ID: 0-3114753931
Opcode ID: 9abb14b9fabce71d513e3d7fefbb91b91b6d0aaf09957dff9a8042f15ded5f57
Instruction ID: bb7c019a88d6fe08c2dc6def68cd3ddc41533dc17352c2cc949e914add1906a4
Opcode Fuzzy Hash: 9abb14b9fabce71d513e3d7fefbb91b91b6d0aaf09957dff9a8042f15ded5f57
Instruction Fuzzy Hash: 64423630B012158FDB14DB78C994AAEBBB6BF88304F148569E40ADB3A5DF35DC46CB81

Function 0543BBC4 Relevance: 2.9, Strings: 2, Instructions: 367COMMON

Download Yara Rule

Strings

LR^q, xrefs: 0543BE38
LR^q, xrefs: 0543C044

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: LR^q$LR^q
API String ID: 0-4089051495
Opcode ID: f2f09b9f20d56ebf6552be718fde30489d00c3d450c7ec6648b06ab8285748e5
Instruction ID: 7038b8c294487c442944fe37d265e9970d35ab16e9cef3465349d9046c815527
Opcode Fuzzy Hash: f2f09b9f20d56ebf6552be718fde30489d00c3d450c7ec6648b06ab8285748e5
Instruction Fuzzy Hash: 64E11B34A006099FCB24DF69C495AAEBBF2FF88314F148569E415EB3A5DB30ED46CB50

Function 0543BD98 Relevance: 2.9, Strings: 2, Instructions: 365COMMON

Download Yara Rule

Strings

LR^q, xrefs: 0543BE38
LR^q, xrefs: 0543C044

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: LR^q$LR^q
API String ID: 0-4089051495
Opcode ID: 4712396b94b211c97a0a5bdaed00e2cec8304e1617fdeb290956f511486e8cf4
Instruction ID: 05bba7e33dea397e09226684cdbe690c9a31beb1386163a62d71223272897851
Opcode Fuzzy Hash: 4712396b94b211c97a0a5bdaed00e2cec8304e1617fdeb290956f511486e8cf4
Instruction Fuzzy Hash: E4F11B34A00209DFCB14CFA9C585A9DB7B2FF48314F2586AAE415AB365DB31ED46CF50

Function 0543E1F8 Relevance: 1.7, Strings: 1, Instructions: 458COMMON

Download Yara Rule

Strings

$^q, xrefs: 0543E3FE

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: ff7bc4be97d10b94649ce4c9aac3062dddeedf12ea8c38d1e8adb664e4dfe312
Instruction ID: 654b7660750f14fbd6a388997c349bc2673734dfb473d969f9612b05be7e5edc
Opcode Fuzzy Hash: ff7bc4be97d10b94649ce4c9aac3062dddeedf12ea8c38d1e8adb664e4dfe312
Instruction Fuzzy Hash: D1F16E30B003059FDB14EB79D4A4BAEBBBBBF88300F148469E4469B3A5DF75AC458B51

Function 05415250 Relevance: 1.7, Strings: 1, Instructions: 450COMMON

Download Yara Rule

Strings

,7bq, xrefs: 0541565C

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: ,7bq
API String ID: 0-2588767232
Opcode ID: b4649c042d19247b58abc28690cb590e7bf4bfcb9a00bf191d4a825ca37aeee3
Instruction ID: 6854ff4da810f31acf7b21bce3f5cc0b3c83d9970bed6ed2d16e456e0497b444
Opcode Fuzzy Hash: b4649c042d19247b58abc28690cb590e7bf4bfcb9a00bf191d4a825ca37aeee3
Instruction Fuzzy Hash: 48022930B002189FDB14DB79D9947AEBBF6BF88300F1084A9D40A9B394EF359C82CB55

Function 06AF9E60 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VDi, xrefs: 06AFA117

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \VDi
API String ID: 0-1758818041
Opcode ID: 41a341b1e3f83b5e6078893d2ea0d08cc241c05227e6f529753af9e749e937ce
Instruction ID: a1b5db02b6253519fd422b7b99f814bbb0531f6a31a664605a82df385d17b151
Opcode Fuzzy Hash: 41a341b1e3f83b5e6078893d2ea0d08cc241c05227e6f529753af9e749e937ce
Instruction Fuzzy Hash: 23B19E70E10209CFDB50DFE9D8857DEBBF2AF88344F148129E619EB254EB749845CB92

Function 02C7F0D0 Relevance: .8, Instructions: 753COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eead344c6ef57125c906459fe4b2586a7cc32c6bb626da7aceb5e09a320e9e9
Instruction ID: 8e2f2c61494d827607dc9a49502be9f595ea18757eb40f99cf292436c5118158
Opcode Fuzzy Hash: 4eead344c6ef57125c906459fe4b2586a7cc32c6bb626da7aceb5e09a320e9e9
Instruction Fuzzy Hash: 8D62E974B002198FDB14DF64D998BADBBB2BF88301F1085A9E54AAB395DF349D81CF50

Function 064D05A8 Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f7fcea96f44659117214bb9c2fc66ec7f0e95f7b505ae4e49ed9f09cd83a64
Instruction ID: 55e6c14b001d940e03c0fb9206f42009a4fdbda1c0edb894add6bbb8d30101d1
Opcode Fuzzy Hash: 25f7fcea96f44659117214bb9c2fc66ec7f0e95f7b505ae4e49ed9f09cd83a64
Instruction Fuzzy Hash: 78424E70E002149FEB95DF69C8987AEBBF2FF88700F148669D4069B391DB749846CF91

Function 02C70DE0 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02977bc5e438184e43b59bf2994067a110caa215818744865b8c027f02390ec
Instruction ID: f645bd68fbd3316f13754b22b1f01d629adfa059b25d57017dd8fc7a015f8d0b
Opcode Fuzzy Hash: e02977bc5e438184e43b59bf2994067a110caa215818744865b8c027f02390ec
Instruction Fuzzy Hash: 99426574A00204CFCB58EB74E98876E7BB6FB88205F148569E48ADB358DF349D46CF91

Function 0543AF70 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab3286a3ae6809270d1f23680a616ddeea5299907ef205c92b6be56e728930b
Instruction ID: 858be9dbbc1580c353e9d31e2e17f41ca000a87e7de62074beed052f29d64c2e
Opcode Fuzzy Hash: bab3286a3ae6809270d1f23680a616ddeea5299907ef205c92b6be56e728930b
Instruction Fuzzy Hash: 38124C34A002158FDB14DF65C499BAEBBB2FF88300F1485AAE44AEB365DF74AD45CB50

Function 05437A28 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693ce9f54e6d7a4486c31692eecc9fbdc782d699809ef9f62887be5a0da32f47
Instruction ID: 27f7055075a3f1bdfc19d5f85b2da8ea0fa9a5149d7da47b4ba20730a3f25f09
Opcode Fuzzy Hash: 693ce9f54e6d7a4486c31692eecc9fbdc782d699809ef9f62887be5a0da32f47
Instruction Fuzzy Hash: 53F13974B402058FDB14DB74C499AAEBBB6FF88300F148569E4469B3A5DF35ED46CB80

Function 06AFB1B0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3668f16415e819bf117c3480cef8ddb78c56711b20dd5b6e2a7b425c393d5f
Instruction ID: 9b2ca4dbecd04c5febbdc4b5f0da93f27d80ed56d3e0d3b7ee496473b4a1ec9a
Opcode Fuzzy Hash: 2c3668f16415e819bf117c3480cef8ddb78c56711b20dd5b6e2a7b425c393d5f
Instruction Fuzzy Hash: 4CB18070B102098FD748ABB9D99477EB6FBAFC8240F188429E506DB3A8DE35DC41C761

Function 06AFA730 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da3afae94e0f961a058a9067ea4be5cf05498245f81ef2c1ba74d0b4e611a18
Instruction ID: a286167f3cbb4098c52c6ff6d9ac6aa3c51ec25895975e3bcdf22398cb554bf5
Opcode Fuzzy Hash: 1da3afae94e0f961a058a9067ea4be5cf05498245f81ef2c1ba74d0b4e611a18
Instruction Fuzzy Hash: A0B17170E10209CFDB50EFE9D9817DDBBF2AF48314F148529E619EB254EB749846CB82

Function 0543EF10 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4448c22db88b19dcecbedce72b6fc38c5c6039aaf5182bcc70e48b8e86bd976c
Instruction ID: 8a43d91c7cd4189ed17f73fc02de7cbd47a53060b3a3eaaf0af7a6d4a21d65e7
Opcode Fuzzy Hash: 4448c22db88b19dcecbedce72b6fc38c5c6039aaf5182bcc70e48b8e86bd976c
Instruction Fuzzy Hash: D4A18B30A002069FDB14DF65D494AAEF7F6FF88300B54C969E8459B369CB35EC86CB80

Function 0622043B Relevance: 21.0, Strings: 16, Instructions: 1009COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06220D27
`q, xrefs: 06220654
`q, xrefs: 06220588
$^q, xrefs: 062215F9
4'^q, xrefs: 06220CA5
4'^q, xrefs: 06221577
4'^q, xrefs: 06220DAC
c^q, xrefs: 0622146D
(_^q, xrefs: 06220AEF
@b^q, xrefs: 06220C0C
$^q, xrefs: 06220B9A
4c^q, xrefs: 06220951
$&_q, xrefs: 06220984
4c^q, xrefs: 062214F2
|-_q, xrefs: 062204BC
c^q, xrefs: 06220A1D

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: `q$$&_q$(_^q$4'^q$4'^q$4'^q$4'^q$4c^q$4c^q$@b^q$|-_q$$^q$$^q$c^q$c^q$`q
API String ID: 0-3238858861
Opcode ID: 3416adc9bba3ecec0c562fe60e25c82523b9c934eb1ddc10d4751b3eaddb776e
Instruction ID: 2498538b048c4313a25fddb324be542cd53400221edd58cf43666c7eb596cdfb
Opcode Fuzzy Hash: 3416adc9bba3ecec0c562fe60e25c82523b9c934eb1ddc10d4751b3eaddb776e
Instruction Fuzzy Hash: 4FB2E434A41218CFCB659F60D958ADDBBB2FF89300F1045E9D50AAB364DB369E85CF81

Function 06220448 Relevance: 21.0, Strings: 16, Instructions: 1000COMMON

Download Yara Rule

Strings

4'^q, xrefs: 06220D27
`q, xrefs: 06220654
`q, xrefs: 06220588
$^q, xrefs: 062215F9
4'^q, xrefs: 06220CA5
4'^q, xrefs: 06221577
4'^q, xrefs: 06220DAC
c^q, xrefs: 0622146D
(_^q, xrefs: 06220AEF
@b^q, xrefs: 06220C0C
$^q, xrefs: 06220B9A
4c^q, xrefs: 06220951
$&_q, xrefs: 06220984
4c^q, xrefs: 062214F2
|-_q, xrefs: 062204BC
c^q, xrefs: 06220A1D

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: `q$$&_q$(_^q$4'^q$4'^q$4'^q$4'^q$4c^q$4c^q$@b^q$|-_q$$^q$$^q$c^q$c^q$`q
API String ID: 0-3238858861
Opcode ID: fa100d3c6f2121fd64e0a10c3430103b8cba6704f33eef5f641a30690ea7fc50
Instruction ID: 35a2eeea62f4cc50ac00960430e00bd74a59f93d6cc213718a6e4e89e08c3a75
Opcode Fuzzy Hash: fa100d3c6f2121fd64e0a10c3430103b8cba6704f33eef5f641a30690ea7fc50
Instruction Fuzzy Hash: 79B2E434A41218CFCB659F60D958ADDBBB2FF89300F1045E9D50AAB364DB369E85CF81

Function 06229E20 Relevance: 7.7, Strings: 6, Instructions: 223COMMON

Download Yara Rule

Strings

$^q, xrefs: 06229FEE
4'^q, xrefs: 06229F13
$^q, xrefs: 06229EDB
$^q, xrefs: 06229FFA
$^q, xrefs: 06229F04
$^q, xrefs: 06229ECF

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3616224387
Opcode ID: 7a51a8a982b3922018ef228df8881ae6aea3a19e2c33c70289697168d025d8bb
Instruction ID: 8ba643dd67d81d397fe67f414307014f29186fe99d6413e1a39140a22d953f0d
Opcode Fuzzy Hash: 7a51a8a982b3922018ef228df8881ae6aea3a19e2c33c70289697168d025d8bb
Instruction Fuzzy Hash: 2571B171B60127AFDB989F69C854A6E3BB6BF88700B144459F902CB375CBB5DC41CB90

Function 054182E8 Relevance: 5.4, Strings: 4, Instructions: 421COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05418660
4'^q, xrefs: 0541864E
4'^q, xrefs: 0541876C
4'^q, xrefs: 0541875A

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 3d102ee7eb4b0b362dff054656b6acd95f5382eeda6481e6f66bb34173164341
Instruction ID: a281d8b7d077bb658d1876c45d4eebbca3f1c57e991bb3096a874a74edada66c
Opcode Fuzzy Hash: 3d102ee7eb4b0b362dff054656b6acd95f5382eeda6481e6f66bb34173164341
Instruction Fuzzy Hash: 45E1C37074410A5BCF05DF6988908AFBAB7FFC8200B54C96AE916DB369DF70DC429791

Function 05AAA037 Relevance: 5.1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

Strings

$^q, xrefs: 05AAA131
$^q, xrefs: 05AAA125
$^q, xrefs: 05AAA0F8
$^q, xrefs: 05AAA0EC

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: a2d5a901b1043eff8a848cdf84f4750d36a5a6a7516dc25bf1851677acf503ca
Instruction ID: cbc7f8b31fc3daefcf6980d723e8779cb057a2db257e6f45d049f3258759b256
Opcode Fuzzy Hash: a2d5a901b1043eff8a848cdf84f4750d36a5a6a7516dc25bf1851677acf503ca
Instruction Fuzzy Hash: 27416C71A00309EFDB18DFA5D948FAEBBF2BF88300F548429D402AB295DB759C45CB60

Function 06AF0040 Relevance: 4.2, Strings: 3, Instructions: 486COMMON

Download Yara Rule

Strings

Hbq, xrefs: 06AF0A33
, xrefs: 06AF015E
, xrefs: 06AF013F

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $$Hbq
API String ID: 0-767690520
Opcode ID: 0375db0524ee4c3f4ccf7302ee5de39e4fed074ce039b94bb4980a220842a5e4
Instruction ID: 2a80f4da7655fe72c70a856ef7a163c14a743ae33c3cbfcdcd4d36bf9d0dc8a7
Opcode Fuzzy Hash: 0375db0524ee4c3f4ccf7302ee5de39e4fed074ce039b94bb4980a220842a5e4
Instruction Fuzzy Hash: 7032D374D11604CFD750DF84C698AAEBBF2BB05309F26C099E1166F2A2D376D889CF91

Function 0622C558 Relevance: 4.2, Strings: 3, Instructions: 424COMMON

Download Yara Rule

Strings

(bq, xrefs: 0622C877
(bq, xrefs: 0622C8A3
(bq, xrefs: 0622C944

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: ae78b189ef5788ebac3bc4ae828f5b4ae9820e761e9211a162a8761a9732ff13
Instruction ID: c8c3861bfb02fd9b1bc4329f2d2bca323071f616edc0f1ee3fa91bdfa84ea289
Opcode Fuzzy Hash: ae78b189ef5788ebac3bc4ae828f5b4ae9820e761e9211a162a8761a9732ff13
Instruction Fuzzy Hash: 73024C35B102169FCB54DF68D994AAEBBF2FF88310F148569E906AB364CB31DC11CB91

Function 02C7B098 Relevance: 4.1, Strings: 3, Instructions: 327COMMON

Download Yara Rule

Strings

PH^q, xrefs: 02C7B11A
PH^q, xrefs: 02C7B18C
Hbq, xrefs: 02C7B404

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: Hbq$PH^q$PH^q
API String ID: 0-1943764995
Opcode ID: 7197e6932840dc72ac1afbfb9744af7405a348c66e64a4a4799f1346947bc03c
Instruction ID: e1562a9100f62727bff2bd74aec0f31a79732d2817aa60bfc3c752b20bb4a2c3
Opcode Fuzzy Hash: 7197e6932840dc72ac1afbfb9744af7405a348c66e64a4a4799f1346947bc03c
Instruction Fuzzy Hash: 54C118347002058FCB14DB78D998AAEBBB6FF88304F148569E909DB395DF74AD428B91

Function 06225D60 Relevance: 3.9, Strings: 3, Instructions: 193COMMON

Download Yara Rule

Strings

##, xrefs: 06225EEA
(Acq, xrefs: 06225F6B
C", xrefs: 06225E56

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (Acq$##$C"
API String ID: 0-1020493742
Opcode ID: 7e0452e3a775f23ad57c72fd9d4ba047d0e361c78f7d8558cacec7fa4fc85ab4
Instruction ID: 5d38957c01baf3bb0b0946e251d310fee07366c01b2c343e9f304da049480388
Opcode Fuzzy Hash: 7e0452e3a775f23ad57c72fd9d4ba047d0e361c78f7d8558cacec7fa4fc85ab4
Instruction Fuzzy Hash: 9E61F731A153659FCB05EF7CC8A069E7BF2AF86304F24816AD485EF255DB70984ACBD0

Function 06AFBF10 Relevance: 3.9, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

Hbq, xrefs: 06AFC04D
Hbq, xrefs: 06AFBFF5
(bq, xrefs: 06AFBFC9

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$Hbq$Hbq
API String ID: 0-2817990774
Opcode ID: c6e2f7ff06ce14749908523802c135ac858d0723d2a89f4e823c3f639d3fb1fc
Instruction ID: e2c8a04587d20ac4c8db563c0d86e5f1e1f28288177a2a7fff8fc29ebc2205fb
Opcode Fuzzy Hash: c6e2f7ff06ce14749908523802c135ac858d0723d2a89f4e823c3f639d3fb1fc
Instruction Fuzzy Hash: 5551D534B101199FC798EFA9D8509AF7BB6FFC4350B108569E6069B345CB31DD42CBA2

Function 05434540 Relevance: 2.9, Strings: 2, Instructions: 442COMMON

Download Yara Rule

Strings

Hbq, xrefs: 054349BA
4'^q, xrefs: 05434868

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q$Hbq
API String ID: 0-251405489
Opcode ID: 16331e438b8ca5e0aac4c507363f8773bd09c4ba744e93d0e32499f8a6eefa42
Instruction ID: 02406fc721c0bddf91531340aa2c1db78c3e1887b5e2364f609f6b2c9363b7a8
Opcode Fuzzy Hash: 16331e438b8ca5e0aac4c507363f8773bd09c4ba744e93d0e32499f8a6eefa42
Instruction Fuzzy Hash: CDF1AE74B002059FCB04EF79D895AAEBBF6FF88200B108569E8469B395DF75EC45CB90

Function 062217F0 Relevance: 2.9, Strings: 2, Instructions: 439COMMON

Download Yara Rule

Strings

(bq, xrefs: 06221804
d, xrefs: 06221A45

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$d
API String ID: 0-3334038649
Opcode ID: 9852eba0db0491e8d4d70842eb9e429b29bc72094e9ed92ce945232f77eaca68
Instruction ID: 7f73bab8acca09805f3153c5a14e88efec258e2ff2e397245a6b836551d47cb3
Opcode Fuzzy Hash: 9852eba0db0491e8d4d70842eb9e429b29bc72094e9ed92ce945232f77eaca68
Instruction Fuzzy Hash: CA02BE34A106169FCB14CF19C484D6ABBF2FF88310B15C669E95A9B3A5C730FC56CB90

Function 06AF2570 Relevance: 2.9, Strings: 2, Instructions: 432COMMON

Download Yara Rule

Strings

(bq, xrefs: 06AF2888
(bq, xrefs: 06AF29D0

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 21da433fb891930596a4161f0d86827da4e0e00606f9c1efaa62cce741dc8c52
Instruction ID: 732754b78cba09922f04b1f25df17f16a8242c2cf4691481d8d44c3a0fef3f22
Opcode Fuzzy Hash: 21da433fb891930596a4161f0d86827da4e0e00606f9c1efaa62cce741dc8c52
Instruction Fuzzy Hash: 82F1C134B002059FCB54EFA8D494AAEBBB2FF89310F14842AF906DB355CB35E905CB91

Function 06AF0006 Relevance: 2.9, Strings: 2, Instructions: 429COMMON

Download Yara Rule

Strings

, xrefs: 06AF015E
, xrefs: 06AF013F

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-645672565
Opcode ID: 5082160aece567950137449228e351239bfeb92cccd285d272d43cce34d6d0df
Instruction ID: d03831e3a98b6bad71ef51e723c5860426989572293b68695e74cacb5d3cee30
Opcode Fuzzy Hash: 5082160aece567950137449228e351239bfeb92cccd285d272d43cce34d6d0df
Instruction Fuzzy Hash: B622D474D11604CFD740DF84C698EAABBF2BB05309F26C099E1166F2A2D376D949CF91

Function 05419A1A Relevance: 2.9, Strings: 2, Instructions: 400COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05419BDF
4'^q, xrefs: 05419BF1

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 067080c6a13a3ce9c836d6a90b54c8a502c17782bd9c5a2a9cf924a15b8c7f25
Instruction ID: 943922d087dd7573a85828114365d9fd2cd272f7fab2abee62802f133c76c631
Opcode Fuzzy Hash: 067080c6a13a3ce9c836d6a90b54c8a502c17782bd9c5a2a9cf924a15b8c7f25
Instruction Fuzzy Hash: 2EF130347002568FCB04DF68D994AAEBBF6FF88300F548669E8469B365DB30EC45CB94

Function 0541E048 Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

(bq, xrefs: 0541E0E1
(bq, xrefs: 0541E130

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: c3a1ee46a6e0af2515be94e8856d9f6b19d84f64dde9ac45f33713a2b9857eba
Instruction ID: 994323dd1436ecbfba69f655bcd003f083dad671b1c641986e25ba68a02fc258
Opcode Fuzzy Hash: c3a1ee46a6e0af2515be94e8856d9f6b19d84f64dde9ac45f33713a2b9857eba
Instruction Fuzzy Hash: F9B13934A012158FCB24DF78D4996AABFF6FF89311B108569E846DB391DB34EC45CB90

Function 02C7B05D Relevance: 2.7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

Strings

PH^q, xrefs: 02C7B11A
PH^q, xrefs: 02C7B18C

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 2046b4366bdb929086819f178e0d5dbed8386dd24180384e9c43a59b49fa155c
Instruction ID: 2f86941e927bfc2344587c45641a8b22476c09704da7f6704a853c33e9afd877
Opcode Fuzzy Hash: 2046b4366bdb929086819f178e0d5dbed8386dd24180384e9c43a59b49fa155c
Instruction Fuzzy Hash: 8C810C34B002098FDB04DB69D994AAEBBB2FF89304F1585A5D805EB365DB34DD42CBA1

Function 06223D60 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

(bq, xrefs: 06223D88
(bq, xrefs: 06223EEF

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 492b3c72f14860fe75a1bb875d33d316faa2dc6b90dda884e7a4790947a156a9
Instruction ID: 4999e4f91243368755b76da24736011f1b13d62e9d57d6b6af03b5db250f96f1
Opcode Fuzzy Hash: 492b3c72f14860fe75a1bb875d33d316faa2dc6b90dda884e7a4790947a156a9
Instruction Fuzzy Hash: 386134317146539FC765DB39D450A6ABBF6EFC5210B1881BDE84ACB362DA35EC06CB80

Function 06AFA49C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

\VDi, xrefs: 06AFA517
\VDi, xrefs: 06AFA66A

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \VDi$\VDi
API String ID: 0-55143252
Opcode ID: 7bb8d4a8ca83b78f6148dd15052ec7e07f2b98ecd765c06b78bb74bf7d844550
Instruction ID: bd033ba31bde080ec1ee2a69c47e7951bee4c284c4d0484df6bb73e8802c9c2a
Opcode Fuzzy Hash: 7bb8d4a8ca83b78f6148dd15052ec7e07f2b98ecd765c06b78bb74bf7d844550
Instruction Fuzzy Hash: 1B714AB0E10209DFDB50DFE9C8817DEBBF1AF48354F148129E619AB254EB749846CF92

Function 06AF2AD0 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

,bq, xrefs: 06AF2AF8
4'^q, xrefs: 06AF2C34

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: ,bq$4'^q
API String ID: 0-1386295989
Opcode ID: fb204413d3ec6604acd05eecf87fe6b84d08e757ec53c37370f035c62d9b8aa5
Instruction ID: b210faf28a63953f3f2e1967fa8628a54f52aa15bf37515cca72f1a328b06799
Opcode Fuzzy Hash: fb204413d3ec6604acd05eecf87fe6b84d08e757ec53c37370f035c62d9b8aa5
Instruction Fuzzy Hash: FE51C571B101058FCB55EFADC4506AFBBF6EFC9210715456AE905DB369CB30DD028BA1

Function 06AFA4A8 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

\VDi, xrefs: 06AFA517
\VDi, xrefs: 06AFA66A

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \VDi$\VDi
API String ID: 0-55143252
Opcode ID: 6efde06199bf2ed74aefd3ee6edacc392946b8ae221c79e09a8386fdd3638039
Instruction ID: 0e95db2c2e64386c5c601e44320b583a4a04f9b76c273e5c72f4dfa3657bc924
Opcode Fuzzy Hash: 6efde06199bf2ed74aefd3ee6edacc392946b8ae221c79e09a8386fdd3638039
Instruction Fuzzy Hash: 9E715C70E10209DFDB50DFA9C8807DEBBF2BF88314F148529E519AB254EB749846CF92

Function 02C7A180 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

Hbq, xrefs: 02C7A1F4
(bq, xrefs: 02C7A28D

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: 356ab7ff8357801bfa3f9a420ada3004beda11f2a8133e4cd3fccaf3f786bf79
Instruction ID: f90ba309a6174c1c6538cc6ba61464246a7135c84b49b70153f4c575f83fb339
Opcode Fuzzy Hash: 356ab7ff8357801bfa3f9a420ada3004beda11f2a8133e4cd3fccaf3f786bf79
Instruction Fuzzy Hash: 6951E2317002048BDB24AB79E8587AE7FB6AFC9311F18446AE906DB385DF75DC42CB90

Function 02C78FD8 Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

3{o^, xrefs: 02C792AB
C{o^, xrefs: 02C79264

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 3{o^$C{o^
API String ID: 0-1295501051
Opcode ID: af51b598b94ad7fe36630de489af1b898f36b4c11e9f2e90d69a6aed3336e543
Instruction ID: 1f3bdf0bac41f45ab29715164cc8a6727d19851d66ec2ed802bbea49c8b48796
Opcode Fuzzy Hash: af51b598b94ad7fe36630de489af1b898f36b4c11e9f2e90d69a6aed3336e543
Instruction Fuzzy Hash: C64166357206549FCB06AFB8A81D95D7FE2FF8920071880A9E50ACB3A2DE35DC11DB85

Function 06AFB760 Relevance: 2.6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

Strings

(bq, xrefs: 06AFB7FA
(bq, xrefs: 06AFB826

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: bda2c68e951cf21e545e8cd73a179b22173a8228d890091744e7c1de23611fec
Instruction ID: bf60c9df6b7882b8d90d3567eb3a4fe4c1690abaf4444062be47d740b0abc524
Opcode Fuzzy Hash: bda2c68e951cf21e545e8cd73a179b22173a8228d890091744e7c1de23611fec
Instruction Fuzzy Hash: B0311530B142119FD795BBA9D8A47AE7AFAEBC5210F14402DE2029B381CE719C048BE6

Function 05AAD158 Relevance: 2.6, Strings: 2, Instructions: 109COMMON

Download Yara Rule

Strings

(bq, xrefs: 05AAD1B8
4'^q, xrefs: 05AAD161

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$4'^q
API String ID: 0-3799531831
Opcode ID: f69928d5c2f8649e55562cc277cbbfbea59ce8d43aa51bf7d7b6ec7549e4b76b
Instruction ID: 242bdbc7c153a4584ec1908aa745e35eb44c5c36ae118ae0c68cfb6d302b17fd
Opcode Fuzzy Hash: f69928d5c2f8649e55562cc277cbbfbea59ce8d43aa51bf7d7b6ec7549e4b76b
Instruction Fuzzy Hash: 743104313043028FC714AB69D894EAEBBA7FFC5220B14452DE59A8B750DF34DC0A8795

Function 05AAF963 Relevance: 2.6, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

(bq, xrefs: 05AAF9C7
4'^q, xrefs: 05AAF971

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$4'^q
API String ID: 0-3799531831
Opcode ID: a4a321a167ff48827148171561b9ef7f88476640c322829669ec4458603b3e5c
Instruction ID: 620a375e4d753e3f6c47bd2504b1e28c2067d0535854c627d64123ae34846926
Opcode Fuzzy Hash: a4a321a167ff48827148171561b9ef7f88476640c322829669ec4458603b3e5c
Instruction Fuzzy Hash: BC2137363042015FC3199B7AA850DBFBBEBEFCA251318816AE44ACF351DF20DC068361

Function 05AAFC40 Relevance: 2.6, Strings: 2, Instructions: 60COMMON

Download Yara Rule

Strings

,bq, xrefs: 05AAFC64
(bq, xrefs: 05AAFC7E

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq$,bq
API String ID: 0-1616511919
Opcode ID: 4aa7fd36b8cf3ca4d1e99fdc7d5bc2a593234f30ca3522882c5c4bacab7e296d
Instruction ID: 9b09d5799da4b9f8173b93c645d66428d508b308b155c4138cd6d05707231e72
Opcode Fuzzy Hash: 4aa7fd36b8cf3ca4d1e99fdc7d5bc2a593234f30ca3522882c5c4bacab7e296d
Instruction Fuzzy Hash: AB0190353191614FC7185F79981456D7BF5BF8266170A00EBE945CB3A2DE29CC00C7A2

Function 06AF4144 Relevance: 2.5, Strings: 2, Instructions: 21COMMON

Download Yara Rule

Strings

$^q, xrefs: 06AF4148
$^q, xrefs: 06AF4154

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: c509df1b8023c727bcb3143ae0f5002b478794fd43ca5d43ae406256fdbf0742
Instruction ID: 4cf1da98b6c0a3dd252ab724670aafcf4decd7641a79d56495f8c41f0d4f245a
Opcode Fuzzy Hash: c509df1b8023c727bcb3143ae0f5002b478794fd43ca5d43ae406256fdbf0742
Instruction Fuzzy Hash: 3FE0E632F610188FA7649B99A844457B7F5EB98A11710446BE7119F316CB318C2587E6

Function 02C74A58 Relevance: 2.0, Instructions: 1979COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8de46dc092ca1e272be0143a8a2d1f3f56d0afd3ae13037557b94c56674c44
Instruction ID: 1c26e4c83d03a82f4b0d63497684a693408a880254051243133315e261eebfd8
Opcode Fuzzy Hash: aa8de46dc092ca1e272be0143a8a2d1f3f56d0afd3ae13037557b94c56674c44
Instruction Fuzzy Hash: 7B233375912204DFCF65BFA1DA28759B732FB4A346B20846BED0263764CB7A8D52DF00

Function 02C74A68 Relevance: 2.0, Instructions: 1978COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a0ea08d7d8600b6ce24aa324a87bc6e3ea6fe34eb17fa255b2aa96056a390a
Instruction ID: 4012a1ee37c077564fd73863619ff4ddbacd367a4e308074fac5313018b590f9
Opcode Fuzzy Hash: 40a0ea08d7d8600b6ce24aa324a87bc6e3ea6fe34eb17fa255b2aa96056a390a
Instruction Fuzzy Hash: A0233375A12204DFCF65BFA0DA24759B732FB4A346B20846BED1263764CB7A8D52DF00

Function 05419D40 Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

T,6j, xrefs: 05419FD9

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: T,6j
API String ID: 0-1879564638
Opcode ID: 70eef178b8c0265812f3996c171b0d6850545a7dfa1170c00242c8a2b965287f
Instruction ID: 4bb5d06cf77aff6411fdcc7f16b89ac4deac78c9c5b8155a004bdab47a8b84e4
Opcode Fuzzy Hash: 70eef178b8c0265812f3996c171b0d6850545a7dfa1170c00242c8a2b965287f
Instruction Fuzzy Hash: 00F15E747002158FCB54DF78D894AAE7BE6FF89300B1445A9E90ADB3A6DE34DC46CB90

Function 06AF12C8 Relevance: 1.6, Strings: 1, Instructions: 392COMMON

Download Yara Rule

Strings

(bq, xrefs: 06AF171C

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: bac0cc4c847954084a269ac3e04b81a26a32a917f7692914479dcb0ea3af3665
Instruction ID: 551fac816beb677173cd27dcf0c395ed341ccbd8c185206539e8ac7cae01a1b9
Opcode Fuzzy Hash: bac0cc4c847954084a269ac3e04b81a26a32a917f7692914479dcb0ea3af3665
Instruction Fuzzy Hash: 4BF16730E103598FDB55EFA8C488B9DBBF2AF85304F148194E549AF291DB34ED85CB91

Function 0541ADE0 Relevance: 1.6, Strings: 1, Instructions: 347COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0541B205

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 16da5aa44cecced542ead6c309a2536cdacadfa50ba5cc67bdec170f4b27ac21
Instruction ID: 528eaa4557ad35f3b6ad2fbbaf23f34085cb2bd19ccc411e5a419ceeee6913d7
Opcode Fuzzy Hash: 16da5aa44cecced542ead6c309a2536cdacadfa50ba5cc67bdec170f4b27ac21
Instruction Fuzzy Hash: 24D17C347002018FC758EF38D594AAABBE6FF88301B148569E84ACB765DF75EC46CB90

Function 05AAE4A0 Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

(bq, xrefs: 05AAE833

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 573071298386ff77122674483bc31dd3b9726348dbf92aa29dda0cf8472007b7
Instruction ID: d46bffbf68decde24e206d70c9c54b030ee36bb307ce316e705227f082c4e35e
Opcode Fuzzy Hash: 573071298386ff77122674483bc31dd3b9726348dbf92aa29dda0cf8472007b7
Instruction Fuzzy Hash: 3CD1BC75E002598FDB15CFA8C884AADBBF6FF89300F1481A9E855AB355EB30ED45CB50

Function 02C7178E Relevance: 1.5, Strings: 1, Instructions: 295COMMON

Download Yara Rule

Strings

fcq, xrefs: 02C717B6

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: 9466d39494c7cdf8f1594a4034b24f6234cfac07cfb44e83b4ef76143619c6f4
Instruction ID: c36f281bca72fd1bedf2aeca2957092b18d1bf9e0b6b84924e5ba01f77ed92d9
Opcode Fuzzy Hash: 9466d39494c7cdf8f1594a4034b24f6234cfac07cfb44e83b4ef76143619c6f4
Instruction Fuzzy Hash: 3EB10070B052529FDF159F34845422EBBF6AFC6308F1884AAC4899B396DB35DC86C792

Function 05AAD287 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

,bq, xrefs: 05AAD3CB

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: ccac8f6b17d8d5815c2aa539141b6b16ced9b5555814bb2c8bae122213d5a6a2
Instruction ID: f6727eaeade0186bac3a1f7a7656da2bc42fdad731d4db25d925b67315c4cf11
Opcode Fuzzy Hash: ccac8f6b17d8d5815c2aa539141b6b16ced9b5555814bb2c8bae122213d5a6a2
Instruction Fuzzy Hash: 6491F871B4420A8FCB949B398958D7A3BF77FC66047204465C5A7CFBA4EF21CC468762

Function 06AF9E54 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VDi, xrefs: 06AFA117

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \VDi
API String ID: 0-1758818041
Opcode ID: e6d3f6b82c579eaff6af9942bad137ba7fe7d224c702e73b2b8465e93ab0e1b7
Instruction ID: 41b0b7fe4df54a6f4975422f85cbb5e8228251f01bf1403b35f3bd9dcc7ff204
Opcode Fuzzy Hash: e6d3f6b82c579eaff6af9942bad137ba7fe7d224c702e73b2b8465e93ab0e1b7
Instruction Fuzzy Hash: 3AB19D70E10209CFDB50DFE9D8857DEBBF1EF48344F148129EA19AB254EB749885CB92

Function 06AF6FF0 Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06AF72E8

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4c^q
API String ID: 0-396817635
Opcode ID: 49315d4f4a8ec2dfc927f66cf7b0e7ee34ec45a8182fec022e2273535b6f0fad
Instruction ID: c91b0f6f00a5a833ca568269859530468bce99febd9b383359cf6a77c5e91042
Opcode Fuzzy Hash: 49315d4f4a8ec2dfc927f66cf7b0e7ee34ec45a8182fec022e2273535b6f0fad
Instruction Fuzzy Hash: 618154307282615FD764A7A9FC90ABABBB5EF45300F0444A7F645CB692D666D880C3E3

Function 05434129 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0543426B

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 4f067b5e0f782bf3bb88df74ede32cb5eddb0b0f820ae2d252af2d95bb4b2411
Instruction ID: c61cc26e60a7accc9e639881fe7d6227e8f48d10a5e51bda9791adddc1f02db1
Opcode Fuzzy Hash: 4f067b5e0f782bf3bb88df74ede32cb5eddb0b0f820ae2d252af2d95bb4b2411
Instruction Fuzzy Hash: 07717E347002158FDB199B79D959AEE7BF6FFC8200B14846AE802DB3A5DE35DC02CB90

Function 02C79F30 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

(bq, xrefs: 02C7A0B8

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 92ddb1542d3c14448febe889dda9bf911736cd69e921639c48679333731775a9
Instruction ID: 9cbcc035a430f75d212133198f361436ea59d6fe44efe9d22e147afd73352e6f
Opcode Fuzzy Hash: 92ddb1542d3c14448febe889dda9bf911736cd69e921639c48679333731775a9
Instruction Fuzzy Hash: 89516D30B002059FDB14DF69D484AAEBBF6BF89314F158469E806EB361DB75ED41CB90

Function 02C7CD58 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02C7CEB7

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: e55283bac507e1fa033d69e39d478718f097535134035ac234aa6c813ad64f49
Instruction ID: 3635f1c4bb2ec3df4d6dfcee96b3983b73bb1cdd82f0bc0444f09aa38d87351a
Opcode Fuzzy Hash: e55283bac507e1fa033d69e39d478718f097535134035ac234aa6c813ad64f49
Instruction Fuzzy Hash: 7E41E1317012128FD318AB79E46576EBBAAEFC5250F1484BAE40ACB390EF75DD428790

Function 02C787A0 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

(bq, xrefs: 02C787FE

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 7f3687c89c5e192dc4060eefb62a1cf71b00f92d31a12695282f1b537ca07f72
Instruction ID: cd81d2933fcbe0894c81662799120ce6e90b11e3f8ff795d33c5186a7d00fea8
Opcode Fuzzy Hash: 7f3687c89c5e192dc4060eefb62a1cf71b00f92d31a12695282f1b537ca07f72
Instruction Fuzzy Hash: 354102313043408FC321AB7DE85861A7FEAAFC625071446BAE506CB386EE74DC42C791

Function 0622F508 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

(bq, xrefs: 0622F5E9

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: a866c5222ca62a7f2320ef7887239cf794f4faeba674905698bdd06723efead2
Instruction ID: 21a0c4ef9fdc8370307205395b1dcc2b50c1a13233d7f42e07cb1ba49d9a3df5
Opcode Fuzzy Hash: a866c5222ca62a7f2320ef7887239cf794f4faeba674905698bdd06723efead2
Instruction Fuzzy Hash: 8E51F435B1021AAFCB05DF64C8949AEBBB6FFC9300F14816AE905AB355DB319C46CB90

Function 0541D2E8 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0541D2FD

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 802265f84d84a6110f6b5448cecbedbfcd43295be8c6f1dc7eb38111f154e9a5
Instruction ID: be71621d589bc69c462429225f79b09aecbd87b1cfbad4adc1d048b8705b7c2e
Opcode Fuzzy Hash: 802265f84d84a6110f6b5448cecbedbfcd43295be8c6f1dc7eb38111f154e9a5
Instruction Fuzzy Hash: BF41E6307002058FC724AB68E4947AEBBE7EFC4314F148969E94ACB749DEB1AC458751

Function 06AF1F00 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

(bq, xrefs: 06AF1FBD

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 20564f61881975c9415ae4d561bbaa4c9e58ac84a9550ec7be17e8149aa4e32e
Instruction ID: ed71a577b9691bc282a32fca3186fcac92e7e37266f0a87b166e8e8cf7ab86d1
Opcode Fuzzy Hash: 20564f61881975c9415ae4d561bbaa4c9e58ac84a9550ec7be17e8149aa4e32e
Instruction Fuzzy Hash: 7641F131B102059FCB14EFA4D854AAEBBB6FF88310F10812AE906EB395CB359D05CB91

Function 06AFD810 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06AFD86B

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4c^q
API String ID: 0-396817635
Opcode ID: 52da0c3fe7845043659692b2f4e3568a9064f82bb7747f2075d0048fb26be47b
Instruction ID: 08fa3034fd7dc6edab294bb7719b665de07281f4e3f97760961f8dacd65bdf9b
Opcode Fuzzy Hash: 52da0c3fe7845043659692b2f4e3568a9064f82bb7747f2075d0048fb26be47b
Instruction Fuzzy Hash: 8241E474B102009FEB95FFA5DA50B7A7AF6AB88300F148029F545DB385DA7ADC01C7A2

Function 06AFD802 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06AFD86B

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4c^q
API String ID: 0-396817635
Opcode ID: 10304e9e0b5373e431871e7abad5a04a8347fb10fb256317e028bbb57dc3594f
Instruction ID: 48d7c8aba1b536352a252c68304790fee001ec68efd7638d5af2b9a1e3aa2226
Opcode Fuzzy Hash: 10304e9e0b5373e431871e7abad5a04a8347fb10fb256317e028bbb57dc3594f
Instruction Fuzzy Hash: B341F270B102019FDB95EF64D995BAABBF6AF84310F048019F545DB281DB39D801CBA2

Function 06AFD76D Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06AFD86B

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4c^q
API String ID: 0-396817635
Opcode ID: 7dbc3e2fd99e4bc670c3ff69b97b3dbb2387d2e8186ac6425ee8961afe179ffd
Instruction ID: c4d7912e497a52ae0378867890a313d0d4eedfc36c2f6bda7f6241ed376f069c
Opcode Fuzzy Hash: 7dbc3e2fd99e4bc670c3ff69b97b3dbb2387d2e8186ac6425ee8961afe179ffd
Instruction Fuzzy Hash: 14412471B083829FE712AB7499957697FF6EF46324F08409AE081CF1D2DB299806C732

Function 062217E0 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

(bq, xrefs: 06221804

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 99c48ae4bb3c23afcb8338583dc36a6c1e7f6b898cba54d1a242dfe90caedbd9
Instruction ID: 430e0f42baebf92e9497e8a6180392960a83393eeb9fd4edd6a14cb97c812a3e
Opcode Fuzzy Hash: 99c48ae4bb3c23afcb8338583dc36a6c1e7f6b898cba54d1a242dfe90caedbd9
Instruction Fuzzy Hash: FC41BC30A106169FDB54CF29C484DAAF7F2FF89310B19C569E95AAB351CB30E851CF90

Function 05AAEF38 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(bq, xrefs: 05AAF05E

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: dba2ce8dc833555b8a9e07c9ec3d4babb5953a261aadcbbc82e31e261f860338
Instruction ID: e5a67a83469909762baf5ec90bd04bb615fa6ed2702de80f3891cb962ef7f2ab
Opcode Fuzzy Hash: dba2ce8dc833555b8a9e07c9ec3d4babb5953a261aadcbbc82e31e261f860338
Instruction Fuzzy Hash: BD41DE36B042159FDB19DB68D894BAEBBF6FF85300F14802AE516EB291DB35AC05CB50

Function 06AF179A Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(bq, xrefs: 06AF18B2

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: fc13a2cf7915c1fedc1519fd71ee7f470c38cdacad757eaefd9f2bb9e0324552
Instruction ID: f2931a59874c9765412baf64efb759063eaf98bd85091b619d1ca2b7ec124e69
Opcode Fuzzy Hash: fc13a2cf7915c1fedc1519fd71ee7f470c38cdacad757eaefd9f2bb9e0324552
Instruction Fuzzy Hash: 04419F30A14209DFDB54DFA5C884AAFBBFAEF89310F148469E505AB351DB30AD01CBE1

Function 02C73CD0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

(bq, xrefs: 02C73DE8

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: b8b346a660b0ce8866ecf224c43991bac861d6d9173f30b566d2dd14eedb872f
Instruction ID: bb66aad7e804d805001d5dc7d428cc8aec8aaace083c88d4e7243981de16320a
Opcode Fuzzy Hash: b8b346a660b0ce8866ecf224c43991bac861d6d9173f30b566d2dd14eedb872f
Instruction Fuzzy Hash: 4431AB30B142448FD718AB79D8997AE7EB6EFC8300F1444A9E406EB396DF749C46CB51

Function 05436900 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

4'^q, xrefs: 054369A9

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: ab9ce95ede8e8ba52a68e50cfa4a401d687621d90db22b278af5193c7c82350d
Instruction ID: ddf67384a676de72b0979bc0ddcde7d3c314e4924fc999b7a920e12fa39d06db
Opcode Fuzzy Hash: ab9ce95ede8e8ba52a68e50cfa4a401d687621d90db22b278af5193c7c82350d
Instruction Fuzzy Hash: AC3145313093414FC7259B38C8956EBBFA6EF8A25070445AEE886CF392EB65DC06C750

Function 02C74381 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02C743C2

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 8b56bf66448a2891bda10662aafb9478b128ff45ae5abb991adc628d28bf4ac6
Instruction ID: 8827cd8fa5d06cfe947813032c7f2cd23e2783d04e22c864757866052f35be2e
Opcode Fuzzy Hash: 8b56bf66448a2891bda10662aafb9478b128ff45ae5abb991adc628d28bf4ac6
Instruction Fuzzy Hash: 6D31A5302106029FC705AB25E59965EFFE6FFC43107548A6CE0568B7A5DF71F98ACB80

Function 02C796F8 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02C797D4

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 29c4aabfd0d2e4682a00e428a26d56a8552dcd680fb7447ca7aa06830960a0e0
Instruction ID: 9aee350d7d0b4686ec66af8def1399ef344e77533e159d9a02d6ce352f2ea6eb
Opcode Fuzzy Hash: 29c4aabfd0d2e4682a00e428a26d56a8552dcd680fb7447ca7aa06830960a0e0
Instruction Fuzzy Hash: C721B0313002128FC715DB79E885A5EBBEAEFC9315B184AB9E409CB356DF70DC428B91

Function 02C74929 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

(, xrefs: 02C74A1D

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-2408637067
Opcode ID: e7258347ab552ce446b504ce4aefb03ca6cfb6471c625d7abd1a1960e3925cd8
Instruction ID: e488a8ec22c6b2f57c42a2f94a401591683b97e31e92bfbeb68435cbd342a9ad
Opcode Fuzzy Hash: e7258347ab552ce446b504ce4aefb03ca6cfb6471c625d7abd1a1960e3925cd8
Instruction Fuzzy Hash: 7F31E431E106068BCB10AF79D4552EEBBB9FF85300F208629D459A7281EF75A945C791

Function 06226670 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

,bq, xrefs: 06226719

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: 1e509da0f71e05bb2f6f0ef79f559cfbe91b1f6202b263d60f6ff834b9efe33d
Instruction ID: 615e0ad78dbe90447bcfd9b598f47af54e94f4c0c5d349494954a6bfefbd3a2e
Opcode Fuzzy Hash: 1e509da0f71e05bb2f6f0ef79f559cfbe91b1f6202b263d60f6ff834b9efe33d
Instruction Fuzzy Hash: F621A036710222AFC764DB28D894A2EB7B6FF89710B118469D44A8F361CB70EC41CBA0

Function 02C74938 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

(, xrefs: 02C74A1D

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-2408637067
Opcode ID: b4318b0569d2c200f4698a796e8e0ce1bc5d1e7bbf0a42f9cdf36d4312da0eb9
Instruction ID: 3504baae9668e0f35df718bf6a991c7a6009e8edb14d96516cb11378db8a27b4
Opcode Fuzzy Hash: b4318b0569d2c200f4698a796e8e0ce1bc5d1e7bbf0a42f9cdf36d4312da0eb9
Instruction Fuzzy Hash: 88310830E107068BCB10AF79D4152AEFBB9FFC5300B108629D45AA7381EF74A945C781

Function 05AACA68 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

(bq, xrefs: 05AACB31

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: be0a3c28e59f7b0b8e7ab3b7f509db5b7f16423f97d214bf46dd2be6a5349318
Instruction ID: 4657e7752f140e9eaeb9283b2f597cb0e8d5fca1b5e463c7c4154c1eef2dc833
Opcode Fuzzy Hash: be0a3c28e59f7b0b8e7ab3b7f509db5b7f16423f97d214bf46dd2be6a5349318
Instruction Fuzzy Hash: 9821B231B042549FDB159B28C464AAE7FF7BF8A210F244069E502EB391CF355C05CB91

Function 06AFBA68 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

PH^q, xrefs: 06AFBAFE

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: 9aee52922cfd2c7727f6526f947b86e4bc0a4a6e2412b9eddf3c654536e4ea86
Instruction ID: bf501640eb30d960373ff1939fa0c096b8168314e1d7f6f11f9fb4532df1383c
Opcode Fuzzy Hash: 9aee52922cfd2c7727f6526f947b86e4bc0a4a6e2412b9eddf3c654536e4ea86
Instruction Fuzzy Hash: 51214131B001499BCB54ABA9D998AAFB7FAEF88251F108025E502D7254DF759D01CBA1

Function 0541D2D7 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0541D2FD

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 51c6beaf1e372d03432a67ce689778fba9793792fba16f6deec9f76e82c3c10d
Instruction ID: 7feea68084c5451f9d468d68a9c709a37955f11a0058bbdc074747f080e5034c
Opcode Fuzzy Hash: 51c6beaf1e372d03432a67ce689778fba9793792fba16f6deec9f76e82c3c10d
Instruction Fuzzy Hash: 0D21CF306002054FC314966DD4C079BFBDAEFD4304F44892AE54A8F359DFA1E8894750

Function 054189F0 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

(bq, xrefs: 05418A5A

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 243125b3f4ec7b358a1e01d2b5a2f0ade8077a1e6146d64575f464b50f832d89
Instruction ID: f88a59e8222bdf25a69a1cf5075fa6a89f6db5217da4f48f6f755ca430e20281
Opcode Fuzzy Hash: 243125b3f4ec7b358a1e01d2b5a2f0ade8077a1e6146d64575f464b50f832d89
Instruction Fuzzy Hash: F31138317052555FC3109A39D445B6E7FE6EFC235071880ABE84ACB385DE38DC038791

Function 06AFB988 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

(bq, xrefs: 06AFB9CE

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: c2b59df63b0fff7b70f8982a6e8bbef5d610246f70a646f5bbab47e92f40849a
Instruction ID: d043ce8edf97cbb034b78d7aedf8dfacb4c4dcf3bff44484d2e1354ddc5ecf78
Opcode Fuzzy Hash: c2b59df63b0fff7b70f8982a6e8bbef5d610246f70a646f5bbab47e92f40849a
Instruction Fuzzy Hash: 4F1134303056402FC356A73CE81499EBFEAEFC632170441AAF046CB3A2DE719C0587A2

Function 06AF72D0 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06AF72E8

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4c^q
API String ID: 0-396817635
Opcode ID: b2249e09d2b249f9402b916b56b8a78b39a55e0f9393f2f928cd9ab54e5c3d22
Instruction ID: bc1a2bfb9eea16219e767dc36ae2c50ea106ba0b16d17224b28b9eb46d9a8463
Opcode Fuzzy Hash: b2249e09d2b249f9402b916b56b8a78b39a55e0f9393f2f928cd9ab54e5c3d22
Instruction Fuzzy Hash: 62110875B00201AFDB54EF79B90577EBAF9AB88601F044029F545CB280DE79DD01C7A2

Function 02C78D30 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02C78D39

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: a9791f3f7e8d75fd3f166645ab6e34a5d065567440a019a5a04ca012c12f04e9
Instruction ID: 8c0e923adb14c3ea0353d346094b7ad45af402d35e836759fb35ecb797ddc843
Opcode Fuzzy Hash: a9791f3f7e8d75fd3f166645ab6e34a5d065567440a019a5a04ca012c12f04e9
Instruction Fuzzy Hash: 9511E3352206258BC325AB79F05F24A7FA5EFC5301B104A78E446CB386EF74E855CB82

Function 05AADE71 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

(bq, xrefs: 05AADEAF

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 7bd7934dd38819b2246784d93a2d926d7d0ba73b0891a36983f48f868f31572c
Instruction ID: f194e6351cc0eadbb766d157c4763bed09c16fc23dbc4e7c7817f70f2fde5fa3
Opcode Fuzzy Hash: 7bd7934dd38819b2246784d93a2d926d7d0ba73b0891a36983f48f868f31572c
Instruction Fuzzy Hash: 13014C326091200FD3255739946456A7BD6EFD2750B15466DE0468BA65EF368C078354

Function 05AAD148 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05AAD161

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 7975beae234021538df9de6111792cbe78332504b001ff1dc40798cbca60b989
Instruction ID: c4f163a8614d288db1a689c48f20f73612035da12b0620f9557a261401900090
Opcode Fuzzy Hash: 7975beae234021538df9de6111792cbe78332504b001ff1dc40798cbca60b989
Instruction Fuzzy Hash: 2F01F9352043015FC314D779D854D9ABBE6EFC521470445ADE0998F325DF31EC4AC750

Function 054132D5 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0541332A

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 7bf2d2ddc0ed6fabdf917549433e9489e683f9676570f6f9681a8903c1ce991e
Instruction ID: 6e57fd2180986cac1f96f04222546b8a3cfbf922edf8000eae8d87b7d58a44db
Opcode Fuzzy Hash: 7bf2d2ddc0ed6fabdf917549433e9489e683f9676570f6f9681a8903c1ce991e
Instruction Fuzzy Hash: EBF0C2317043424FC7059B28D85498ABBE6BFC520475585AAE489CF356EF34D84ACB85

Function 02C78D20 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02C78D39

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: fc42dd2fe38915eb0f36da900354deb9483ce885064372f0b9781d1cc4aaf77a
Instruction ID: 7736ac9806c01bf7fbfac930a091c025c55423e44233446ac5ea5c83f985ba2c
Opcode Fuzzy Hash: fc42dd2fe38915eb0f36da900354deb9483ce885064372f0b9781d1cc4aaf77a
Instruction Fuzzy Hash: 2BF050352206144BC3159725E44E38ABF65EFC5300F14475DE48647386DF75A84A8786

Function 02C77240 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

k9Y!0, xrefs: 02C7724B, 02C7725F

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: k9Y!0
API String ID: 0-1825060378
Opcode ID: cab6210653da2c133f599f06baced4a6472a7fc4f1251468f7c0442ae95d90c7
Instruction ID: bfb188205e3248f2c7e0e842b75d700744f454a7069835de467658b4ca0bc0c3
Opcode Fuzzy Hash: cab6210653da2c133f599f06baced4a6472a7fc4f1251468f7c0442ae95d90c7
Instruction Fuzzy Hash: 4BD02B331082241BC704D97DC8C17C97FD9CB84170F0044ADD048E3302D8A19EC082E5

Function 02C77250 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

k9Y!0, xrefs: 02C7724B, 02C7725F

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: k9Y!0
API String ID: 0-1825060378
Opcode ID: bb51bc8f853b392712858fd35a60942792bc75b3946423ad99c666b5972d3f73
Instruction ID: 1728b8b86793eb47a96eabea86ead1b70a5dda6745963628ade08fe7b5845bdf
Opcode Fuzzy Hash: bb51bc8f853b392712858fd35a60942792bc75b3946423ad99c666b5972d3f73
Instruction Fuzzy Hash: 6AD012736442182B4B05EAAD58505DE7FADDA84170F0145BAD50DD7341EDB15E8042D9

Function 06AF5B58 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac857165b539378fd0edf31c1c2803560beb85b22a9cfcbd6ba3cee4f7b7e42e
Instruction ID: 5f119cc61f1d8047d50ca1e5e246ed600baaed21b82ab184d876fbea54c3857d
Opcode Fuzzy Hash: ac857165b539378fd0edf31c1c2803560beb85b22a9cfcbd6ba3cee4f7b7e42e
Instruction Fuzzy Hash: 89327C34B102459FDB55EFA4D858AAE7BF2FF89301F144069EA029B395CB31DC45CBA1

Function 064D0598 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff169fcabebaa4c1c149b3502082049fa383194ecde935f8f5ea57fbe8e973a
Instruction ID: 5bf51994bcd6dfb77cbdaf673c26cc402d3eea8beea47f0a26a054dbeec1a1b6
Opcode Fuzzy Hash: 3ff169fcabebaa4c1c149b3502082049fa383194ecde935f8f5ea57fbe8e973a
Instruction Fuzzy Hash: BC122974E002148FEB95DFA9D8987ADBBB2FF88704F14822AD40697391DB789846CF51

Function 054106C0 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52ff056adc9900bcbc3b5439486acd7434afefa7375602ceb331297bb115132
Instruction ID: dfba159f11cb2f1d69dc838141edd41fe6806b9c849d407d744657b61d071288
Opcode Fuzzy Hash: b52ff056adc9900bcbc3b5439486acd7434afefa7375602ceb331297bb115132
Instruction Fuzzy Hash: 8F022639710110DFD716AF54D85CB9A7BAAFB49301F21C0AAE5099B76ECB76EC81CB40

Function 02C7E7F8 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4af66b94e6178cf246a8f3272748615a9ff1b8dbddaf9637cb056bd197c7fa
Instruction ID: 28d259b815a112a79dbfe58260235980ec6e57ba6d7e13a029bbf63bc638b2fe
Opcode Fuzzy Hash: 3f4af66b94e6178cf246a8f3272748615a9ff1b8dbddaf9637cb056bd197c7fa
Instruction Fuzzy Hash: 3FE169757002158FDB14DF78C898A6ABBF6FF89300B1544A9E906DB3A6DB35EC42CB50

Function 06AF12B8 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e201025e2b98f4173d40ab76f1ffa1ba66f9bf460366fc71605281ec346253
Instruction ID: ae33dda2917ef0da15349a07d86f12c40b7068a53ab78f36944cb86bc4eec86b
Opcode Fuzzy Hash: f6e201025e2b98f4173d40ab76f1ffa1ba66f9bf460366fc71605281ec346253
Instruction Fuzzy Hash: E7F15474E10349CFDB55EFA8C488B9DBBF2AF49304F148194E909AB291D734ED85CB91

Function 02C7D9E0 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8d77784c5fae2496341a59dd478ae7891e7920549412e041359b5296a64be6
Instruction ID: 9324e6407fc7364da898e6ca2b5f663b33562fcda58f3595adb17442694c4832
Opcode Fuzzy Hash: 2a8d77784c5fae2496341a59dd478ae7891e7920549412e041359b5296a64be6
Instruction Fuzzy Hash: 9BE13A34A00205DFCB14DF65E598A9EBBB2FF88310F148568E8469B3A5DB74ED45CB90

Function 05435DC8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e740f0ed81dce5b31b17c6037ba4781fa56778d89abe68d84b8a3ffc76911e9c
Instruction ID: 7e133cf4551f678eaa4e3f8f66ffa08ace458cfb6f30280d0b337ed4413aac06
Opcode Fuzzy Hash: e740f0ed81dce5b31b17c6037ba4781fa56778d89abe68d84b8a3ffc76911e9c
Instruction Fuzzy Hash: EAD1E734A002148FDB64EF74D499BAEBBB2BF89305F1184A9E44A9B395DF359D81CF40

Function 0543614C Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054e3bf9333f29aa5e16e6c7ba11f984d51f7ff380d7a600ba2fb4b347116d2a
Instruction ID: 123f55f1bb5cd0c00356d01204a218311b1aaa99d77018c5717406ae07fa9690
Opcode Fuzzy Hash: 054e3bf9333f29aa5e16e6c7ba11f984d51f7ff380d7a600ba2fb4b347116d2a
Instruction Fuzzy Hash: 30D1E434610215DFCB69DF24D499A99BBB2FF89301F5180A9E40A9B3A5CF35DD82CF40

Function 06224FD9 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81760fe1878842070cc1eceaa1f967232fa4509e1e23f850adf36f45551e399f
Instruction ID: 69915d8fc6b4f2ddb23de71b6013a6f87d78b2d0587d4d315dd6c93ea14ff9ea
Opcode Fuzzy Hash: 81760fe1878842070cc1eceaa1f967232fa4509e1e23f850adf36f45551e399f
Instruction Fuzzy Hash: 31C12B74B1020A9FCB54DFA9C49499EBBF6FF89300B108429E906EB364DB31AD46CF51

Function 05AAE491 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc35266fa0b7733cb66a8158565708e3bbb3df2d8a11db7dc6934b3f8182446
Instruction ID: 345c6ba003bb4666c94400a22364183fe66587114fac4609a33c9d9aeb432e52
Opcode Fuzzy Hash: afc35266fa0b7733cb66a8158565708e3bbb3df2d8a11db7dc6934b3f8182446
Instruction Fuzzy Hash: FCD1AA75E002598FCB15CFA9C984EADBBF6FF89300F1480A5E855AB365EB30E945CB50

Function 02C7F6F9 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8a17bce33359fa73f69300ed692d9393a685664190c0e11680130b2ec693f9
Instruction ID: 3d025ec64668a44dbdced8791d75f86237ce431bf1721525977bdb6655ee388a
Opcode Fuzzy Hash: 5f8a17bce33359fa73f69300ed692d9393a685664190c0e11680130b2ec693f9
Instruction Fuzzy Hash: CED1E834A00259CFDB25DF64E898B9D7BB2BF88315F1484A9E50AAB290DB719D81CF50

Function 064D15B8 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b2917574cd01e44513ff4b89131d5e94f9f0c0ba8729acf9e916f46297b10a
Instruction ID: fdf28e839390f0d7008f81c1cbd7a7667adf3039eb96424483c6103dca9be903
Opcode Fuzzy Hash: 62b2917574cd01e44513ff4b89131d5e94f9f0c0ba8729acf9e916f46297b10a
Instruction Fuzzy Hash: 0451B170A163906FD702EB28D8646DEBFB5EF82304F0441ABD445CF297DA758D4A87E1

Function 05418EB0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58799243ad5ef50f9c3a7da1de2b887a76dc177daf23408c350209c2f302511
Instruction ID: b4b2012f71e2ea5a9a90631268497c5e191cf821654de2b30e2187b610a1995d
Opcode Fuzzy Hash: f58799243ad5ef50f9c3a7da1de2b887a76dc177daf23408c350209c2f302511
Instruction Fuzzy Hash: 97A16D30B002058FDB54EB79D4986AEBBE6FFC9341B1484A9E80ADB399DE35DC418791

Function 0541520D Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caaac2c270e96f6f6c96dd4ab3068b632ebe59ddb5643ff3a1edac23f988eff2
Instruction ID: 2207b705e8583c3aaa450de386eaa9dcba607b4c8ff3481823a2655288195a9d
Opcode Fuzzy Hash: caaac2c270e96f6f6c96dd4ab3068b632ebe59ddb5643ff3a1edac23f988eff2
Instruction Fuzzy Hash: 6EB16B30A006188FCB15DF69D554BEEBBF2BFC8305F0484AAD8099B394EB359986CF55

Function 06AFA725 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7a7fd11fba70d6f796a8f24cabec1e408d1da065e317561fa688a70fc4039e
Instruction ID: ba31c1740a9c368bea27544a5f91d6665bd6a5cb8602456d6ab05866b6d79f71
Opcode Fuzzy Hash: fe7a7fd11fba70d6f796a8f24cabec1e408d1da065e317561fa688a70fc4039e
Instruction Fuzzy Hash: 57B19F70E10209CFDB50EFE9D9817DEBBF1AF48314F148129E619EB254EB749846CB92

Function 06224FE8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30d624f6e809098e13a85634aef4fcd3b0f5e4c30065003f5bae0d2377954f7
Instruction ID: fa5cf62b17d0d04c04f7b468f1049a36440edb4316b934609aedd248472647a9
Opcode Fuzzy Hash: c30d624f6e809098e13a85634aef4fcd3b0f5e4c30065003f5bae0d2377954f7
Instruction Fuzzy Hash: 73B11974B1021A9FCB44DFA9C59499EBBF6FF89300B148429E906EB364DB30ED06CB50

Function 05437A19 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16564a6626bc0d94ef3c5d8c2215ce2a82196e10d942ad933168bfd3968c4ce8
Instruction ID: 76d1458a109b99a41e8784335d542f1324f8aedd6f2fe88c840e22512aaf343d
Opcode Fuzzy Hash: 16564a6626bc0d94ef3c5d8c2215ce2a82196e10d942ad933168bfd3968c4ce8
Instruction Fuzzy Hash: CBA13D70A402059FDB18DFB4C995AAEB7B2FF88300F148569E4469F3A8DB35ED45CB80

Function 0543FC50 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f43724cd152cb4d4dbd40ca5729de44f0662bc603f85e7c38d9c0004d68e7e0
Instruction ID: fba2fc4dbc6da0e033eb3dea16d325114598bc00ea00a9d425349492f5157f8c
Opcode Fuzzy Hash: 2f43724cd152cb4d4dbd40ca5729de44f0662bc603f85e7c38d9c0004d68e7e0
Instruction Fuzzy Hash: CCA13B74B003059FDB18EB74C559BAEBBB6BF88301F108469E806AB3A5DF399C45CB50

Function 05431750 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b245d218eab726dfb2dbd7c1e1e9ba457fa77de35c157e20a763fee991851d
Instruction ID: 69371405e204977955f3bfcbc629138ed124fe1dcae3c3420134a31fa03f7b33
Opcode Fuzzy Hash: 66b245d218eab726dfb2dbd7c1e1e9ba457fa77de35c157e20a763fee991851d
Instruction Fuzzy Hash: 61918F34B102148FCB25AB65D499AAE7FF6BF89311F5460AAF842AB394DF34DC41CB50

Function 05AAB2D2 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a9b8f26a7aef642c7a78ed997a2ee1bddac5b53b4d68440df0cd15b12377e2
Instruction ID: 1be30a13065b76bc8039bce18762247fae0750b2589b9d49b8f8fdba72fb6215
Opcode Fuzzy Hash: c3a9b8f26a7aef642c7a78ed997a2ee1bddac5b53b4d68440df0cd15b12377e2
Instruction Fuzzy Hash: B8919D71B052468FDB05EF78D944AA97BF2BF44304F188869D406DB356EB35DC86CBA0

Function 06AF18F0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d98ef51436498f8f83faaa0a873233282cf925875c62ec0b956f0457e6ea8f2
Instruction ID: fbe8ee703f8f036b8734468a958373b3f70a5576ced33ccfa8d342b7429f9c8f
Opcode Fuzzy Hash: 3d98ef51436498f8f83faaa0a873233282cf925875c62ec0b956f0457e6ea8f2
Instruction Fuzzy Hash: A0818034A2021ADFCB94AFA5C84487B7BF6FF85350B148819FA169B354EB31DC45CB92

Function 06AFDEDE Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135911332ef80ab3ee747e54baeb028fedf2665ebd866d04aa50a629e441c24b
Instruction ID: 55740d82eae4281ee51af24c309ed4e683fec34ce49f7cc32dde1742f19bb451
Opcode Fuzzy Hash: 135911332ef80ab3ee747e54baeb028fedf2665ebd866d04aa50a629e441c24b
Instruction Fuzzy Hash: E391C131B053428FCB05EF78C98059ABBF2FF952047148869E545DB32AEB31ED56CB91

Function 06AF1BC8 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e370550329c81accd4d754193a5107db08db3214d92ea0e63830b83f1b37178
Instruction ID: 295f08fdf0b27078b443a2ac9fda31e6718e90f948db0797237260ad49faf857
Opcode Fuzzy Hash: 4e370550329c81accd4d754193a5107db08db3214d92ea0e63830b83f1b37178
Instruction Fuzzy Hash: 6EA1B135A10209DFCB55DFA4D994AAEBBB2FF89310F148059F902AB364CB31EC12DB51

Function 0541F788 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15afbbab4f3d06e3dd7e07ccf9b7f6ea276d869419941a2e5a42d667deb38a8
Instruction ID: 73ee6acc1b63b8ad37410fbb3807cedc5c54b18e42a879eaa73968f0569a98b8
Opcode Fuzzy Hash: e15afbbab4f3d06e3dd7e07ccf9b7f6ea276d869419941a2e5a42d667deb38a8
Instruction Fuzzy Hash: D3918E74A002159FCB14DF65D594AAEBBF2FF88310F548469E846AB391DB31EC45CFA0

Function 06AFFB0D Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8934df9e6e6185555499566985ee9df50044266e7818fdf5c54749e937e0cccf
Instruction ID: d1226dac9bd2fd562b8cf89ddc3f29e12d042a9cf8ba993d0507aa255c6bbbe7
Opcode Fuzzy Hash: 8934df9e6e6185555499566985ee9df50044266e7818fdf5c54749e937e0cccf
Instruction Fuzzy Hash: 68811635E282848FCB82EFA8D450AAC7BF1AF46304F154496E941DF3A2D734DD45CBA2

Function 05413F28 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0ce2996d8eb1cb1fc445af7eec3d57a17eadd765aec355cd1019d19f622d30
Instruction ID: 61fad8dfbbeaf18b4f1d74ed3afb4b4c4e9bdc28e121f84db206370db05a6ae1
Opcode Fuzzy Hash: cf0ce2996d8eb1cb1fc445af7eec3d57a17eadd765aec355cd1019d19f622d30
Instruction Fuzzy Hash: F9719434B055118BDB15DB39C094BAABBB2FF85310B1444AADD4ACF355CB76EC42C798

Function 02C798A0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f63f9ffa016742a1e50e313a90a0ea768f0073b0af727bf054e134acbcd92fa
Instruction ID: b2c8257dab6c1d658564183d97f5d19d7b2cf4e6b9aec40aa8e7a2d960d01d57
Opcode Fuzzy Hash: 2f63f9ffa016742a1e50e313a90a0ea768f0073b0af727bf054e134acbcd92fa
Instruction Fuzzy Hash: DA618E317112118BDB246B79A46932E7EEAEFC9295B184478E806C7385EF78DC41C751

Function 06AFE298 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e175dc4d01f421698933038f37294fe383159fae05cd3cfd427c0e13c4c5a7
Instruction ID: 4d64573652434c4c54eba187fcae71d69167ac96b0ebde4a9f918060b288151d
Opcode Fuzzy Hash: 39e175dc4d01f421698933038f37294fe383159fae05cd3cfd427c0e13c4c5a7
Instruction Fuzzy Hash: 6A71CD34B10204AFDB54EFB4C5506AEB7F6BF88200F148129E50ADB3A4EB35EC41CB91

Function 06AFFC08 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb67c6d1e5d2b1e1171c7388fefbf72ac5a49fa1e796009c32dfbeddc7f56600
Instruction ID: 2782c5fc67f67d89f4bbb97bd94edd2cde18a945e1219282fdf2a74921ed71c7
Opcode Fuzzy Hash: cb67c6d1e5d2b1e1171c7388fefbf72ac5a49fa1e796009c32dfbeddc7f56600
Instruction Fuzzy Hash: 5C816C35A101048FDB84EFA8D594BADB7F2BF88304F248459E905EB355C735ED42CB91

Function 0543EBD8 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5848236a5b8a879579940693df6932dc3125871046896fdedbc691c1b33de3e0
Instruction ID: a670b06f5ef4b626b96484ab5748410b8794b95a5fef08ca35c51a46238c3b37
Opcode Fuzzy Hash: 5848236a5b8a879579940693df6932dc3125871046896fdedbc691c1b33de3e0
Instruction Fuzzy Hash: 9C815B746006069FCB14DF64D595EAAFBF6FF88300B008A69E41A9B7A5DB30FC55CB90

Function 06AFE28A Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5916841b3a6ed4c263f3b1e74cf4e7411b3e0f8591aac284ebdd7933bd385b84
Instruction ID: 3e3e56e3c7705f0f3d1d8f6c37e981beaf21d8e069ce150b393269395aebd0fe
Opcode Fuzzy Hash: 5916841b3a6ed4c263f3b1e74cf4e7411b3e0f8591aac284ebdd7933bd385b84
Instruction Fuzzy Hash: 1461F234B10205AFDB54EFB5C544AAEB7F6BF88200F148529E50ADB3A0EB35ED41CB91

Function 05410350 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd4e15fb65011949c6cddba1459e57ac1d0f06d171ae3013d31d7a978f7b4e0
Instruction ID: 7258a7985f541688bcfee4eec85dce193676e712bea6397e3a3645acd6d07f94
Opcode Fuzzy Hash: 7cd4e15fb65011949c6cddba1459e57ac1d0f06d171ae3013d31d7a978f7b4e0
Instruction Fuzzy Hash: 41817C34614144CFDB54DF68D48DBAA7FB2BF8C314F24409AE80AAB396CB74D885DB64

Function 02C7D9D0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03aa31a96010e90368d4fc64e1b9ef752f78ebf93762b16c3858920d2b409280
Instruction ID: 4eae2772ddcd8dad91b4fa8daddd658534a1c8912d2b55b528be527de697adb8
Opcode Fuzzy Hash: 03aa31a96010e90368d4fc64e1b9ef752f78ebf93762b16c3858920d2b409280
Instruction Fuzzy Hash: CB81DA34A00209DFCB14DF64E598A9DBBB2FF88310F148568E806AB365DB74ED45CF90

Function 0622C549 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9de48816d5a5e2f434e51e8f98625b1a37399d3dad4bc23cee9ebcfda82c5f
Instruction ID: a0a49aa672ccf1285c08353e122f73ddf88deab8c3cc0babed1fec9a82250066
Opcode Fuzzy Hash: 4c9de48816d5a5e2f434e51e8f98625b1a37399d3dad4bc23cee9ebcfda82c5f
Instruction Fuzzy Hash: 63811675A1021ADFCB55DFA8E984AAEBBB2FF88311F108169E905A7364C731EC51CF50

Function 06AFCB70 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976880a42ffefb10ffa16cc134282dfb92132eb6026cf050c37cec1c3cd6ed9b
Instruction ID: 15e10d39747d294d15523ef68c708737ea74d0a9a4fb0f950b5599ade9cab30b
Opcode Fuzzy Hash: 976880a42ffefb10ffa16cc134282dfb92132eb6026cf050c37cec1c3cd6ed9b
Instruction Fuzzy Hash: 2451AF307006158FC788AB69C458A6F7BE7EFC42217298569E10ACF3A5DF75DC01CB91

Function 0541033F Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7c9d5d4f8ff8f23137d979ce1bc4be59d9c06a88b90f9640f3cd9867cf2568
Instruction ID: 369f39ab84866e0ef533101b6d1fe151f802dd10ba02009c56481f12b1bf7585
Opcode Fuzzy Hash: 0e7c9d5d4f8ff8f23137d979ce1bc4be59d9c06a88b90f9640f3cd9867cf2568
Instruction Fuzzy Hash: 36817C34614144CFDB58DF68D48DBAA7FB2BF8C314F284099E806AB396DB74D885DB24

Function 06AFFBD3 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0c260ad0adf940bb9cdc52bd6d8849beb3eb9c64d2e705ca4516226e235bcb
Instruction ID: 55e0d375ce338279d8ab919f45d9622330860f5acab971ad59a1702df549e131
Opcode Fuzzy Hash: eb0c260ad0adf940bb9cdc52bd6d8849beb3eb9c64d2e705ca4516226e235bcb
Instruction Fuzzy Hash: E8619B75E202548FDB84EFA8D184BADBBF1AF49304F144099E941EB3A1D734ED46CBA1

Function 0543AB30 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 065bb9e1ab486d70ded857af9e75651432b928b112dd92c510cbd12f16fab8cc
Instruction ID: b0044e2e9f66c75caabcf84af1c1f58448eb1ba37b96d5c5139823955bfdf97f
Opcode Fuzzy Hash: 065bb9e1ab486d70ded857af9e75651432b928b112dd92c510cbd12f16fab8cc
Instruction Fuzzy Hash: F4615A35244205DFC715CF25C085A99BBB2FB49325F19C4AAE54A8F371C736E981DB80

Function 05AAFA08 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205d6428f533ff75efe4350064ccc96a7d81677de9c9bbc5566da674ae827107
Instruction ID: 3a2c16fad4ae358573191d40948875f437bd95a40faed6516e8aad7d1889d50e
Opcode Fuzzy Hash: 205d6428f533ff75efe4350064ccc96a7d81677de9c9bbc5566da674ae827107
Instruction Fuzzy Hash: B051F53A7041128FC7589F29E4A8D2A77F7BF8961132880AAE006CB379DF71DC46CB00

Function 0543A202 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c1ba02b13f45e60a2f57ef5017f96ff15d3db1d0e80bf4fff5349da93fa53bc
Instruction ID: 2db588d040246b2ff954177a0cbcb29b42b712650773afe168f72f6b8fa419f3
Opcode Fuzzy Hash: 2c1ba02b13f45e60a2f57ef5017f96ff15d3db1d0e80bf4fff5349da93fa53bc
Instruction Fuzzy Hash: 6851C130A442489BDB14DB79D8197AEBFF6AF89300F1881A9D48697395CF359C41CB90

Function 05AAED3C Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b8ebe4a15f7ede43c4a5d13d5593626fec55d98b34d796faa6b5b2fee4f093
Instruction ID: 55915efa36ebcee590923ee2721bd6489d350f76f6c4aceb768cade0eed7685e
Opcode Fuzzy Hash: a1b8ebe4a15f7ede43c4a5d13d5593626fec55d98b34d796faa6b5b2fee4f093
Instruction Fuzzy Hash: 9A518D36B00115AFDB249F69C894F6EB7F6FF89710F144168E9169B3A5CB319C41CB90

Function 0543F510 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c489cca4668b169b895944caf4d5a5f27c3077e29139d5670700eddaf99554
Instruction ID: 85dba33f18f274a75739922ecb1dddb812ac69cfd8e551beee233fa838d9efae
Opcode Fuzzy Hash: d1c489cca4668b169b895944caf4d5a5f27c3077e29139d5670700eddaf99554
Instruction Fuzzy Hash: B4514630A002099FCB14DF68D594AEEB7F2FF88310F599569E446AB374CB71AC89CB50

Function 06227768 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9043c97faef985a221376c8dac6ea536033d83c523f8e1d2a3fe8675de4cac6c
Instruction ID: 13ed725c875f6ae075952e9aa8160c8fc3ae2629ba4093cc9de0021e90d28154
Opcode Fuzzy Hash: 9043c97faef985a221376c8dac6ea536033d83c523f8e1d2a3fe8675de4cac6c
Instruction Fuzzy Hash: 9F518F35B14217DFDB60CB68C980AAABBF5EF48360F1040A5ED09DB351D731E941CBA1

Function 0543F520 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b94ff2895c8c3038d77b58bde26832f3991fe34190659e2bc4fb63babc7b7f2
Instruction ID: 19bb3132b0375443e61174337a67059ff5c3aee13a9311d2db7be1ca210be729
Opcode Fuzzy Hash: 7b94ff2895c8c3038d77b58bde26832f3991fe34190659e2bc4fb63babc7b7f2
Instruction Fuzzy Hash: C8513530A002099FCB14DB68D594AEEB7F2FF88310F558569E446AB374CB71AC89CB90

Function 0543A872 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae7c3f8cf81738abccf931a5edfe7db82b15ec4416f91e705ec6fd6b8203f78
Instruction ID: e58e5128a1428dfa0aad9cbb909f23595e88094bc45fe81db736ce165715b49d
Opcode Fuzzy Hash: 5ae7c3f8cf81738abccf931a5edfe7db82b15ec4416f91e705ec6fd6b8203f78
Instruction Fuzzy Hash: F8519035B502059FD724AB75D869AAE7BF2FF88301F04446AE886DB395EF349C05CB50

Function 05430828 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43c900fb9cb04203d6c69b822fee3924eac7e60c751b96e60a10b6860fb1254
Instruction ID: a420debe8797a44c703ccdea077f9a3be24184e6a99e5a476576ab39d754c0f0
Opcode Fuzzy Hash: b43c900fb9cb04203d6c69b822fee3924eac7e60c751b96e60a10b6860fb1254
Instruction Fuzzy Hash: 0E519035A102099FDB15DFA4D459AEEBBF6AF88314F10856AE40AEB350DB30DC06CF90

Function 06AFBC88 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33b398c6c94df949ebec88d15bbc464d6ceb64a4cb446f886f092ef44e2147b2
Instruction ID: 1e0e58df545801f19a22fe81c705beeb8f97b88b35a79b0eb79a5ab98aed3418
Opcode Fuzzy Hash: 33b398c6c94df949ebec88d15bbc464d6ceb64a4cb446f886f092ef44e2147b2
Instruction Fuzzy Hash: 3A517F307102458FCB45EB68C858AAEBBF6FF85310B1581AAE546CF3A5DB70DD05CB91

Function 02C7D320 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5930e7cdbd29ae686e746f1f588f8a92848d1397bae9a278c2b03e302545149
Instruction ID: 3aa689b359e9093b90e7e151c21e71e5216aaacd71d2c3fbc2592a138f4ffd6f
Opcode Fuzzy Hash: d5930e7cdbd29ae686e746f1f588f8a92848d1397bae9a278c2b03e302545149
Instruction Fuzzy Hash: E551EC34A10219EFCB18DFA4E8599DDBBB6FF88314F148029F806A73A4DB35A941CB50

Function 02C7DDA7 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d05651439bf8697f8b7c3695ae3c3609e69fd16865959bfbc7a2cfea06319f
Instruction ID: be6a2b18c210aab2b9f4a529bf352a4e31add0120da8fb3f553a2cc221cbdcb7
Opcode Fuzzy Hash: a4d05651439bf8697f8b7c3695ae3c3609e69fd16865959bfbc7a2cfea06319f
Instruction Fuzzy Hash: 7851C534A00209DFCB14DFA4E598A9DBBB2FF88314F148558E806AB365DB35ED42CF50

Function 05AAB6B8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ae80af19beafa92bfe950cc4dc895f4a85ff0c072a1d85f0a57c4d63749726
Instruction ID: ef1e9bc3804a85afdf14ab7e306bc3553f352c2752e87fb79e382283aafdd425
Opcode Fuzzy Hash: e7ae80af19beafa92bfe950cc4dc895f4a85ff0c072a1d85f0a57c4d63749726
Instruction Fuzzy Hash: 10512C35A01209DFCB55DF68D598EADBBF2BF88700F204459E406EB360DB759D44CB91

Function 02C732A8 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08c9f1ce74839e3e4f2352d2bbfd3243bd92052d3b35ba67fdcb74c4eb8efe9
Instruction ID: 45bdd524b9e9d0c021a30c7ea1a9d2e68c574f274967d6b66ea95b7dc5785fe1
Opcode Fuzzy Hash: a08c9f1ce74839e3e4f2352d2bbfd3243bd92052d3b35ba67fdcb74c4eb8efe9
Instruction Fuzzy Hash: 5541BD30A002059FCB28EF79E9D866EBAA2EFC4201F00596CE4429B394DF759D45CBA1

Function 05430817 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5344ed7b191de598d151b299a40e59771bbe4cb443823093ef4fed492551f8ec
Instruction ID: ffd64dcbdcd406bd94e250cdaaf64a25bd03cd431540174ca4e6564b699041ca
Opcode Fuzzy Hash: 5344ed7b191de598d151b299a40e59771bbe4cb443823093ef4fed492551f8ec
Instruction Fuzzy Hash: 2A41C330A102159FDB15DF75C459AEE7BFAAF88310F14856AE84AEB354DB30DC06CB50

Function 0543EBC8 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612328b64d718c7e0f7483e56128f2c16fc04c23dc064f9cf4a2405995545e04
Instruction ID: a1e2b8f74d1a9b4938f049f3564690555baca2b5efbb47a040f78cf619041946
Opcode Fuzzy Hash: 612328b64d718c7e0f7483e56128f2c16fc04c23dc064f9cf4a2405995545e04
Instruction Fuzzy Hash: 3C515B746006069FCB14DF68D585E9AFBF5FF88300B008A69E41A9B765DB30FD99CB90

Function 0543BA28 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f38b02f7f17ffea46b7ab8c3c3c883c07ef9e9ea5a2603264fff023f9c54269
Instruction ID: ef0b9ac4c42a434649765be8535a8562615a81531cab246c62b74e312d6c4ed3
Opcode Fuzzy Hash: 6f38b02f7f17ffea46b7ab8c3c3c883c07ef9e9ea5a2603264fff023f9c54269
Instruction Fuzzy Hash: 5241D031A002059FDB14DF39D499BEABBB2FF88314F048569D8869B758CB75E884CB90

Function 06AFB188 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7637bd296c74a0726fcb69f4578bafc344f94cb47244ee96e3f6c91df0f32f4b
Instruction ID: 12d32531a74214a22cc30280c3bbdaddf43e8a88c54a3f3143e4037de1a72181
Opcode Fuzzy Hash: 7637bd296c74a0726fcb69f4578bafc344f94cb47244ee96e3f6c91df0f32f4b
Instruction Fuzzy Hash: 75419D70B142058FEB58EBBAD99077AB6FAABC8240F188469F506CB294DA35DC41C771

Function 064D1F58 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a42fe9977d4985beffaf32c3ec79e081270c7668d7430b245bc5695fd8d2b8
Instruction ID: 8113cf2b759306e591cb05ad0c17a77280a68d54bcbb800c6e3ccc1824f9cd19
Opcode Fuzzy Hash: e8a42fe9977d4985beffaf32c3ec79e081270c7668d7430b245bc5695fd8d2b8
Instruction Fuzzy Hash: BC41D2357002008FC359DF29C890A6BBBE6EFC931471485ADE54ACB3A5DB35EC46CB90

Function 0622BC08 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f9edc61d405a5a626905ffacab493e8df290138e90efbb5aeceb06887cfe1e
Instruction ID: 593be22951da6e89206668fd8521039f766d4f745fd7da7fc261f0b6d36b6d36
Opcode Fuzzy Hash: b7f9edc61d405a5a626905ffacab493e8df290138e90efbb5aeceb06887cfe1e
Instruction Fuzzy Hash: 2E412830710602EFDB658F25D458B66BBE2EF89315F148469EA068B3E1CB71DC41CB50

Function 05439040 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0ca6aa32224982c680cf1806fb7058ab994a0b80206df7e858e9fd08845788
Instruction ID: 04758addd03d6c13cbed77bf4d4cf8b4bfb5549c222f872d4c2a8ba9428d5585
Opcode Fuzzy Hash: bf0ca6aa32224982c680cf1806fb7058ab994a0b80206df7e858e9fd08845788
Instruction Fuzzy Hash: CF41B230B002069FDB05DB68C5897EEBBF6EB89304F14856AD00ADB395DFB1D906CB81

Function 0543FB10 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f7290bda3274c05feb31dc5c844801bda12bc0c7853dd3cd73d38239d616d0
Instruction ID: 951195231e58f8fe8655238ddc5f0e8e892cf057a5f1d51aa1da6acc4cec4068
Opcode Fuzzy Hash: d0f7290bda3274c05feb31dc5c844801bda12bc0c7853dd3cd73d38239d616d0
Instruction Fuzzy Hash: 1F418C35A002019FCF10DF64E5859AAFBF6FF88311B088599E84A9B795CB30FD45CBA0

Function 05AAB140 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48d27307f6672d7121255696537400a52821cbdbc218ffb545d85ced0827558
Instruction ID: 7595ca8fde4500674a332d3c70e597bb07a5e3aafecb182107883615afb354ea
Opcode Fuzzy Hash: f48d27307f6672d7121255696537400a52821cbdbc218ffb545d85ced0827558
Instruction Fuzzy Hash: 9F41E5717002169FCB54EF79D944A6BB7E2FBC8204B14862DE40ACB355EB34DC0ACBA0

Function 06224E73 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48e308678fd9a22894f342809fa96a7b92a50e4175b3d33307eaafe3a63ffa2
Instruction ID: 0a434fca19ec882fa31485659e47814d661fbd4c90752b576cda6093e6feb3ac
Opcode Fuzzy Hash: f48e308678fd9a22894f342809fa96a7b92a50e4175b3d33307eaafe3a63ffa2
Instruction Fuzzy Hash: CD41A631920206AFC764EB94D884BEFB3FAEF80301F158629D95297290DF74A949CF91

Function 05AAB150 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84365c37c2c62ba7f67ab98b8c9f6e2e28f6a3cd0290d6e7e6220f775c2de34
Instruction ID: 3bf884a248b76ca76a61045b9a09f49cedec05f74538ea8c782f9b14274f94f8
Opcode Fuzzy Hash: d84365c37c2c62ba7f67ab98b8c9f6e2e28f6a3cd0290d6e7e6220f775c2de34
Instruction Fuzzy Hash: 5731A2317002069FCB54EF79D954A6B77E6FBC9204B148629E40ACB355EB34DC0ACBE0

Function 0543DDC8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b8f7cabc41bb98cb3d9783aa57109b1fad364253a766888628c405db9fca99
Instruction ID: 9acff81946a93a7b883812f2c68579d50c117a4b8521ffed62a2faaea1812bff
Opcode Fuzzy Hash: d6b8f7cabc41bb98cb3d9783aa57109b1fad364253a766888628c405db9fca99
Instruction Fuzzy Hash: 03413970A0060A9FC704DF69C981D9AFBF2FF88314B048A69D4599B725DB70FD89CB90

Function 054138F8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e1591d5749f05e960fc1c9160de4670d7f782b4eabff4f92be1568e94594cd
Instruction ID: 3948b6c553baa7ff24a56c6256def908891401d2b328d1e0240a008166321713
Opcode Fuzzy Hash: 79e1591d5749f05e960fc1c9160de4670d7f782b4eabff4f92be1568e94594cd
Instruction Fuzzy Hash: B4417C74B102059FCB14DF69D8999AFBBB6FF84301B14846AE90ADB394DB30ED01CB94

Function 0622A68B Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ada080b0fc7accd345bc9862e4d209f23547a191d7997fe4b4e4754b2a34f9
Instruction ID: 0e5c80ef7b62336e20f717da3c89f3b837fd62b62d96d77ce6564847d919d798
Opcode Fuzzy Hash: 16ada080b0fc7accd345bc9862e4d209f23547a191d7997fe4b4e4754b2a34f9
Instruction Fuzzy Hash: 4C3116306287A3AFD7A58B25C49093AB7F1FF05310B10486ACC83CBE56D7B4E881CB91

Function 05432118 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df41a937ab0e4a719dd3934d98b70999437b65944b4d8886d237e5732b483e7
Instruction ID: 1906190e15634f6f1174750c6f68f3b534e2599caa8a35d47f93026312471a1c
Opcode Fuzzy Hash: 0df41a937ab0e4a719dd3934d98b70999437b65944b4d8886d237e5732b483e7
Instruction Fuzzy Hash: 5931E0357083048BDB289B25C8596AFBBE6BF88300F1440BAE846D73A5DB759D01CB50

Function 06228F22 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b89af470305b3cee37c7555085586c790f90185cadbf693df0297ba41ba778
Instruction ID: 75e5dbc5b753cb541aff998c1a287c47bd4f11be38f6dd864c54e67e4856bea6
Opcode Fuzzy Hash: 47b89af470305b3cee37c7555085586c790f90185cadbf693df0297ba41ba778
Instruction Fuzzy Hash: C6419D34B24212AFDB64DF65D45466EBBF2BF89300F008469E946CB384DB38ED45CB85

Function 0543DDD8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 154cbd0fbc45fcf68ddca5a40efbc48cc4d4ed4867f38bfc2562412204d4bec7
Instruction ID: 01300f3ccd97cb56d48e97ea89f6979d4a68e363cc985c91d48c29f68526f91c
Opcode Fuzzy Hash: 154cbd0fbc45fcf68ddca5a40efbc48cc4d4ed4867f38bfc2562412204d4bec7
Instruction Fuzzy Hash: 62412770A006069FC704DF69C581D9AFBF2FF88310B00CA69D4699B725DB30F989CB90

Function 05436E18 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7e498434d1d5d37cc1054029adb7dfc54de998576edc05ab61ed014cba56d9
Instruction ID: b5876ab38a80e577cbe73f93f8ff1f44cfe6badf6d6a6dd766e2b75364bde669
Opcode Fuzzy Hash: aa7e498434d1d5d37cc1054029adb7dfc54de998576edc05ab61ed014cba56d9
Instruction Fuzzy Hash: 5A31A030B002159FDB14DBB9C4956EEBFF6EF88351F148069E806EB394DE349C458BA0

Function 05415992 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8bc4e1ca8bbd7003b14a1cc68c0fc2bbd879860ed26b2c00e618cfff708d141
Instruction ID: a2000cb5d610360af20f0f9dec4a301593437fa1f1469a70daa7aefa3f55f3bc
Opcode Fuzzy Hash: f8bc4e1ca8bbd7003b14a1cc68c0fc2bbd879860ed26b2c00e618cfff708d141
Instruction Fuzzy Hash: 3D31933178430647DF1C563258D16FB6ADBBFD0A90B58846AD947CE394DF38C842DB89

Function 06AFBC78 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf10b85838fa2c26b71c686652a90aac1b9240340b6f0b29e39b4c40e2f41fc2
Instruction ID: 976706757c2bdba53b3059dfc1ca799bac9aa360f67bcd3fe04757b9ef6e6f7e
Opcode Fuzzy Hash: bf10b85838fa2c26b71c686652a90aac1b9240340b6f0b29e39b4c40e2f41fc2
Instruction Fuzzy Hash: CC4134307102058FCB44EB68C488AAEBBF6BF88310B148569E51ACF375DB71ED45CB91

Function 02C77060 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75b2a660dc5079b6ab0a0b83c5896abb7f51b4a0ca6edc4f8d1933441fefed16
Instruction ID: b4d2b876024a89d6e09c59788ba9db66c3d873e8efa2ae464f5da46046914540
Opcode Fuzzy Hash: 75b2a660dc5079b6ab0a0b83c5896abb7f51b4a0ca6edc4f8d1933441fefed16
Instruction Fuzzy Hash: FD31AC30B102599FDB04EB78DC597AEBFB6AF85300F0084A8E405EB399DF759D058B91

Function 064D1740 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c48bf63368e6f1e1b84dead09409959a828f7d237645d75682144ff30de1b930
Instruction ID: 160d6dc3ff911fb80d4e1f1cf4f17ffd2b3f49c2a3df9727526af3a87c5c21ab
Opcode Fuzzy Hash: c48bf63368e6f1e1b84dead09409959a828f7d237645d75682144ff30de1b930
Instruction Fuzzy Hash: 3841B474B203049FDB41EB64D4547AEBBB6FB84300F10862AD405DF756DBB59D4A8BD0

Function 0541F398 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b978daa85412df32d22dfbf9670612f54312e1a31f886c329e4c22856e939a
Instruction ID: 7e8690c76a2056cd743e6f05fb69fd7e51d8bca94d9e46f364853e87af252375
Opcode Fuzzy Hash: 08b978daa85412df32d22dfbf9670612f54312e1a31f886c329e4c22856e939a
Instruction Fuzzy Hash: 22417630210B119FC715EB39D98469AFBA6FFC03107548B28D0968B768DFB0F94A8B91

Function 06228DA0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b06001d796e54829d5b627c90610f058774135327ad6ad62edec94e3ac2e30
Instruction ID: 4e82a2868d6e4545164e75015938be8e1a98150d7e3a8c3b5667289d45c3750a
Opcode Fuzzy Hash: 35b06001d796e54829d5b627c90610f058774135327ad6ad62edec94e3ac2e30
Instruction Fuzzy Hash: 95314635720026DFCB84DF28D4848A9B7B5FF49A11751819AF906DB272DB74EE18CB80

Function 0543C4E0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be0d73833ab1f1e681740e18aa0604b73405f0dda3fe4dce9221b6e76b9a867
Instruction ID: 4292d7f4a725ad8863f455428cf36cbf34c201ebd5ba983019c4f56b22e73891
Opcode Fuzzy Hash: 9be0d73833ab1f1e681740e18aa0604b73405f0dda3fe4dce9221b6e76b9a867
Instruction Fuzzy Hash: 49318F71B002199FCB04DF69C8859EFBBB6FFC8210B14816AE549AB355CB35DC46CBA0

Function 05430120 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9daa410f50c7e4a2576ea6559bc46b39b41ee3c92734ee8f55781839637a066
Instruction ID: 2c7f510b622495c2708d8d90f01dbd7eba136d37d7a679d22951dd9dc269818b
Opcode Fuzzy Hash: e9daa410f50c7e4a2576ea6559bc46b39b41ee3c92734ee8f55781839637a066
Instruction Fuzzy Hash: 72419E30A00219DBDB18DFA5D5996EEBBF6BF89300F14816AE805AB354DB719C41CF90

Function 05415B68 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08d0b9937d25a6cf24bfa64ccc285719cf4fc8a3e9d6afb28e538d56e91bd27
Instruction ID: 441dbd135ca7d570f302fbcffe90761132d99aa12efd433c9020a10d164c878d
Opcode Fuzzy Hash: a08d0b9937d25a6cf24bfa64ccc285719cf4fc8a3e9d6afb28e538d56e91bd27
Instruction Fuzzy Hash: BC3133313042546FD7159B789894AAFBFEAEFCA260B1440AAF909CB381DE70DC0187A4

Function 06AF2560 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c572acd391d9359e74952d335b64efb179d463f88b45172ac9d53404b79d907c
Instruction ID: c6eb5c8e71e664e49475a3d04667c736122e8ba2692182570082f0ef9379ebe1
Opcode Fuzzy Hash: c572acd391d9359e74952d335b64efb179d463f88b45172ac9d53404b79d907c
Instruction Fuzzy Hash: D031C6307102059FCB60DFA4D884B6B7BEAEF89314F048439F906CB255DB34E955CB50

Function 05410E0B Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a3182f2909f6b78f1374c7642922097f315bdd84ea32cddc675086aeb4158fc
Instruction ID: 6105209d16b2a5aa325b09b7aef9eeec76a9b30834947721f3deead5f9941caf
Opcode Fuzzy Hash: 4a3182f2909f6b78f1374c7642922097f315bdd84ea32cddc675086aeb4158fc
Instruction Fuzzy Hash: F631D270B006068BD748DB6CD49567FB7F7AFC8310B144529E40AE3385DF34AD128B94

Function 06223D53 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634b09a4e6caf38bc90023afa8fdef72a514593afc5e6a4e161799f992171cb
Instruction ID: cd70f252349b274db43355df2a5b9659815d8cfe19ede9618ed2844cc738bf6c
Opcode Fuzzy Hash: 1634b09a4e6caf38bc90023afa8fdef72a514593afc5e6a4e161799f992171cb
Instruction Fuzzy Hash: AE31C3323107128FC361DB29D584A66BBF6FF897007088668E54A8B366D735EC0ACB80

Function 06AFFE05 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0442e11e40a0ea82b7bca5c390de3a8a652304668c806d379dab870ed613b6b5
Instruction ID: 3f7fe125396c7add41febc8b3b681b41eb7158907e91df8f096f9cfb0f826377
Opcode Fuzzy Hash: 0442e11e40a0ea82b7bca5c390de3a8a652304668c806d379dab870ed613b6b5
Instruction Fuzzy Hash: A1313E35B002199FCB09EF64D9909ADF7B7FFC8750B108918E816AB368DF31AD458B81

Function 06AF7F74 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d08050553b98f1efe65fc77b7d7f8e5c3ad416467117bb6527aced54109757
Instruction ID: 14692e3e69fd09bf3f947ac0f6d95305054856d2dc3eca551f5ad5b59cba70bb
Opcode Fuzzy Hash: 17d08050553b98f1efe65fc77b7d7f8e5c3ad416467117bb6527aced54109757
Instruction Fuzzy Hash: 8D410FB0D01249EFCB10DFA9C880ADEBFF5FF48310F108429E419AB254DB79A946CB91

Function 05439010 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecd6299fc180bb87a231512cc537cd14ffb5bd7eb23b7e3998877b2c39f5bc2
Instruction ID: 41af3a9ec94132721c5082f5f78643c4ba0fad2bdeaf4cdccb47a3759151dda3
Opcode Fuzzy Hash: 5ecd6299fc180bb87a231512cc537cd14ffb5bd7eb23b7e3998877b2c39f5bc2
Instruction Fuzzy Hash: 053128306142018FDB05EB78D9967EE7BB6EF89304F14456AD046DB395DFB1C806CB81

Function 054138E8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c4dcd78c49b8a8e87c3cbd191f5fa007adbcc3366298ed2f02be6bfef7f0bda
Instruction ID: 9c357dfbab66791e0c57e7219750d98135d57ccabb363401cd8590d839267b7b
Opcode Fuzzy Hash: 3c4dcd78c49b8a8e87c3cbd191f5fa007adbcc3366298ed2f02be6bfef7f0bda
Instruction Fuzzy Hash: B3317C74B102059FCB14DF69D495AAEBBF6FF84340B14846AE906DB394EB30DD01CB94

Function 0543B21C Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4bb4163263dffb3463b3f18adac85b4283eaa988df268f5aaa75ad686aed186
Instruction ID: 636be70b9f1beff3f028721539bc089631b7f16efabf29fb33b2ea06a1a073e5
Opcode Fuzzy Hash: d4bb4163263dffb3463b3f18adac85b4283eaa988df268f5aaa75ad686aed186
Instruction Fuzzy Hash: BC411930904219CBDB18CF61C549BDDFBB2BF89301F24C696E859AB361DB30A985CF60

Function 064D02A8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f24835ee964c2b4898d6c055f899d6902a825baa79903427a7213e29355370
Instruction ID: 3e10dd1e704adaab2b59c090722628cedf59d148905ab21e084ad40b065420be
Opcode Fuzzy Hash: a5f24835ee964c2b4898d6c055f899d6902a825baa79903427a7213e29355370
Instruction Fuzzy Hash: 3D31B176F001198BDB84DEADD8A05AFB7B1EF84721F108A2BE921A7381C6719905CBD0

Function 06AFE168 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cda944e8ca12987d42a18b45ccf2167246341618442bace10b8ef51d8e280b3
Instruction ID: ce4dcc1eff9c9dd5c49d32f3a0afe7d1d6d81bec5a7f336b04f3e783a0cc8142
Opcode Fuzzy Hash: 6cda944e8ca12987d42a18b45ccf2167246341618442bace10b8ef51d8e280b3
Instruction Fuzzy Hash: 3B31C231B01242AFDF14BBB8D54011EB7F2BBDA244714886AD645DB355EA32EC06CB92

Function 02C777D8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d592dbe19e33b21d78cd3d06567f260680c7620074a51df329869cba93b77d
Instruction ID: e077552d966ff8bd4ad61284aa5f00d879afa99f87ccd678ee9d571e7996deef
Opcode Fuzzy Hash: 28d592dbe19e33b21d78cd3d06567f260680c7620074a51df329869cba93b77d
Instruction Fuzzy Hash: 84319932D1070A8ACB10EF79D840399B771FF99320F248729E159B7241EB30B9E5CB80

Function 06AF7F80 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3358bbf3e6c8044ca9ac94572d999b8dd2388adf4eec3a3befc3f3dccdf3e204
Instruction ID: f7b30567c173caaf5451a1fd1427365693e0e528cd4652a8040d25a6ccfd57fb
Opcode Fuzzy Hash: 3358bbf3e6c8044ca9ac94572d999b8dd2388adf4eec3a3befc3f3dccdf3e204
Instruction Fuzzy Hash: 0341EFB0D01249DFDB10DFA9C884ADEBFB5FF48310F108429E809AB254DB75A945CB91

Function 05AAFCE8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7bcda17c20d788932b8126f9adda77ada18785433c39fbaeee3d42ba465c9df
Instruction ID: 13818a3f3e8ecfc9c16a30030e8100193776fa3b8600a37313443ff2bb6ad904
Opcode Fuzzy Hash: a7bcda17c20d788932b8126f9adda77ada18785433c39fbaeee3d42ba465c9df
Instruction Fuzzy Hash: AE319535B00209DFDB189B69C458FAEBBF2AF88714F148419E506EB3A1CF749C01CB90

Function 05418E80 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc81fb65d8d22c3ed683311df4823b9958a94850851a22c46c257e1aa39c3c45
Instruction ID: 9840f0ff31d9fba4dd2df61ff3cee80260e918f156de2c3ca2f0e6ecafa8f79a
Opcode Fuzzy Hash: fc81fb65d8d22c3ed683311df4823b9958a94850851a22c46c257e1aa39c3c45
Instruction Fuzzy Hash: 023164317041114BC704DF69C990AAFFBF6EF85250B15806BE805DB36ADA34DC0587A9

Function 06AFE560 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5157d2b982efd85e44aa130836609f824710f627e5341a2b4bbd3c1a229aafe7
Instruction ID: cf92e9e2833742fee152cbf60a5d81ab082ba497c05af31c2acf6838d03fb7b8
Opcode Fuzzy Hash: 5157d2b982efd85e44aa130836609f824710f627e5341a2b4bbd3c1a229aafe7
Instruction Fuzzy Hash: 6721C432B16252AFEF152B78560402E7BE7AEC562832C486AC589CB305EE35DC478781

Function 0543F410 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abdff50935e8240c29adb57666f5c63e4fe406d1fea1195e9b84aba46e586d98
Instruction ID: 1de2ac49c42afcd542ed0759d66ee08dbff4ead66c8822fb99b5386e3afcee0d
Opcode Fuzzy Hash: abdff50935e8240c29adb57666f5c63e4fe406d1fea1195e9b84aba46e586d98
Instruction Fuzzy Hash: 94318A71A002059FCB24DF69C494AAEBBF2FF98300F18896DE4469B390DB35A906CB50

Function 05437028 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee06bb7cc94079cfc4309f04fa6f9a02435fb919bf17602f61c825332234da6
Instruction ID: 2454993ee660cfec46dd07d049d05cfe745aa3933c987fefe44914ab771d59e6
Opcode Fuzzy Hash: cee06bb7cc94079cfc4309f04fa6f9a02435fb919bf17602f61c825332234da6
Instruction Fuzzy Hash: 33314DB4A0031A9FCB01DFA8C8809BFBBF5FF89210B15449AE995EB355D730E941CB60

Function 02C7B8B8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e85f741c0294af0c6c78b45e8cceb1db35512b469bc9dac59cb6642071c03a3
Instruction ID: 227aafc7ffcc8897cab496fd611dcaa0e9a0f5cd61396b88815e2dfd09571967
Opcode Fuzzy Hash: 0e85f741c0294af0c6c78b45e8cceb1db35512b469bc9dac59cb6642071c03a3
Instruction Fuzzy Hash: 86317C303106058FCB08DF25E988A6ABBF5FF84319F048668E4198F395CB74ED46CB90

Function 0541F778 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f24501daad0f20e62bb727cab315753fb2e079600413b8946b481e4c2c83c9
Instruction ID: 34f631d36dde384216026ef1d2e1f26a6666dadcef64b9160825a295a35ef664
Opcode Fuzzy Hash: 65f24501daad0f20e62bb727cab315753fb2e079600413b8946b481e4c2c83c9
Instruction Fuzzy Hash: 8231CE74A046159FCB24DF65C584AAEBBF2FF88310F548469E85697790CB30EC86CFA0

Function 02C777E8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046f205986dde65bc82bf5ebb8b6b7270b02416809e196bb1e9a19135cebf51d
Instruction ID: b06a284b73f0611865a71a5ff855b14c34d8904c42adea0ddb4bdf2e44ef57bd
Opcode Fuzzy Hash: 046f205986dde65bc82bf5ebb8b6b7270b02416809e196bb1e9a19135cebf51d
Instruction Fuzzy Hash: C6315B32D107068ACB10EF79D8403D9B771BF99320F248729E559B7241EB70B9E5CB91

Function 06AF4EE8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3694c843ea19f919cbb02badb22d5f78a860c24f669eebb16852e7c0c225dd4e
Instruction ID: e865915b6ad7f07956be472eb62daec41d9793aec8d96a859170538dfd711674
Opcode Fuzzy Hash: 3694c843ea19f919cbb02badb22d5f78a860c24f669eebb16852e7c0c225dd4e
Instruction Fuzzy Hash: EB312678A11204DFD794DB68C588E9A7BF5EF4C715B254098F902AB362CB31ED40CFA1

Function 06AFDDC7 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ddd48e8902a78ca89b59056f97cd84666345297f87f3157de69e5c6976f979
Instruction ID: 17012874899d60b0010db398f38976dd3583334eeafd9c47a7ac53b24318d80c
Opcode Fuzzy Hash: c7ddd48e8902a78ca89b59056f97cd84666345297f87f3157de69e5c6976f979
Instruction Fuzzy Hash: 8B317231A001069FC705EB68D5809AEBBB6FF85304F14C569E4499B349DA35ED46CB91

Function 0543C4D0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aaff6dc5ed569232d5b1d2605b9048ea555403b8c9e0fc00fc6aafb2331e20d
Instruction ID: 5ef906934bbdac1c730edb30aeec93f8de8c091851fb30a91daf153242bf67f1
Opcode Fuzzy Hash: 3aaff6dc5ed569232d5b1d2605b9048ea555403b8c9e0fc00fc6aafb2331e20d
Instruction Fuzzy Hash: 34317C71B002199FCB04DF69C9859EFBBB6FFC8200B14856AD449AB365CB35EC46CB90

Function 05AAB6A8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1380be34f29ef4e5d746f4538dd20c40389d1e21f2bff9bf41fe36e61e6c1576
Instruction ID: 1f4a1695ae345dc51b116f373e470818121a7eeb352e7cb115cb4a6e8478e59b
Opcode Fuzzy Hash: 1380be34f29ef4e5d746f4538dd20c40389d1e21f2bff9bf41fe36e61e6c1576
Instruction Fuzzy Hash: 4B315A75A15218EFCB55DB68D898EAE7BB6BF48700F100059F502DB361DBB19C00CBA1

Function 054342C8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140e22ea996934b744d9a83c35cb1cf0bd56724d5668ef5790ff23b41e6fdd7c
Instruction ID: 2c756a59d9e997aa65b5ae5566a0a9672206795aabc7f3b8d09440fe2823ff73
Opcode Fuzzy Hash: 140e22ea996934b744d9a83c35cb1cf0bd56724d5668ef5790ff23b41e6fdd7c
Instruction Fuzzy Hash: 0C310330B102158FDB28DF65C559AEE77F2BF88310F50446AD442AB3A4DB76D841CBA1

Function 0543AF62 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff7a69f7f8e56f753ba74d5d786d5bf4bca63270eecdfd4aa085a56e4be2cd1
Instruction ID: bf001788b9244144d224b2ee5ecac46d762cd9329fa3b361659ffdbb9892b3f6
Opcode Fuzzy Hash: eff7a69f7f8e56f753ba74d5d786d5bf4bca63270eecdfd4aa085a56e4be2cd1
Instruction Fuzzy Hash: 64313931D1025A9BDB08CB65C555ADDFBF5BF89300F14C196E858AB351DB30A949CF60

Function 064D2500 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa609b450c92245aa184e31ebe9dc7876e0eed5fe1e273e094ce49a4919c243e
Instruction ID: 07d092a6b86224f75bf3933e76925375e7fed2d905e8febcbb5a63ca38421733
Opcode Fuzzy Hash: aa609b450c92245aa184e31ebe9dc7876e0eed5fe1e273e094ce49a4919c243e
Instruction Fuzzy Hash: F231BA30250A069FC751EB28EA80A86FBF5FF453147009B68E0458BB39D771F9598BD0

Function 05410E09 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68db6f8771ecc0a78f174b59172dd544efcc0ecb37411d01e060dd7ff0f65c28
Instruction ID: dd044b4e99ebfe502778b5a943c0f61cb5a5b3d73f33d82d1ef3b51ee008c425
Opcode Fuzzy Hash: 68db6f8771ecc0a78f174b59172dd544efcc0ecb37411d01e060dd7ff0f65c28
Instruction Fuzzy Hash: FD21CE70B006068BD748DB6CD4A867FB7B3AFC8310B148129E41ED3385DF30AD528B84

Function 06AF4EB9 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2831d9ce2e022b93f70ace5c0a3b70d087d153abd12db425af402393fa38be8b
Instruction ID: 4e199caeafddc03031622a3542b8372414af5c2c42520b25cb90944074d200a8
Opcode Fuzzy Hash: 2831d9ce2e022b93f70ace5c0a3b70d087d153abd12db425af402393fa38be8b
Instruction Fuzzy Hash: C3311478A50204CFD784DBA8C598AAA7BF2EF4D715F254099F506EB3A2CB35EC40CB51

Function 05AAEF1B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b7911bd973c098dbb794771a3c3dccc1c66da81a742d71c70e4862af407701
Instruction ID: 84e7d4ce7425fa61f87d2e014ead1e69c5c0dc08240e4f1a2d778c498101d8af
Opcode Fuzzy Hash: 20b7911bd973c098dbb794771a3c3dccc1c66da81a742d71c70e4862af407701
Instruction Fuzzy Hash: EA219136A00205AFD724DB68D895FBE7BBAFF88310F148459E502AB291DB70AC45CB51

Function 06AFDDD8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04c116221a7d3eac9b7ed112bf00a082f83ca652bbb61bae3a3984e2044c6c9a
Instruction ID: e168973a104a29bc13f24b4ae55193f6b30a6363bed86428639b996d436cadd3
Opcode Fuzzy Hash: 04c116221a7d3eac9b7ed112bf00a082f83ca652bbb61bae3a3984e2044c6c9a
Instruction Fuzzy Hash: 30318F31A0050A9FCB04EF69D9809AEF7B6FF89310B14C629E4099B349DB35ED46CBD1

Function 05AAFCD8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5425216cb757b900914a2f79b2ece20c20e5ec870b4f829a4a5243acda8c94dc
Instruction ID: 3139b3300beeb2e946f182d94bfd1e71149d6dffa074e8e026de22b7afd6e7a8
Opcode Fuzzy Hash: 5425216cb757b900914a2f79b2ece20c20e5ec870b4f829a4a5243acda8c94dc
Instruction Fuzzy Hash: F121B275B002058FDB199B79C498BAE7BF2AB88714F148429D516AB3A5DF748C01CBA0

Function 05413341 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c19436e42a6c88909d27df96ebd93a32710cde4f444f545f57634ddcdcbbbb
Instruction ID: 30eb5f1fe018f9a5532dca3254e195d5c86777d460112bff7478451f55414684
Opcode Fuzzy Hash: 61c19436e42a6c88909d27df96ebd93a32710cde4f444f545f57634ddcdcbbbb
Instruction Fuzzy Hash: 562192357002198FCF04DF69D880BAB77A6FFC5354B5085A5E905AF364DB34EC068B95

Function 02C7BA41 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c630fd24785f0efca35a831bee9ef6b0402b5e974a3e3a3320b0b6491a6462e7
Instruction ID: fa26e4f29b0c7f1761e26ff6071938f925411e51a89e344e680d439c0229a629
Opcode Fuzzy Hash: c630fd24785f0efca35a831bee9ef6b0402b5e974a3e3a3320b0b6491a6462e7
Instruction Fuzzy Hash: 64213E317102069BDB14DA39C99076EB7E6EFC4358B54883EE909DB354EB71DD02C791

Function 02C77B81 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59292747485df90da320ae6880f4d3d7e716fd243fe3699c182527b97c55082
Instruction ID: 4ea3542c638ffcc534a25151f38a9861137f955475b26cb869113c4d3a57c711
Opcode Fuzzy Hash: d59292747485df90da320ae6880f4d3d7e716fd243fe3699c182527b97c55082
Instruction Fuzzy Hash: 4321BC30B252448FD7195B71B46F37A3EA69F8970AB0440A9F447CB2C3DF298A45CB91

Function 02C71272 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ae432dccc89c18d78f97e1c2be343cb43bc17be010bdceee20e9fe9a607550
Instruction ID: 46fa7311e56d314ec5d19520d490d794880ca270d3fc9ce9aea5ec28720e8a93
Opcode Fuzzy Hash: 79ae432dccc89c18d78f97e1c2be343cb43bc17be010bdceee20e9fe9a607550
Instruction Fuzzy Hash: 37317A34A10204CFCB14EF78E58865C7BB2FF84305B148969E44ADB268EF34DD41CB51

Function 05AAEF32 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c170fdef8b48902f46e5867c7335fb9ad2e6d618114e0efd76ca1f361ae26efb
Instruction ID: f91881891b340e88aad6fda094904fc6007d497ebb60f8785fdc440960fbd26f
Opcode Fuzzy Hash: c170fdef8b48902f46e5867c7335fb9ad2e6d618114e0efd76ca1f361ae26efb
Instruction Fuzzy Hash: CB218036B042059FDB29EB68D894FBEBBBBFF89300F048119E552A7294DB715C41CB50

Function 06AFE550 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b3bbc40c7dd4ad0af1c92a9652928277d23e86bc301238f2e80488561fda104
Instruction ID: ebe0bcbc26247ec4958636d2d7eaf6387bac42131b4ca2d6101451c313ce2dd8
Opcode Fuzzy Hash: 9b3bbc40c7dd4ad0af1c92a9652928277d23e86bc301238f2e80488561fda104
Instruction Fuzzy Hash: 1F21D671B16292AFEF252B34450412E3FE76FC561872D486AC589CB30AEE34DC47C781

Function 06AFD9DA Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20fa195dc9ddcfcac6537fdf3af8a49e4b64441fb31eb2b8c34e08ae2a98ed78
Instruction ID: 4551d6e85e4ea9ab910130ca4aef3a7b674163af5ec2fd7fd25f98e70a24d1b1
Opcode Fuzzy Hash: 20fa195dc9ddcfcac6537fdf3af8a49e4b64441fb31eb2b8c34e08ae2a98ed78
Instruction Fuzzy Hash: 1E215C30250B069FCB51EF69EA80986FBF5FF443147009B29E1498BB29E770F9598BD0

Function 0103D7EC Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177093426.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_103d000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 002eb38cac20bc16f34e933cf3d251623ffc52fe495a21dba133f4417afdaba5
Instruction ID: 45d1a8637a3422ae25764f0732cb3d2c201f18e25249facd3b12f1afc2d8e5bd
Opcode Fuzzy Hash: 002eb38cac20bc16f34e933cf3d251623ffc52fe495a21dba133f4417afdaba5
Instruction Fuzzy Hash: 3D210871500240EFCF059F58D9C0B1ABFA9FBC8314F64C5A9E98D4B256C33AE416CB61

Function 05436E08 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce47e7f8e32971fd461b32410c313edd226b1f28f5df77d6d7c2826da67a07f
Instruction ID: fc2f726f9a947c28add524d3e4643ac1ae579650bd4479265e85aca6bafbd03c
Opcode Fuzzy Hash: 6ce47e7f8e32971fd461b32410c313edd226b1f28f5df77d6d7c2826da67a07f
Instruction Fuzzy Hash: 6821A074B002199BCB14DBA9C4956EEBFF5EF8C350F15806AE416AB354DF309C458BA0

Function 02C7BA50 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fe52710dc40de39ee35b9a5df24b10b466aa52857b05b235d00e6e113c7f34
Instruction ID: 08cc4714450204a72d429ac6592be6309420e0b36aa969a3c394a2a11cc336a6
Opcode Fuzzy Hash: 71fe52710dc40de39ee35b9a5df24b10b466aa52857b05b235d00e6e113c7f34
Instruction Fuzzy Hash: 8F215E307002069BCB14DA7A899066EB3A6EFC4258B54842EE809DB354EB71DD02C7A1

Function 06AF4EF8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3edc80f8424c30a505c21a525c5f530b72923877706f92cb70675488e19da170
Instruction ID: 3ede32453606d493723e67b859408ee45a7b13ffd78eee8e22b9433a867ba504
Opcode Fuzzy Hash: 3edc80f8424c30a505c21a525c5f530b72923877706f92cb70675488e19da170
Instruction Fuzzy Hash: 6D31E474A502049FD794DBA8C588E9A7BF5EF8C711B254098E906AB7A5CB31EC40CB61

Function 06AFE157 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584dd8518d5645c1e4d9954aa42450dffe8497c8d1365d6bc141c952cb2ec58c
Instruction ID: 8712ac1efb04d8150722ffb95b7ccda81dcb48f3dde16760434856b8207557f8
Opcode Fuzzy Hash: 584dd8518d5645c1e4d9954aa42450dffe8497c8d1365d6bc141c952cb2ec58c
Instruction Fuzzy Hash: 94216B31B01241AFCF11AB78D84009EBBA2EFD2314718487AE645CB355DB31DD16CBA1

Function 02C73CC0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8514e5d5d60cb9482617a0b91aae2d885902c43f1f45d1723fda43713dfc08b7
Instruction ID: 86d1a66dc7e54d71a67dd3cfb5c77a50e9dd05d9723e1797ebde32e4a45fb376
Opcode Fuzzy Hash: 8514e5d5d60cb9482617a0b91aae2d885902c43f1f45d1723fda43713dfc08b7
Instruction Fuzzy Hash: 57218B31B202048BDB089B79D4997AEBEBAAFC8301F148468E406E7395DF759C01CB50

Function 05413350 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc8a100b363f8e819c740fa57da839d70d1aaf4ea34705a52d67610ad81d177
Instruction ID: f61370742440c3aaad3e4898aef75515c7bb363203fea11d8e76b2d021822bc2
Opcode Fuzzy Hash: 6fc8a100b363f8e819c740fa57da839d70d1aaf4ea34705a52d67610ad81d177
Instruction Fuzzy Hash: 412183347002198FCF04DF69D890AAF77A6FFC9314B508595E905AF368DB30ED068B95

Function 06AF1EF1 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b714f3c3bcd6fbe099f7cbd6c28bc89e19961d418fa14e577f03c90096b8f6
Instruction ID: 87caf60905edb7bbcba5a6e5a471a10f0df5edf670a40e6ff8165b4682952a6e
Opcode Fuzzy Hash: a9b714f3c3bcd6fbe099f7cbd6c28bc89e19961d418fa14e577f03c90096b8f6
Instruction Fuzzy Hash: 6C21DE34600205EFCB14EF64D844AAEBBBAFF88314F00812AFA069B355C735AC51CBA1

Function 064D2610 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a845eaf88d8075e51a2e3742e1578dda86fae41beffeead6d572904f8b8d8e1
Instruction ID: 2dda4afa9f428503b48e2abc1c2975a6af4d361cf259f93cad6c8cbe31b5c7bb
Opcode Fuzzy Hash: 2a845eaf88d8075e51a2e3742e1578dda86fae41beffeead6d572904f8b8d8e1
Instruction Fuzzy Hash: FC1104323013047FEB506655EC50BABB76ADFC0660F108023FB489B2D0C6A19D52C7B5

Function 02C7E880 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f9d02fdfe6a4beb50e8869463b69ee885b5c9ca2f1ae7bb6a1101029e6ea28d
Instruction ID: 0e9c78d187a3fb9af222ec890ae6661594a420eb10438fe00cbe1f0488473233
Opcode Fuzzy Hash: 8f9d02fdfe6a4beb50e8869463b69ee885b5c9ca2f1ae7bb6a1101029e6ea28d
Instruction Fuzzy Hash: 1821B636B0021ADFDB10DF68C884BAE7BB1FF84310F148469E9159B361DB31D941CB50

Function 064D1048 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d38e005f260f496001ec1232c04a121cc9fa6014bc5a4eae42ceafd97407b46
Instruction ID: 57c93c1bd47cc9a54d69a67ea9dcdeee568f48e76fe2c1da4f7b5a9f18c9cf8d
Opcode Fuzzy Hash: 1d38e005f260f496001ec1232c04a121cc9fa6014bc5a4eae42ceafd97407b46
Instruction Fuzzy Hash: 3B110432B445904FC385BA3E882482E3BD7DFCA65135905BEE845CBB91CD28DC02C7D5

Function 05413F18 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e110c4ff6e2f5b89e24bbe1cfcabbfec4c17a7d3a86923eeaa857d0d47cf535b
Instruction ID: 6eed5a9f22ca6b3e0bd151ad9061437fe44f8dd8ac3adc4819e35d641b6a9f2a
Opcode Fuzzy Hash: e110c4ff6e2f5b89e24bbe1cfcabbfec4c17a7d3a86923eeaa857d0d47cf535b
Instruction Fuzzy Hash: 6621A935A152118FCB00CF6DC48499ABBF5FF99220B09C4AAED49DF366C670EC05CBA4

Function 05430040 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e4bce7a039c783a3fe33f6844d7b5e68d0bd974c189c28d3c05745fbf22d93
Instruction ID: 591d099ab236a232db3db4b08e010de34e061f9132598695d654fbce920ee4a8
Opcode Fuzzy Hash: 47e4bce7a039c783a3fe33f6844d7b5e68d0bd974c189c28d3c05745fbf22d93
Instruction Fuzzy Hash: 9A11C431B112118BDB24AB79E49965E7FE6FF8926132441B9E806C7381EE34DC42C790

Function 064D2510 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b84deb1445329812d47ccfaf33f58be9ee42e2eaa38ccc49673720622328049
Instruction ID: a86949fa53ec3fdfc99f940c47db247fe717f23ceddef1b06946f47cb8d7b33c
Opcode Fuzzy Hash: 3b84deb1445329812d47ccfaf33f58be9ee42e2eaa38ccc49673720622328049
Instruction Fuzzy Hash: 3A318931250A069FCB51EF68EA80A46FBB5FF44314B009B28E0458BB39DB71F9598BD0

Function 05413A39 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277f854bc8f6d181b1c6124b88c5e913da5699278f9dff961fd6672f79bad2b0
Instruction ID: e42877fb2ebbc780a147f8a3d2f621269022d984df4cf5589b60cbbb81d1fae8
Opcode Fuzzy Hash: 277f854bc8f6d181b1c6124b88c5e913da5699278f9dff961fd6672f79bad2b0
Instruction Fuzzy Hash: 7821F074B001065BCB04EBA8D8D1BEEFBBAEFC4240F504529E509AF394DE71AD0587A5

Function 06AFCD90 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 887f91bf380df89eed1a06baeab4b2c36040e4fb4a87d6143bab963cff2a47c5
Instruction ID: 1e52867767a864a03299089063e0e15d2594a3bc7d23cdd60a0cb9666b0406e0
Opcode Fuzzy Hash: 887f91bf380df89eed1a06baeab4b2c36040e4fb4a87d6143bab963cff2a47c5
Instruction Fuzzy Hash: 28219F34B101089FCB54EFA9D454AAEBBF6EB88720F148029E506AB350CB759C05CFA1

Function 02C7BB21 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6fc8c43fd2fa920194c8e5520789e4d6285e6a580a21a3a0e039a1f498b7465
Instruction ID: 5603da190d8487518aed9910352bb070398114097ec07b8acbd40269560f3466
Opcode Fuzzy Hash: c6fc8c43fd2fa920194c8e5520789e4d6285e6a580a21a3a0e039a1f498b7465
Instruction Fuzzy Hash: 02110032A0422A9FC704CBB9D88166EBFF4EF89310F10803AE808D7354E6758D42CB90

Function 05AAF89B Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609d2569b95be929a92644c089dfe902d78c9c1153ab176d2cc94f76b38efde7
Instruction ID: cfc6dfa8071ae918e168864baa0b4efba6d01140963502bec21584b24777a9d0
Opcode Fuzzy Hash: 609d2569b95be929a92644c089dfe902d78c9c1153ab176d2cc94f76b38efde7
Instruction Fuzzy Hash: A7212F34A053499FCB44DFA8C5509AEBFF2FF89310F104499E445AB355DB349E84CB91

Function 06AFDAC0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f98f82db5172839b9fa3d6caca2850b9a2c764ea364edeff219ccc53ac70d64f
Instruction ID: ef098bf09cb2d6e1798c4b76e5e3fb2b7c141da27c4878c4891d17a648e13090
Opcode Fuzzy Hash: f98f82db5172839b9fa3d6caca2850b9a2c764ea364edeff219ccc53ac70d64f
Instruction Fuzzy Hash: BC21A131A142058FC751FFA9D58095AFBF1EF80321F10CA69E2558B725D730E949CBA6

Function 0543FB01 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fafe837e4b147381551920554f50e3f3033c12c3e00ea89cb4a08460f869a9bb
Instruction ID: 9ecd1e97f4ea79d280cfdc7cf31249928a3fd3336236e700ca60462d129f25aa
Opcode Fuzzy Hash: fafe837e4b147381551920554f50e3f3033c12c3e00ea89cb4a08460f869a9bb
Instruction Fuzzy Hash: 87218035B002108FCB10DF64E459A9BBBF6FF88711B188499E85A9B385DB70ED45CBD1

Function 064D02B8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f10cfb6b5ee44243673fa02c4faf61f068a7afc08bc647935a795f90b37db1
Instruction ID: 8cf066fb135d142a4cd9f5597a57874665e6f6b09a457ce4bb780323b685f607
Opcode Fuzzy Hash: 29f10cfb6b5ee44243673fa02c4faf61f068a7afc08bc647935a795f90b37db1
Instruction Fuzzy Hash: 0511A0353447509FC3059F3AC8648197BB6FFCAA5132504EAF45ACB362CE21EC06CBA5

Function 05418880 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167eba117fea1381be7f69c609201586b3c8980e0d712dda2ed96cc5b62d144d
Instruction ID: 142a27fd65c2e943bf13d2dec5fee216e4129f4bee38de085155d81bae761574
Opcode Fuzzy Hash: 167eba117fea1381be7f69c609201586b3c8980e0d712dda2ed96cc5b62d144d
Instruction Fuzzy Hash: 4611D3357002046F8F05AFA998984FE7BB7EFC9210710882AF94ADB391DF70CD055791

Function 06AF4FCF Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a866278e8e4736b359a5a3e4b04c25de2c7edc341240308116794698cd40dada
Instruction ID: 9920238d709e9d2cf6f2ceaa86959657340429f7f34d317041ad3346c194daaf
Opcode Fuzzy Hash: a866278e8e4736b359a5a3e4b04c25de2c7edc341240308116794698cd40dada
Instruction Fuzzy Hash: 2D115B35B201008FCB94EB6CD59486DB7E6EFD862532544AAE60ADB371DF71DC048B81

Function 05433BC0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09bb12ee15ceb44172c0a62c0a015b4d471c8f3598149d3eeef7fbd0f61fe4f
Instruction ID: b9a7e0332176d5820c7121af644f2f61af8ff6f84ba7c913a95d6d3aa83dba0f
Opcode Fuzzy Hash: e09bb12ee15ceb44172c0a62c0a015b4d471c8f3598149d3eeef7fbd0f61fe4f
Instruction Fuzzy Hash: 0811B2327042545FD7189B69A4496ABBBAAFFC9210F20406BE506C67A0CA35DC91C790

Function 064D2931 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cda388416c22a85731dbb5660466dbbd0570af95fabef97cc33ccce0f55a3bb
Instruction ID: 14d97209d84ee6631247267289167f573bc71e57844d4373ba763332f2fa902e
Opcode Fuzzy Hash: 5cda388416c22a85731dbb5660466dbbd0570af95fabef97cc33ccce0f55a3bb
Instruction Fuzzy Hash: 3A2167B07006019FC359EB38D064A6EBBE6EFC5215714856ED59A8B360DF34AC82CB81

Function 05418890 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c21110e40b0f882284fdeee6d0d328b458d9359471f3266d4029f48c56b605
Instruction ID: 17412dba851985344900a08aa5ab1339203cfbaf454e7a2c3260353cb728f498
Opcode Fuzzy Hash: 67c21110e40b0f882284fdeee6d0d328b458d9359471f3266d4029f48c56b605
Instruction Fuzzy Hash: 761194357001086F8F04AF6998988FE7BF7EFC8210700842AF94ADB391DE70DD1157A1

Function 06AF3348 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 115c0b17858fd143437c268cf26c24e75b5122b92c8510d3ba517095f226d429
Instruction ID: 9e7284d7aa5305049653fb36ea805abaf8460a7a49bb4b0a9f2591673a653264
Opcode Fuzzy Hash: 115c0b17858fd143437c268cf26c24e75b5122b92c8510d3ba517095f226d429
Instruction Fuzzy Hash: 05115E363111149FCB059F68D884D9A7BA6FF89321B154156FA058B262CB31CC12DBA0

Function 05434078 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bddbf98581ca8ad76913377d56befe0210d99042ff622fe0c98d0350074844e6
Instruction ID: 50571215368f95b0bacb5d0f769f04f4f96a1ffcb67d21d0eb18ace202a8d5c9
Opcode Fuzzy Hash: bddbf98581ca8ad76913377d56befe0210d99042ff622fe0c98d0350074844e6
Instruction Fuzzy Hash: B311C1347003148FDB189B35E459AFBB7A3BBD8321B1484BAE9018B365DE76EC42C790

Function 064D2940 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5eb2d3bc8bf47e19d5feaaa6f7ecf3fd9556e1d3999e2edb2aebdbdf8e9e32
Instruction ID: 866ff1c30bcea97d3a9e0a27b453f50a32a64019d3b23dd2d6d5891c6ffd72d8
Opcode Fuzzy Hash: ca5eb2d3bc8bf47e19d5feaaa6f7ecf3fd9556e1d3999e2edb2aebdbdf8e9e32
Instruction Fuzzy Hash: 2D1164B17006059FC745AB38D064A6EBBE6EFCA215714856ED19ACB320DF34EC82CB85

Function 05AACA62 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71814242ef154000cc42c36c2d80b5d43f3fe41039dd934fed8101ff5e15872d
Instruction ID: b58ae5ddaeb3f13b896c3cb321699b21439c7a0890a2b754c982508ea5d70b6b
Opcode Fuzzy Hash: 71814242ef154000cc42c36c2d80b5d43f3fe41039dd934fed8101ff5e15872d
Instruction Fuzzy Hash: DD118431A001159FDB14DB69C4A8AAEBFF6FF8D710F144169E506AB361DB725C44CB90

Function 06AF7560 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd20b6ad478f3096f3caef6df81c78158e39bd602f63bf58945054ed6143e50
Instruction ID: 357235a28eeaf428d2ab40cc4eec8731e4f7ec2b55792df86670e1654f348f1f
Opcode Fuzzy Hash: 6fd20b6ad478f3096f3caef6df81c78158e39bd602f63bf58945054ed6143e50
Instruction Fuzzy Hash: 27119331B102049FCBC5FB68E454A9EBBE1EB85254B108569E10ACF354DB31DC42CBC2

Function 064D0F5F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c573b128816c2cce69c7f90637a2eef7d0bfedbe5f418b259638bc716e99f1
Instruction ID: f95cec85ae7c07a1eb428730af47aacba8f54e2945a4d127be267589a941fc53
Opcode Fuzzy Hash: 63c573b128816c2cce69c7f90637a2eef7d0bfedbe5f418b259638bc716e99f1
Instruction Fuzzy Hash: 3111C23BF006048FC750CE6AE8548DAB7B5EFC9621B1145ABE525D7662DB31EC01CBA1

Function 05AAD2B0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecdb77c8603ec63888da47a0621a770cf983b85e58708ee5e663387190afc7f8
Instruction ID: 18ab1409fc022cb91ce22e2bc3b603279a3d7c92265df8a166877615ec90c39f
Opcode Fuzzy Hash: ecdb77c8603ec63888da47a0621a770cf983b85e58708ee5e663387190afc7f8
Instruction Fuzzy Hash: A201B1332443055FC76253345C04DFD7FB6BAC2221720029BD0D5CF650DB224C898776

Function 06AFC12F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ad7079e82afba1e83c065482bd6c8b8f27bbec170f36ad42a40589744172d6f
Instruction ID: 2cdde69af966401bf387932eb73f0f8806354b35c1c155dfac0a1809874d8df2
Opcode Fuzzy Hash: 1ad7079e82afba1e83c065482bd6c8b8f27bbec170f36ad42a40589744172d6f
Instruction Fuzzy Hash: E5117A30B163545FC726EFB5AC406BF7FA6EBC1220B04856EF146CF242CA3489048765

Function 05437128 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7728f59790bcc2071022d2b2ec4aff99f749de5e7da82ec645fba0b9417277a
Instruction ID: 1a3e1e749e58214e295cbb7d70b979b325323391619a23bd9469202335b3a9aa
Opcode Fuzzy Hash: e7728f59790bcc2071022d2b2ec4aff99f749de5e7da82ec645fba0b9417277a
Instruction Fuzzy Hash: F3112E76B006199F8B08DF59D8408EEBBF6FFC8221B04C16AE949E7354DB34DA158B90

Function 0543EB18 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ece444fdca28c499ad678b930648398c364809d2bbf8680b6f7700507a73cc
Instruction ID: 7ccba699d28d58ee5bfdfff804f141d3e1f8cde40c246fa45b6ac70dbe930eb0
Opcode Fuzzy Hash: d7ece444fdca28c499ad678b930648398c364809d2bbf8680b6f7700507a73cc
Instruction Fuzzy Hash: 5B117C306053009FC724DB68D895AAEBBB6FFC9310B148969E84ADB395CB72EC05CB51

Function 0541E44A Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29b0e2191ef3f0ee3aee37a611d3f771b2c57184fd7547a10853d1448983137
Instruction ID: 130f6afd7f1ce4f75dcd6785020e71bc171d8e02422fccd7523a6c2b0cb00293
Opcode Fuzzy Hash: a29b0e2191ef3f0ee3aee37a611d3f771b2c57184fd7547a10853d1448983137
Instruction Fuzzy Hash: C611B6302407124FC724EB1AD88169FFBEAEFC0220B808A29A4568F364DF70E84E4791

Function 06AF7551 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea8189ab1b147a6a558f491bb7279376e9b4fe5586fba7b9a5a279d8d9070fe
Instruction ID: 48a4a0eb4985c21fbd3149cb6fa39e9ed9c1636f52a2e81b69813bd15d38c04d
Opcode Fuzzy Hash: 2ea8189ab1b147a6a558f491bb7279376e9b4fe5586fba7b9a5a279d8d9070fe
Instruction Fuzzy Hash: A311C430A242509BDBC2FB68A4646AE7FD2AB42144B14866AE046CF355DB34CC0287D2

Function 0103D7E7 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177093426.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_103d000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: b9d75be123518bd609eeca272a739cf2be8c3b03796773d5d7e0f7d8b0a894ae
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: 54219076504284DFDF06CF54D9C4B16BFB2FB88314F24C6A9D9490B256C33AD426CB91

Function 06AFCF12 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59dda638018fa360f84fb08a4b2a098b6c9db44b2a17ffb2bed89011ee8670ed
Instruction ID: d6da8fbbea8040f34f41767a28289d8144891150cff6952e8bb838da1cc6cb2d
Opcode Fuzzy Hash: 59dda638018fa360f84fb08a4b2a098b6c9db44b2a17ffb2bed89011ee8670ed
Instruction Fuzzy Hash: BA0126363115105FC345AB69E910C6BBBFEDFCE62171580AAF64ACB721CA70EC01C7A1

Function 06AFE650 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d42ed1be0883a4d841b8ebb231020f53134ecc698118275090371ed47a183e
Instruction ID: 6cc6cd21dae83b6862a665d43350be5f1581f92bb4ea902ec004d9c09beb367c
Opcode Fuzzy Hash: 45d42ed1be0883a4d841b8ebb231020f53134ecc698118275090371ed47a183e
Instruction Fuzzy Hash: D811AF30E116449FDB58EFA4C548BAEB7F2BB88304F248529F902AB258DB755C01CB51

Function 06AFB750 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01bd990441403f9e2ad3e03cb4e39580e128ce915d870944c5621b3444bdef36
Instruction ID: f093a7680f3a005fbe800af5193624b1fc429e47dcfcfdec8b1c6750b2f09643
Opcode Fuzzy Hash: 01bd990441403f9e2ad3e03cb4e39580e128ce915d870944c5621b3444bdef36
Instruction Fuzzy Hash: 7711CC30A112049FD755AB99C454BDBBFF5AF88710F19542DF202AB741CB719804CBF1

Function 05AAF8A8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d55e14b364a18256b482eafe738a25744bc00b5a7d723c52561668fe9d74b8f
Instruction ID: bdae9a3a349753656b3e92c6eb0a04170fab2934f6fab609d76d1058ee48c523
Opcode Fuzzy Hash: 5d55e14b364a18256b482eafe738a25744bc00b5a7d723c52561668fe9d74b8f
Instruction Fuzzy Hash: BC21BD74E00209DFCB44DFA8D5949AEBBF2FF88310F104599E555AB354DB34AE84CB91

Function 0543FA58 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6588c084e1bb0496bd3d1777af0bd0c185009cc0ea98e778bb58c95b9002633d
Instruction ID: b3925f426e2dbce372cbc403acd8c05560aea636e8702ceb27591012fbdac882
Opcode Fuzzy Hash: 6588c084e1bb0496bd3d1777af0bd0c185009cc0ea98e778bb58c95b9002633d
Instruction Fuzzy Hash: F811C130A04244AFDB14EB78C5526AD7FE1BF89205F2481EAD8058B3D2DA36DD46CB51

Function 06AF7429 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d859ceef0f9d554b2c7f70b2fc6d5a9836d018c1920f78fa5213269701eccc0
Instruction ID: 0d1fce6123dfcfed6c5bedbfc1a5f5d9c993458796b7b12d28ddf451be426e86
Opcode Fuzzy Hash: 2d859ceef0f9d554b2c7f70b2fc6d5a9836d018c1920f78fa5213269701eccc0
Instruction Fuzzy Hash: 1F11CE342416479FCB11DB29EA80986FBB5FF813147009B65D0458BA29D774F99D8BD0

Function 06222D88 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90bf69eb0e0b206325eb4fd318abcdae24914987b7a3fd4ab26971dd60418da
Instruction ID: 326c47c32f55d1ff3f0109f11030efea54616d161b762b73da73ddab2d6d1452
Opcode Fuzzy Hash: b90bf69eb0e0b206325eb4fd318abcdae24914987b7a3fd4ab26971dd60418da
Instruction Fuzzy Hash: 0F01F7333282129F9B50CA6CE44096BBBEAEFE9271325802BF848C7350DA35ED028750

Function 02C7B9C0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f224b213c02ba1dae8dee58a41aaa08ff10c63ffcc9a222fc77f970e3dd08809
Instruction ID: d25591c936e3a7315aa710f0d09304f2da5dc0c66cefa841c6b6637bba60f227
Opcode Fuzzy Hash: f224b213c02ba1dae8dee58a41aaa08ff10c63ffcc9a222fc77f970e3dd08809
Instruction Fuzzy Hash: 98018436700215AFD754DA6AD884A5ABBEAFFC83A4B54C526E908C7724DB70DD02C790

Function 05AAFE46 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd3d17ea7ed64b2b1ba6717e74256a11394689b99a096d7561c75b68cbb2ad5
Instruction ID: 6ca4ae89c199c7cb0f0f7f100e6c255ee07d5e3e05330e3a81ee52cfd8968083
Opcode Fuzzy Hash: 5cd3d17ea7ed64b2b1ba6717e74256a11394689b99a096d7561c75b68cbb2ad5
Instruction Fuzzy Hash: 0901493AB141544FEF2C52299810AFD7797EFC2610F44802ADC1AA7381DF64980343D3

Function 06AFC172 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed34d9aedc546656a999911959dd334166fee9ffc39c25d3a0b6bb63e06191f6
Instruction ID: 54bfb5c78c3a41ab56d59d330b219047c5963beb1054a0dfd46e1bf3503ac0dc
Opcode Fuzzy Hash: ed34d9aedc546656a999911959dd334166fee9ffc39c25d3a0b6bb63e06191f6
Instruction Fuzzy Hash: 3E012871A103145FD305EB659C40AB77BAEEBC4220B04455AF54ACB342DB705C01C7B5

Function 0543FF08 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b58b22092f3ec5a3e3e171beec701b1f9e9ca37f408338ac0c3ffee9c72950
Instruction ID: 2f0e766e771dec595fe1bd96d568c717abd86898c4c7eb1350307beb0ff2d9e4
Opcode Fuzzy Hash: 37b58b22092f3ec5a3e3e171beec701b1f9e9ca37f408338ac0c3ffee9c72950
Instruction Fuzzy Hash: E301B531B04204EBEB149B58C41A7EF7AE6AB8C751F14412BE806E73D5DFBD8845CB90

Function 0543A998 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac0fe04a14956de14a1cc866b86e307ac26d82a56cfbd2d363a31c95b45f77e
Instruction ID: e54d076792f8548116774773ae5267547c2e05dade736fe12ab0bc7015b17362
Opcode Fuzzy Hash: fac0fe04a14956de14a1cc866b86e307ac26d82a56cfbd2d363a31c95b45f77e
Instruction Fuzzy Hash: 7E114C31A50219ABDB149F65E859EEEBBB6BF88700F04402AF482A7394DF754804DB90

Function 064D2040 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68f61e003b0e8e0914cbff023278bd0b85d8fdf5c94551c629353ce2bddeb94b
Instruction ID: 34f11ee2fd51e272e6a9d59bc02009dc8a414094c7b6d22b7cace3ef23749764
Opcode Fuzzy Hash: 68f61e003b0e8e0914cbff023278bd0b85d8fdf5c94551c629353ce2bddeb94b
Instruction Fuzzy Hash: 91118E356002408FC769DF28D4A4A6BB3F5EF89318704456DE546CB369CB75EC86CB50

Function 06AFC4C8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a3fb4be3a2457d6f8a785cd4d39a1c3600fee0db6a65dc692dfec75652ec62
Instruction ID: 03de7a175c70c5e578cfbf20d5be8beb922095b270fdf8ba2a7bb5638d00a3f3
Opcode Fuzzy Hash: b9a3fb4be3a2457d6f8a785cd4d39a1c3600fee0db6a65dc692dfec75652ec62
Instruction Fuzzy Hash: C7015E767506159FC358EB6ED440966B7E6FFC8220705857AE606CF720EB72EC05C750

Function 02C70DD0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02aa9fd94af90b8f5c84d2ea36fb67b69907d7ef4135b51347b8f6997633037
Instruction ID: 3300968b0c385f9552d76fe25522deae71b30a18e60e2c84f0f5f952876c7088
Opcode Fuzzy Hash: e02aa9fd94af90b8f5c84d2ea36fb67b69907d7ef4135b51347b8f6997633037
Instruction Fuzzy Hash: C5019C70B083900BCB22537494E46CE7FA9DF9A110F0001FEE5D6DB3A9EB2544058793

Function 05430006 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e903a9cd95a28d0c595830373cb12c81c7e53a3405bbac7a5b4fbc1020e61365
Instruction ID: d85417cb5da37123a88d7340480256f2bf2103340ab52540c4e316f7d4919a47
Opcode Fuzzy Hash: e903a9cd95a28d0c595830373cb12c81c7e53a3405bbac7a5b4fbc1020e61365
Instruction Fuzzy Hash: 7901A2766493901FD3135626DC826D63FB9DB5A660B4D02FBD884CB253D51C9C4AC371

Function 02C797F2 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47dbb233448d95bfb2e96da343a65b9d2f482bd3327dba5026a82007b9a7743
Instruction ID: f8df3ee61b928db5c9aa5dc5469c6443f8279b665e4b6d6905ccabb77735bdad
Opcode Fuzzy Hash: a47dbb233448d95bfb2e96da343a65b9d2f482bd3327dba5026a82007b9a7743
Instruction Fuzzy Hash: DF115E35A141188FDB14CBA9C985ADDBBF5AF4C310F1980A9E405F7361CB75AD40CBA0

Function 02C7DE45 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd8c468d680c572a6271493dd4ce927f520a013af66774ef18740eb55292110
Instruction ID: 5e6ab66b426d733376067cc77dfc17ddf73b41a8979865a0e5353ffe7dcbf8bf
Opcode Fuzzy Hash: dbd8c468d680c572a6271493dd4ce927f520a013af66774ef18740eb55292110
Instruction Fuzzy Hash: 490124322143829FC715A629D8D574BBF66FFD2224F44857AE18ACB652DB20AC4483A0

Function 0541EB20 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2557be1b51a5e04f11d265733ee0e008768c3426c16bf65f2bfe8d7e88999881
Instruction ID: 54af6c1a6510fda2a4114a40cf7f06c86af4b024178fffdc7926c01a1d89ebe7
Opcode Fuzzy Hash: 2557be1b51a5e04f11d265733ee0e008768c3426c16bf65f2bfe8d7e88999881
Instruction Fuzzy Hash: F801FC357043508FC3169739940925ABFE5EFD6344B0841FAD849CB383DE65DC898366

Function 02C7B9D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a24dd59f4fe455ff68761380f73df8c2d98d47b97389c969ab537fc0b76341
Instruction ID: 86593770fa7eaa4d522e16dc3458ad71eedad7a4b32c95ac1ca47274c75a5a86
Opcode Fuzzy Hash: a6a24dd59f4fe455ff68761380f73df8c2d98d47b97389c969ab537fc0b76341
Instruction Fuzzy Hash: 820162357002059F9754DA6ED88496ABBAAFFC83A4714C126E909C7324DB70DD018790

Function 05411201 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5d766fef93fd5508a6ca5078d13fe275560d382252d78fa322c2b0404b458cd
Instruction ID: b6272f52e4f43ae623689c6e38ec981d6334f6fc00071d38c0b85c43a94d0d61
Opcode Fuzzy Hash: a5d766fef93fd5508a6ca5078d13fe275560d382252d78fa322c2b0404b458cd
Instruction Fuzzy Hash: 2B01D6767001128FC704DB69D45066DB7A7EFC821172985BAD908CB365DF31DC42CB81

Function 0103DC11 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177093426.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_103d000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cb067368b5ae7f579ebd83ddc391fbfc47fbed4c048d3fe740646885a6fb219
Instruction ID: 48f3d48e4d2d701e9482f6c66b1176fc93c0462c0a75cc407ba4d4e9cce2c3df
Opcode Fuzzy Hash: 0cb067368b5ae7f579ebd83ddc391fbfc47fbed4c048d3fe740646885a6fb219
Instruction Fuzzy Hash: 9C012B714293099AE7518A5ACDC4767BFDCEF81320F08C469ED894F183C2B9D840C7B1

Function 064D2050 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6e911e97b42b42c1bbab8cd1a75e40f2b4c868c65707591b7e85c0b341c9ff
Instruction ID: d5555a892effb4c15e75f3baea385a656c2300ac708c486cb78082be9b5b36cc
Opcode Fuzzy Hash: fd6e911e97b42b42c1bbab8cd1a75e40f2b4c868c65707591b7e85c0b341c9ff
Instruction Fuzzy Hash: 40015E357002009FC759DB68D454E2A73E6EBC9358714856DE506CB369CB76EC86CB90

Function 06AFC5A8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334a33917098c0db333d762b9ffa85eb656f9cd52a068ad693403292aa9f0cc1
Instruction ID: 03d2cc7a236b377c3d0c5533eed5c8580b7cfe0f9bd97bf5cab15cbffbf6fb3a
Opcode Fuzzy Hash: 334a33917098c0db333d762b9ffa85eb656f9cd52a068ad693403292aa9f0cc1
Instruction Fuzzy Hash: CBF0F4317142161FC789BB7598206AF3FEBAFC9610B044159F206DB382CD358D0287A5

Function 0543A3D0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76a0ef7a220d625b80acd3cd4418072cf24c0bf71799fa5a69da9487d7f10fd2
Instruction ID: 79da365f8b75bc6bc44451fe64be9d6b24adae80e4521db0ffe0e058de9d67c8
Opcode Fuzzy Hash: 76a0ef7a220d625b80acd3cd4418072cf24c0bf71799fa5a69da9487d7f10fd2
Instruction Fuzzy Hash: C101D631A442594BDB14CB66C5097EEFBF2AF8D300F1881A9D441A7391CF795D41DFA0

Function 05437F02 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fc6e7b7b16b6d7a1eb996f84e5e3059900bd1b6d1b3f55b0c21d383fb9b3e6
Instruction ID: ca95abea8a85bff10c4b5f30238e8f42f88f015c28e544f4991bd8db136c5afe
Opcode Fuzzy Hash: 84fc6e7b7b16b6d7a1eb996f84e5e3059900bd1b6d1b3f55b0c21d383fb9b3e6
Instruction Fuzzy Hash: 85010C74641206CBDB14CBA1D5959EEB7F2FF88308F20806AD50A9B764EB35DA47CB41

Function 05AACC9F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006e78260d2196134a7f950fdb338d9b7723b1ba7b49ddf4c22a58d0ed123e92
Instruction ID: 4a84c024545e6112e41676895aa3fcf98ae7486ae3d68432fc8a8d343a3a5159
Opcode Fuzzy Hash: 006e78260d2196134a7f950fdb338d9b7723b1ba7b49ddf4c22a58d0ed123e92
Instruction Fuzzy Hash: 8C01FC316052459FC751EB78D85048DFBF5EE451207048AA9E055DF254DF319E088BD4

Function 05415AE8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f080f859abf11ea51303308c610d19dc780e99a4ae96134d55a953f295afcbf
Instruction ID: c24afd3010148e3a92c3cac03e43ca0d99409d68e8f4e6cc9191a194be96c416
Opcode Fuzzy Hash: 4f080f859abf11ea51303308c610d19dc780e99a4ae96134d55a953f295afcbf
Instruction Fuzzy Hash: E5F0FF757042008F8708CFB9D984D9BBBEAEFC9260315C4ABE84ACB352CA70DC0187A1

Function 06AFC180 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd0bc2cf07679f5cd89541a9f29075a94244fbe53ad810d56e8d374d2f332e9
Instruction ID: 415547e02d40d3db97660b6fd8b3474769368f0d358d8930198b9d4e8dd824c5
Opcode Fuzzy Hash: bfd0bc2cf07679f5cd89541a9f29075a94244fbe53ad810d56e8d374d2f332e9
Instruction Fuzzy Hash: D6F0D671B103145FD714EBA99C84A7BBBAEFBC8620B04452AE54A87741DA709C0187A4

Function 02C79800 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cc1f176beb148cc704034fcd02cdd801a6fbab2b657ce576ab86edd546efd3
Instruction ID: 1e46fd9eb2e915ee3dc3a43116a848d71029f343484a9a1608558554b5a49f23
Opcode Fuzzy Hash: 54cc1f176beb148cc704034fcd02cdd801a6fbab2b657ce576ab86edd546efd3
Instruction Fuzzy Hash: 0B01E935A041188FDB14CBA9C998ADDBBF5AF8D310F1980A9E405BB365DB75AD40CBA0

Function 06222CD0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e27b6f9371e9d6ff92e02f2841e3c6709ac1db12c265a144925bbfadc03a6a
Instruction ID: 68a44a8204e2348f0a6f39080d352d6c62a9acbf933d1c7d83a192acbf541e69
Opcode Fuzzy Hash: d1e27b6f9371e9d6ff92e02f2841e3c6709ac1db12c265a144925bbfadc03a6a
Instruction Fuzzy Hash: FAF0F631771233DFD7A57BB9A4086AA77AAEF886613408566FD0ACB714EE72CD044780

Function 05AAC5F2 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1892d15a956c305e29292e7f34a28a6d9d01009ea5a1425d42e9551794997d3
Instruction ID: 6942dcf8af388d84d3c0d533ebd0efdde5916a786d5e3cddaca174bee661e334
Opcode Fuzzy Hash: f1892d15a956c305e29292e7f34a28a6d9d01009ea5a1425d42e9551794997d3
Instruction Fuzzy Hash: 0BF0C8317091005FE309C71CD864F7ABBA6DBCA320B14506AF405C7351DB669C418760

Function 05AACCE8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6399105142a10591b23f2683ac527b15b6f0c100b751bcbf4a11c10589a30f1a
Instruction ID: e2e226741cb52e6b87497c3184194e9660a39af780ea2c288754e676d179fc5a
Opcode Fuzzy Hash: 6399105142a10591b23f2683ac527b15b6f0c100b751bcbf4a11c10589a30f1a
Instruction Fuzzy Hash: 37F02B722092615F97229B7CA891CABBFE5E9D65103008A6FF09ADF244CB24DD0D87F5

Function 02C78F58 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fb68a012326538bcb26bbc5253b6e555b67432ba5526c3bf5d97679ef9c0d8
Instruction ID: efe9069c654abe9031463f7546ba19ae2ab6c4de04ba3e037366e7184bc16d4b
Opcode Fuzzy Hash: 80fb68a012326538bcb26bbc5253b6e555b67432ba5526c3bf5d97679ef9c0d8
Instruction Fuzzy Hash: 36018C75310610DFC715AB29E44DA197FAAEFC9316B1401A9F406C73A2CF75DD42CB80

Function 06AFE738 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21af7e36f48365d4a016c5ff1c40b28fcfb3733a77733d9af79c13fca5b1e15
Instruction ID: 99e0b0e7c20e8df923f9fd9bd347164c7b0e434550ab509566c44c169c2af78e
Opcode Fuzzy Hash: d21af7e36f48365d4a016c5ff1c40b28fcfb3733a77733d9af79c13fca5b1e15
Instruction Fuzzy Hash: 16F0F6357006115BC617737DA0582AEBACBFBC1261B04012EF5198F351CFA59C0683D5

Function 06AFC4B7 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ee3505fed58b5ca080c080897fa92af0daac97f7e3b4c56140eb51d4b2141f
Instruction ID: 75cdaac4d4015f7dc58faedd6a6bd1be6cc7b604e29720587d878420698d717f
Opcode Fuzzy Hash: 22ee3505fed58b5ca080c080897fa92af0daac97f7e3b4c56140eb51d4b2141f
Instruction Fuzzy Hash: DCF0AF352606148FC310DB69E444D96BBB5FF8632170145AAF302CF632C762EC44CB90

Function 05434C91 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd9da4f0b8888d996893d4c17c8add9a56afec65202143e6f29139153b46244
Instruction ID: 5c682e0e2ac4f16db704b501148f16eafc8b3d92bfafc9ad79e33677377e0167
Opcode Fuzzy Hash: 6dd9da4f0b8888d996893d4c17c8add9a56afec65202143e6f29139153b46244
Instruction Fuzzy Hash: 78F090763082086FDB108E59DC80EDBBBAAEF8D264B15802BF809D7351DA71EC018B60

Function 05433FE0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6030a03b818c8c543b02e7f89f554ab058d19d3e9c4d36ca5ccfa5fb930a14d
Instruction ID: 6a6770f331474c12df81775c8c7f7722a11f36303ffc41f31e777e88cd2420ae
Opcode Fuzzy Hash: c6030a03b818c8c543b02e7f89f554ab058d19d3e9c4d36ca5ccfa5fb930a14d
Instruction Fuzzy Hash: 1C017136214244DFDB52AF60F909AD73FB2FF48700B18854AF556C66E9C7329950DF40

Function 06AFCE60 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f753fe571764d4e930c06ffd321a4f09c4f6e187a614e54d40564a851ceecd
Instruction ID: c102960d56cd1f1197a2a6d15fe91d1e417286dd302ef70d964582c70db73e4b
Opcode Fuzzy Hash: 79f753fe571764d4e930c06ffd321a4f09c4f6e187a614e54d40564a851ceecd
Instruction Fuzzy Hash: 60F0F2363105109FC3489B2AD988C5ABBF5FF8D62035180A9F50ACB321CA31EC058B80

Function 05411B70 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa3e4d7dcf484acb192044b362ad5cc417f961e4d35dbd132074e4e3e3432a8
Instruction ID: 02599c0d7a6b4524119ecfcbe6de40dfe2af6e2ed65ed4436717e984df154b39
Opcode Fuzzy Hash: 8fa3e4d7dcf484acb192044b362ad5cc417f961e4d35dbd132074e4e3e3432a8
Instruction Fuzzy Hash: 1EF02776B04250CFD3058BA4E9943963BA2D79E316B1548BFD849C7388EA75CC03CB04

Function 02C77F18 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772e21837f1bce551b3309353a0760d358513d867b49dc5a015613b49f95b39f
Instruction ID: 2a4598f9faac5267da2c990141f5626bcb92804763b903761d50bcda35124981
Opcode Fuzzy Hash: 772e21837f1bce551b3309353a0760d358513d867b49dc5a015613b49f95b39f
Instruction Fuzzy Hash: 33016D31A103198FCB40DF69E8095DEFFF4FF88711B404129E449E3341D770AA098B94

Function 0103DC10 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177093426.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_103d000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e3955599b1cc883fefd72e818667de28009f363b0c5af13618bfc19fa1849b
Instruction ID: 1c528debb98bbbf87a2119ffa4f86646b606dbcb2f9d2b5fca6528f4cbe88e89
Opcode Fuzzy Hash: e6e3955599b1cc883fefd72e818667de28009f363b0c5af13618bfc19fa1849b
Instruction Fuzzy Hash: 1DF0AF714053449EE7518A1AC884B63FFE8EB90324F18C45AED484A282C2799844CBB0

Function 064D2258 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2271e16b54b343c1a8091a4abb6c17cc80ae77085b9411fccfd546b2891a630
Instruction ID: 78a829bf872f202094c2915cc0e1f8a2f39aac4c28951069faeaf13f0159adb6
Opcode Fuzzy Hash: c2271e16b54b343c1a8091a4abb6c17cc80ae77085b9411fccfd546b2891a630
Instruction Fuzzy Hash: E4F04934E04205AFCB50EFB8D8459EAFBF4FB49210B1485AAE91AD3351E7319A52CFD1

Function 05410F50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee857f68b67bddbf8745ef4ef3ca2c2c552bcf9247782597b14428f06ab09e0a
Instruction ID: 88778ce65e7b082d0d89a470faff7abaa02266122016e11516527db59769e173
Opcode Fuzzy Hash: ee857f68b67bddbf8745ef4ef3ca2c2c552bcf9247782597b14428f06ab09e0a
Instruction Fuzzy Hash: FFF0C8752007019FC711DB28D9D495EF7A6FF80310715DD3AE4598BB65DB70F84A8B80

Function 05418948 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41885efd8c5d428a3f1c57f2abf99585565e245b12d92361a2fd183ae555ba6b
Instruction ID: f2fb0b9412bdf1273c2a31d5e610204b1409c011d15c02754a3c35609c5bb437
Opcode Fuzzy Hash: 41885efd8c5d428a3f1c57f2abf99585565e245b12d92361a2fd183ae555ba6b
Instruction Fuzzy Hash: EEF0E9717081000F8709D7AD599496AEFEEDFC911031A80ABE00DCB396DB71CC014761

Function 02C78791 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c719681b911d74ed1140d05711f12abfb113f97224d24b132877d9259b58bc4
Instruction ID: 32b3dca059cf044e486a64576db90668f675a97faa4910e8c2cf957d4d4d9802
Opcode Fuzzy Hash: 9c719681b911d74ed1140d05711f12abfb113f97224d24b132877d9259b58bc4
Instruction Fuzzy Hash: 88F082353002015BC620D66DE9C5F9AB7DDDFC83147448639F24ADB314DB61E8068795

Function 02C7BB30 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc4d7765d8f4b0df2b14110cb0a10992f5ddc9a454b73c51dd75135432da6ea
Instruction ID: 26316a30c88998dd380bf84d6dbd7f11bbb3a31e6f1d79ffb7d92c65bd02fdb8
Opcode Fuzzy Hash: 6bc4d7765d8f4b0df2b14110cb0a10992f5ddc9a454b73c51dd75135432da6ea
Instruction Fuzzy Hash: 6DF0E2327006259BC3145AAD9C9092FB7EEEFC9360B50013AE909C7354DF71DC4287D5

Function 05433FF0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681ff0f64c6fde3f62388beb4b327abeae27fff27d445ad2da0ae03cc3809c12
Instruction ID: a0ebc862fece8230473097cba59504b790edf55a5817fbc2fddb8a6793c0af25
Opcode Fuzzy Hash: 681ff0f64c6fde3f62388beb4b327abeae27fff27d445ad2da0ae03cc3809c12
Instruction Fuzzy Hash: 13018F36214204ABCB22AF50F909AD77FB6FB4C700B18804AF552866A8C772AD50DB80

Function 0541C2C8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b94cf08b738a3bc3040e531ba60014d2a11da18cfdf078909e617d07b9e1d12
Instruction ID: 735c4f2cb8b6c0b8dfedf7bbddd3a9a2ddb0b2aa22d60e92c43d668cd975e1bb
Opcode Fuzzy Hash: 2b94cf08b738a3bc3040e531ba60014d2a11da18cfdf078909e617d07b9e1d12
Instruction Fuzzy Hash: 70F0B4353803014FD310DB29D8C0A9AB7E2FFD8250B148A29E586CB75ADB34EC468744

Function 05434CA0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b5b64e950fbec2d49c4c9de5a1eef7215e5f1d18d8145c96f5ff53287ae366
Instruction ID: 7f86bf1afc8824b2547c9332736e62f29213f5548314757e1e9dd8298ffa0739
Opcode Fuzzy Hash: e7b5b64e950fbec2d49c4c9de5a1eef7215e5f1d18d8145c96f5ff53287ae366
Instruction Fuzzy Hash: B5F012753042186B9B14DA5D9C40EABBBEEEF8D660B15842AF909C7355DA71EC0187A0

Function 05AAC654 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4fbf9e26ce49e954ab282e2d9e903b957741bebaf2a43ee2df16e9946a7a83
Instruction ID: e9a58d78a3cad4d5c7d770f34c2a248689a31c79d6eb234e779e0509d545487b
Opcode Fuzzy Hash: ca4fbf9e26ce49e954ab282e2d9e903b957741bebaf2a43ee2df16e9946a7a83
Instruction Fuzzy Hash: 1BF02E73B4D1404BE31AC31CA474739AB91EFD6221F0820EED5468F265EB1ADC47D344

Function 05415CA0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582ba750803822b26b6b345a22eb432a20c8619b9a0196f4104f01f1b459a71e
Instruction ID: 85217ffeb9c400ab612fe6ade8c227df2450397f42b2f977234e513f1750a0d7
Opcode Fuzzy Hash: 582ba750803822b26b6b345a22eb432a20c8619b9a0196f4104f01f1b459a71e
Instruction Fuzzy Hash: 3AE039713042141B9B18AABE58909ABEBEEDBC9264360807FA409C7345DAB1DC0187A0

Function 05410F60 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46cf993818b0cb2bef1d50f65d254ee95e5dc763e2ab137724d274854340fcc6
Instruction ID: 282d769df6fcbe2643f6c7664ecfc5375bc40a63d9a4890dbda53a2011a92f66
Opcode Fuzzy Hash: 46cf993818b0cb2bef1d50f65d254ee95e5dc763e2ab137724d274854340fcc6
Instruction Fuzzy Hash: 5CF090312007059FC314EB29D984C9AFBA6FFC0320740DA39E41A4BB25DBB0FC598B90

Function 06AFB931 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92a9656b963629654738b676ef3d13e7a8aab1b417dbaee614aa97faceb890f
Instruction ID: f209d2b3bf5ea67153ea1d27fd33225d6f54703f22acb86b44c5446acb38cca7
Opcode Fuzzy Hash: f92a9656b963629654738b676ef3d13e7a8aab1b417dbaee614aa97faceb890f
Instruction Fuzzy Hash: 23E022323102002BC60536ADAC9199FBE9FDFC9161B08863AF30ACB342CD614C0682F6

Function 0622DFCB Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f35e8f8a6e171e13fef7b17fa2001a04d23222caf27a552a02d447bf75fe9aa
Instruction ID: 756b8b8ee0e781d0abf804eea17649e33b08bf7aadf2bbee222e4ef79d6327b7
Opcode Fuzzy Hash: 4f35e8f8a6e171e13fef7b17fa2001a04d23222caf27a552a02d447bf75fe9aa
Instruction Fuzzy Hash: AF011934D0121ADFCB44DFA8D940AAEBBB1FF48311F10C52DD96AA7650D735AA42DF90

Function 064D2880 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9226cbd4b3eac6080aef83da317ebaee6ad06c1c53ed476ebf87fc8fdf8722c5
Instruction ID: ecb2427643e8e432f89d0018f279255043e6267b9c03d3c03d5613bdfde0b1f0
Opcode Fuzzy Hash: 9226cbd4b3eac6080aef83da317ebaee6ad06c1c53ed476ebf87fc8fdf8722c5
Instruction Fuzzy Hash: EEF05E776001189BD645B7ADF00CBAA77E9EB88325B04C126F309C6640CB745C82CBEA

Function 05AACD44 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a516093496747baf51454254197efe87c26ca75969b1e24a3deeb6a38b8e7c28
Instruction ID: b771c31807a1bb0224e4fb13044af232cf14648cfc216757ff40a4aa83177eef
Opcode Fuzzy Hash: a516093496747baf51454254197efe87c26ca75969b1e24a3deeb6a38b8e7c28
Instruction Fuzzy Hash: 05F02E735082918FD353DB3CD4F6599BFE1E9A25503448A9AE087CF268DB24DD0E8794

Function 06AFCEC8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64df3ed307fef14a5694fc49b2031b9233bab85e2026b26808bd609aa189c82d
Instruction ID: 2f9c52c8d8a4afc1f1e85e62da6321ceeb59cb5dee6b5cb0641c21b7bd90a537
Opcode Fuzzy Hash: 64df3ed307fef14a5694fc49b2031b9233bab85e2026b26808bd609aa189c82d
Instruction Fuzzy Hash: BAF08C363104148F8B48EB6EE944C5AF7EAEFD962131540BAF606CB731CA31EC01CB50

Function 06AFC541 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b15d299d7dedce36785d75063999a6fd645670766a69628fe2ed694834ab37a
Instruction ID: 7f26b0feecad142d6c2d02334fa0c041e039d92a1bcab7ab9dc0b24c35fdb5b9
Opcode Fuzzy Hash: 8b15d299d7dedce36785d75063999a6fd645670766a69628fe2ed694834ab37a
Instruction Fuzzy Hash: D1E092353196506FC3059269E814D973FEEDFC6A21B0541ABF505CB3A2CE608C0083B1

Function 02C79891 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91aa035c7989e25e2ae057407cb90931f02e16e45c824153cf54d416988acb1c
Instruction ID: b4de10acdb2dce6175bc616f4022c42a4f54a4ace57a3238d96a2726d1d968d0
Opcode Fuzzy Hash: 91aa035c7989e25e2ae057407cb90931f02e16e45c824153cf54d416988acb1c
Instruction Fuzzy Hash: 8DF0A7313002545BC7155B3AF85966A7F9EEFD9255B1C407DF506C3342DEB19801CA90

Function 05AAB64A Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066056cc92578593d06d99d56c05e87116413611b5190d9929a71ae84399b1e9
Instruction ID: ee1cee6f9738f9a8ccbfc34b8496a41a38c3c3dc398e04908fc4c2bf7666a681
Opcode Fuzzy Hash: 066056cc92578593d06d99d56c05e87116413611b5190d9929a71ae84399b1e9
Instruction Fuzzy Hash: D8F0A7343013175FCB189779E865D6A7BDAEFC5215304853CA00BCB205DF72EC0A8790

Function 05418958 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6d1d3cf8c52f8ba73791b119bdeb579aa1c6c9e759ed180542a9b5aa9368dc
Instruction ID: e69cfd416a2e0b1b855fcd25e6326b8ad46de940828992e2ad7c6bea80b98982
Opcode Fuzzy Hash: ac6d1d3cf8c52f8ba73791b119bdeb579aa1c6c9e759ed180542a9b5aa9368dc
Instruction Fuzzy Hash: 25E092713041141B1A18A69F58909BFEADFDBC9260354803BE40DC7348DE61DC0143A5

Function 054189A0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3daa5e832c2a225ade7e6685a4829d64fb6dd56bf1b02e1aaec9b1915e8f7c80
Instruction ID: c7fdae5691ceb894eec3c1c34833e537b4575e38e94f788cf52d3a8405d80fc7
Opcode Fuzzy Hash: 3daa5e832c2a225ade7e6685a4829d64fb6dd56bf1b02e1aaec9b1915e8f7c80
Instruction Fuzzy Hash: F8E06D367042046BC704DA5AD885F9BBBEEEB88370B14C066F90DC7341DA39E84387A9

Function 06AFBC20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9c4562ee3259c9147f895936e489c9fb2d043e587ba3a6752edbd26c5ffe4c
Instruction ID: add680900292a449d6db37703631201c5463d98d815ea7cce76af8bd8a33abd3
Opcode Fuzzy Hash: 2a9c4562ee3259c9147f895936e489c9fb2d043e587ba3a6752edbd26c5ffe4c
Instruction Fuzzy Hash: 6EE06D337000549B4728AA8FE8C4CABBBADFBDD2323544037F209CB220CA219C46C7B0

Function 06AF42B8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da0ae1d2f7c1fc1cd222bbe63b3fd4c6a8ade0c3415d0c5ce1f49450804c385
Instruction ID: 82e1145de5568738bb82de7bee6826b29d8c246c7dd6bfc6eb665172121cd2fc
Opcode Fuzzy Hash: 5da0ae1d2f7c1fc1cd222bbe63b3fd4c6a8ade0c3415d0c5ce1f49450804c385
Instruction Fuzzy Hash: A7F0A7353102108FC354A79DE844AA6B7EAEBC9331F55406AEB4AC7751CB71FC42C790

Function 02C77EB8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fdabd359e6e3efa0f22f7c716cc24f4c4bdc92f4b54b8dd4e2d5e0722489643
Instruction ID: 806e4bddcf4030a387598dc66353fb10fb307cadccf237f00b6149536d0e96d1
Opcode Fuzzy Hash: 0fdabd359e6e3efa0f22f7c716cc24f4c4bdc92f4b54b8dd4e2d5e0722489643
Instruction Fuzzy Hash: 13F055363341812BC3002669BC9EB8ABF6DEFC6210B44416DF04AC3386DEA59C0082A4

Function 0622DFD0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b956411d7e5640da5e7ea909e2e0a70ab9049d9b9c8a9dec5ea6f18f95013ef
Instruction ID: 218f20140676166978211fb50e10c1aa02fd0babd186572fb1eeb783f8833a82
Opcode Fuzzy Hash: 7b956411d7e5640da5e7ea909e2e0a70ab9049d9b9c8a9dec5ea6f18f95013ef
Instruction Fuzzy Hash: DB011430D0031ADFCB44DFA8D840AAEBBB1FF48310F10C929D96AA7640D775AA42DF90

Function 06222D98 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 078234d5fa4ac7fe9a17b0b1cf0896d32e68c488775d7d849ed438c8a220a341
Instruction ID: a267797ef31a0080d2819c3d8c0e0262180fcdfc0de5cf26515598516ae20c40
Opcode Fuzzy Hash: 078234d5fa4ac7fe9a17b0b1cf0896d32e68c488775d7d849ed438c8a220a341
Instruction Fuzzy Hash: E1F065363186156F5754CA5E984496BBBDEEFD92B03158026FD48D7300DA71ED018664

Function 06AFCEBA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba1727c2d43cf0205e5f248b6834d6fea6847b0db0301493a5c1e92f017415e
Instruction ID: 8cadbdcac5580a08fc8ce85aae3c62050777eadeaf48932687c1f71bfb84dc46
Opcode Fuzzy Hash: 9ba1727c2d43cf0205e5f248b6834d6fea6847b0db0301493a5c1e92f017415e
Instruction Fuzzy Hash: 22F0A7353165505FC745DB29E914C5BBBB69FCA62131540AAF506CB332CA20DD15C791

Function 06AF4318 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7b3ace76e5ca123c2bb46580d9b7b8ab8e7687528351d0f8d547fcf1f9fce9
Instruction ID: 992e0058d19d4426ef193b0a9aa65cf8f378e5ef79928b376e21aa1ab9733b82
Opcode Fuzzy Hash: dc7b3ace76e5ca123c2bb46580d9b7b8ab8e7687528351d0f8d547fcf1f9fce9
Instruction Fuzzy Hash: B8F0A7711006206FD324575ADC80D77FBEEFBC8311F508529F68646600CA75AC41C7A0

Function 02C7D4F5 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14bba2707648bb673f372d4a0377bc1047fe72b6413cdaca23c55cb9df5ded81
Instruction ID: 766e4e02ccb4b5900ba18c88254bd39c24fd016d1fffba1f1344a2564edaa980
Opcode Fuzzy Hash: 14bba2707648bb673f372d4a0377bc1047fe72b6413cdaca23c55cb9df5ded81
Instruction Fuzzy Hash: 8E01F674A11259EBDF14CB90D855FADBB76BF88304F144015F802BA2A0CB75A940DF60

Function 02C71EAD Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ac37a03e455030e899140978b3a47a8833d024a2f82145db63e767e492c1a3
Instruction ID: 30cfe19b35fd92a205272cef35debbc8eb0a595d9267193d189316d5b1b7d68d
Opcode Fuzzy Hash: c6ac37a03e455030e899140978b3a47a8833d024a2f82145db63e767e492c1a3
Instruction Fuzzy Hash: E6F0EC3460C388DFD7025775C4153DD7FB69F86200F1500A6D145A7291DF761959C373

Function 05AAA728 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538e492b275ba4f092e2381c49c8880155aab67fcbe23a1f7d5ddb3f8e45f8c8
Instruction ID: 8bb623b43d811df06074ec33ae4b06c40af1e01a4c4a0d59b2ed21f78833ecd5
Opcode Fuzzy Hash: 538e492b275ba4f092e2381c49c8880155aab67fcbe23a1f7d5ddb3f8e45f8c8
Instruction Fuzzy Hash: 29E0D8323041505FC301A7A8E89489F7BA9DFCB15631540FAE444CF351CD158C0343E2

Function 064D2268 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca162aca015281a7d5942cf40ecabf45e1ecc26d2c0dc866b9437c3d45e20ab5
Instruction ID: b1329697a2247e1c518f500e1613868c89034ee7c53fb2a31113e1b5730fb968
Opcode Fuzzy Hash: ca162aca015281a7d5942cf40ecabf45e1ecc26d2c0dc866b9437c3d45e20ab5
Instruction Fuzzy Hash: 45F0D474E00209DFCB44EFB8D5455AEFBF5EB48200B1485AAD919D7301EB359A02CFD0

Function 064D2A11 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de9aa887ceb58a11bae004c2dad76a8986bbf1fbdf264dde41c0d12cc55dbe6c
Instruction ID: 94ee8e3af7256519f57977ade01853d1d990e20d847df32a759a442269bec259
Opcode Fuzzy Hash: de9aa887ceb58a11bae004c2dad76a8986bbf1fbdf264dde41c0d12cc55dbe6c
Instruction Fuzzy Hash: E0E0E52231025017C22AA668E056FBFB7E9D7C1225F18046ED94A4B782C79568068390

Function 0541EB12 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03add50724f8fde799cffc1114f7e5e55ca8aea572af688929ffc8372988138f
Instruction ID: 61e05176efd07f00c958a46eb803fed3b4acaa5cbfc1ad6ad106cd76d0f1fe5a
Opcode Fuzzy Hash: 03add50724f8fde799cffc1114f7e5e55ca8aea572af688929ffc8372988138f
Instruction Fuzzy Hash: A3E09B3520415147C311926AD44578AEEDDDBD1724F0C82B9D45D8F383DDAA98C943A5

Function 02C734B4 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62f0712ee71ad920a358ca1b900bd240cea560b4cf5b6fa55d61ac96de8906c
Instruction ID: 8e8873c192b7e6665e3d4ba2128ca0f83add586cec07b7ba21589f3ac5377e19
Opcode Fuzzy Hash: e62f0712ee71ad920a358ca1b900bd240cea560b4cf5b6fa55d61ac96de8906c
Instruction Fuzzy Hash: EFE0D873D091D49FC71A4B79B8590F47F30EDA629478541EBD0819B062E315855BEB10

Function 02C71ECD Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9c97804c8dfc9bad79bc50549ae4b32fd520ff9d09c8456b9657e775af9941
Instruction ID: 27df389686b81218ba4b94b72f8498c7676bf5f93a00b19522149e5784d3aec3
Opcode Fuzzy Hash: 0a9c97804c8dfc9bad79bc50549ae4b32fd520ff9d09c8456b9657e775af9941
Instruction Fuzzy Hash: A1E02B53A0D3C28FD713836498653CC7F725FA3050B0911DBC085C72A7EA994619C323

Function 054343FF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d35757a8b744f1bb9d0f8a5c953d32e8892507e502e63d92f339f34184cb15
Instruction ID: 0424facaa48960ebd656670abc86d9dc6b47a3b13ea918cfd8b49566b264ba94
Opcode Fuzzy Hash: d5d35757a8b744f1bb9d0f8a5c953d32e8892507e502e63d92f339f34184cb15
Instruction Fuzzy Hash: A8E02C323411358BDE94B228F8AB7DEB354EB8226AF411624E0928B344DE281D828FC0

Function 064D0F30 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd056398c9755a48b286322bd9c61cb91ed6433a1359402728280c45dcaf12cb
Instruction ID: 53ba579f84c0390f5ea749bdb5b34be948f48c5b7c3c5407fc75cffdfeef3860
Opcode Fuzzy Hash: bd056398c9755a48b286322bd9c61cb91ed6433a1359402728280c45dcaf12cb
Instruction Fuzzy Hash: 24E08C31205264BFC702AA4ACC45CE37FADEF0A2A07158097F944CB273C636D92287E2

Function 05AACC62 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f2f3db3bd15aa08f8f956e745a6cef05b4f3028c75858a9074e4b6632f7d4a
Instruction ID: 3ff334686d3959b61dd3f991a3c098cea0818f4e0f9bccfd86d4afb5a4112d81
Opcode Fuzzy Hash: 43f2f3db3bd15aa08f8f956e745a6cef05b4f3028c75858a9074e4b6632f7d4a
Instruction Fuzzy Hash: EFE0D8313082B11B83225768746482ABB5AEACB51130541EEF546C7242CD1A5C1543F5

Function 05410D5F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1d3ab12e739659b64bce49d509e45153ea81075e869107ed27e28eeae27d2b
Instruction ID: a65d2e317400ba70c5919b750b30d70bdce3d329bd68d394ec1452066783453e
Opcode Fuzzy Hash: 3a1d3ab12e739659b64bce49d509e45153ea81075e869107ed27e28eeae27d2b
Instruction Fuzzy Hash: EAF0F839A441198FCB04DFA4D5986EDF7B2FB88314F1086A5E9096B265CB70AD868B90

Function 05410DC8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088b7f4476fd438497052f5303feb6312ab0dffbbfb43ad195715e908972cc75
Instruction ID: 4987299ba2c27282794914a06ddb064223bfebbd2212353c8d8e0e9285c6a174
Opcode Fuzzy Hash: 088b7f4476fd438497052f5303feb6312ab0dffbbfb43ad195715e908972cc75
Instruction Fuzzy Hash: A0E0863671015457CA197669B40DABE7F9EDBC4572B090077FA0DC3381CE2959458395

Function 06AFC599 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5312348f159c5108b607719b312f08027f716acb5071a07f6981322ee9ee0e70
Instruction ID: 9db17ec6240f5f751841e794f8639646aea99cb4dabdbcf6f085e1ca983a565b
Opcode Fuzzy Hash: 5312348f159c5108b607719b312f08027f716acb5071a07f6981322ee9ee0e70
Instruction Fuzzy Hash: 11E0CD322192542BD75576757D20A9B3E5EAF46521F04415BF105CA141DD114A1543E1

Function 06AFD3D8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea9e0a661946cdbe0e0e6d1926a0bf41a9fadb4cbe4ec89eb6abcbfef82b40a
Instruction ID: 7a73e2042f52433017bb0600d471ce75190e6f316df036012bb033a486e5c3b8
Opcode Fuzzy Hash: bea9e0a661946cdbe0e0e6d1926a0bf41a9fadb4cbe4ec89eb6abcbfef82b40a
Instruction Fuzzy Hash: 5DE01A382652409FCB41EB24E895F927B69DB45B04F288295F5058F2A7C662E853CBA1

Function 06AFB940 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d329505dbf1d0d7ac976a35e13a26624e2fd0d326fbc8dc15b92a62fd2148aab
Instruction ID: c6c8f2b612795f27f75949f4b061f7ff65ddd02a5821d2875acec35d164a804c
Opcode Fuzzy Hash: d329505dbf1d0d7ac976a35e13a26624e2fd0d326fbc8dc15b92a62fd2148aab
Instruction Fuzzy Hash: E7E08C323002111B864837AEAC9056FBA9FDBC81A0B18453AE30BCB345CCA19C0682E9

Function 02C7A361 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f8879bec888a87b08b5c2990a9c8c12e06091ccd613e4a05a95cb6b16fa5af
Instruction ID: 247f2eb3e6162b148c082e5c2fd8a9086cc7e3b8441a9c43057dd9bde54455fb
Opcode Fuzzy Hash: 69f8879bec888a87b08b5c2990a9c8c12e06091ccd613e4a05a95cb6b16fa5af
Instruction Fuzzy Hash: B7F09D38A401088FCB45CF99D9809CCB7F1FF88314B2181A5E505AB325D772AE45CFA0

Function 02C77EC8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 158887503135ce284f9e0c677c20d614571ab1ec155258dc7ebbce01ed42c14b
Instruction ID: 2f5799db2bcad8b0d9f52b2df688df5c524f0ea1155b0279dc65fe47a80967e0
Opcode Fuzzy Hash: 158887503135ce284f9e0c677c20d614571ab1ec155258dc7ebbce01ed42c14b
Instruction Fuzzy Hash: 4DE0DF353201446B83007A6AB89895BBE6EEFCA221740413AF50EC7346CEA25C0082A0

Function 0543F3C9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 499dbcc038b493133abae0dc0db7614218a27145eb62dcaa3108756bd08be76d
Instruction ID: 554a2160bb4a1e844c06810d88057496316b5ea617b925f4bfb13f296608ed76
Opcode Fuzzy Hash: 499dbcc038b493133abae0dc0db7614218a27145eb62dcaa3108756bd08be76d
Instruction Fuzzy Hash: 56E0DF726002446FC3049A19E486BCBBBF9EB866A4B04847AE01CC7300DB61E90087D0

Function 064D0EEB Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71d9dd787c78f8480b50856bda879f22d76c9d9503541cd9da77019acc56a6f
Instruction ID: de6ed0ede4d2e6d2d4c86f86dd7af06c038b419e10b2e5da811e9010a30d3db1
Opcode Fuzzy Hash: c71d9dd787c78f8480b50856bda879f22d76c9d9503541cd9da77019acc56a6f
Instruction Fuzzy Hash: 22F01C35F01105CFDB84DFA9D8908ADB3B1FF88314B5084AAD525DB362CA30AC02CB10

Function 054111C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d0088623facc02fa4fe775b267266794f44b8237061ffde744c6565b29e592
Instruction ID: 50fca1ebedea35b5adb4e15d1fa3c34ec5a887a30199528b45a5d258e51e8fb7
Opcode Fuzzy Hash: c5d0088623facc02fa4fe775b267266794f44b8237061ffde744c6565b29e592
Instruction Fuzzy Hash: 2CE09A72910318AFCB05CBB8EC846DEBFFCEB04252F0184BAE808E2241E6319540CB40

Function 054189B0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75d61997496a04747b46291fd3086ac440cea02591665621a9cb0285ea3563e
Instruction ID: 71d683129a98041af8ec78bd2d8dafdc2b88a522d8ba273cf024026269770fbe
Opcode Fuzzy Hash: b75d61997496a04747b46291fd3086ac440cea02591665621a9cb0285ea3563e
Instruction Fuzzy Hash: 4CE01A327042046B4714DA5ED444D9BBBEDDB88270715C06BF90DC7340DA31E8028BA9

Function 06222D41 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bee3a8c375da582a0c1f5e62b9cf3df73f3755193eec881a24fe3a9cda7d9fa
Instruction ID: 8eaf0e3cf03f87b15c28e499fd841c0ea5ffa790e060e5c0ab479e9663de9585
Opcode Fuzzy Hash: 7bee3a8c375da582a0c1f5e62b9cf3df73f3755193eec881a24fe3a9cda7d9fa
Instruction Fuzzy Hash: 4CE0923155A717DFE340DB74E9006B0BBF4EB00215F4809AAE488CA066E3355D55C791

Function 05431A65 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a9989d6432f9230e50853d53ac34c0dba26e72ea6c236b3e957e58cb31a1b9
Instruction ID: 1c1dafcf562f4cbad9a8ef06d1d919648a81ba01e53af52030583d367eb183a2
Opcode Fuzzy Hash: c3a9989d6432f9230e50853d53ac34c0dba26e72ea6c236b3e957e58cb31a1b9
Instruction Fuzzy Hash: 05F0F839A04248DFCB04DF95E4859DCBBB1FF4D321F20A056E9016B261CB319A91CF60

Function 05AAB5E6 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e0657f991c0b95c7f9a569926a024c2ea826de3011c135f0de00e1b0df17b2
Instruction ID: ca8dd308de8551fa083f258a786aaa0c3a5edd9ed79a7e1cacdccb50e75c7c4f
Opcode Fuzzy Hash: a6e0657f991c0b95c7f9a569926a024c2ea826de3011c135f0de00e1b0df17b2
Instruction Fuzzy Hash: ADE0E6B5D152096F9750DF78DD05DBBBBFCEA44200B014569E419D3241F7709A118FF1

Function 02C71F19 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4e8f015d23e7a139ae0f0f7ed1fc18354ab8fcad045f4dad73cf86442bd52a6
Instruction ID: 31ea2f9e8d93c494895deb729cefb22c495928fd2ffbbc5506749b1992752149
Opcode Fuzzy Hash: d4e8f015d23e7a139ae0f0f7ed1fc18354ab8fcad045f4dad73cf86442bd52a6
Instruction Fuzzy Hash: F6E02B75904308DFDB009BA5C4443DD7BF79B98200F500064C10167280DF79569987A3

Function 064D28E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9b6a2ba7ea1bcd69389c615caafd0341f2d0193985ac282e4fbc75a631d01d
Instruction ID: 29d0c9f3902aa4877274270023528f05831bf5ae262277ce14c1a25ff2b45312
Opcode Fuzzy Hash: 1e9b6a2ba7ea1bcd69389c615caafd0341f2d0193985ac282e4fbc75a631d01d
Instruction Fuzzy Hash: 92E026385182505FC382B324FC503D93BA1F782214B008295E182CB346CA344D0787D9

Function 05AAA257 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8988cb3ac3ee196ba3eb657c0b56d32b087ff1aaab2459394a4d9220af6dac6
Instruction ID: b4cdefae63ede4721eee64da1fc0bb59795c8d4ee6647ad8e611a31325f3f6ad
Opcode Fuzzy Hash: d8988cb3ac3ee196ba3eb657c0b56d32b087ff1aaab2459394a4d9220af6dac6
Instruction Fuzzy Hash: 30E0C2712593415FCB058B34DC59DEA3FE8EF0510030110D6F009CB363EA21ED01CB61

Function 05AACC28 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87569f2d716b0a0066dd549517529b0582d92b094e37a77957e0a9a5435df5a2
Instruction ID: b3d244a86d85777d8809b035fff8e2499e4916b27b06968a036cf0f0c5a453de
Opcode Fuzzy Hash: 87569f2d716b0a0066dd549517529b0582d92b094e37a77957e0a9a5435df5a2
Instruction Fuzzy Hash: FDE04F3030D2855FE705DB759865C21BB699A86505349C4DDB45ACB543DA17DC0382A1

Function 0541BDD2 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de080361fb518bd35542c7c022750c5b67dcfd3c2fbfbb6a6b8e5acc73eef39
Instruction ID: 48c06fe3f15c0e5361e95994d8d347feab1cef6717732e5901d35c880515dedd
Opcode Fuzzy Hash: 3de080361fb518bd35542c7c022750c5b67dcfd3c2fbfbb6a6b8e5acc73eef39
Instruction Fuzzy Hash: 19E02C31A01209EFCB00DBE4D8807CCB7F8EB44300F0002A8E408EB340EAB9AF418B81

Function 05AACB6A Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823643cd4c177ec7f9cd7a852e6ee7ac97b243c2a8067cfdea7ec39ceab3bfd6
Instruction ID: 61cafe3fe0484a2b9e8ee5d2e0b3d4d9f86ebc4e34e511a2c10e2ca719e6ac6f
Opcode Fuzzy Hash: 823643cd4c177ec7f9cd7a852e6ee7ac97b243c2a8067cfdea7ec39ceab3bfd6
Instruction Fuzzy Hash: 00D0A73B7012263F4130222AAC28CAB7A5FDAC59763080036FA45C3300CE51DC0542F0

Function 06AF54C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8febc7ca7423d938a0e6ab8875ccb3404605eb19f57c1889d629ca3d2d1c0402
Instruction ID: 6822cf07699d3efe8c910a16a0d7dd058863ce2949676491cd506027fc65b8cb
Opcode Fuzzy Hash: 8febc7ca7423d938a0e6ab8875ccb3404605eb19f57c1889d629ca3d2d1c0402
Instruction Fuzzy Hash: C7D05E22710121270658219E389886EE6DEFACF561350403AE60DD7340CD115C0603A5

Function 02C71EBD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8dc62201d683d24ba9d1c62df0aa12addff81bca387a846d7578c657580949
Instruction ID: c5d06ca31104f891e8713c60d121d3a545987b1cf2ce7131e5c1cd6e2b1f2404
Opcode Fuzzy Hash: bf8dc62201d683d24ba9d1c62df0aa12addff81bca387a846d7578c657580949
Instruction Fuzzy Hash: 1EE09A20A0D3C59FD7038BB4C82429C7FB69F86208F1A00E7C185DB2A2DB760A588373

Function 064D24C0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f4d6584c7e6b16bead4a7e9d5f345f437c1c40fafec54d12e1f0998623b063
Instruction ID: 34a1a9feb5aa0876f545f92b895c1a7bacc7e9f25169cacd32f3a86290d99177
Opcode Fuzzy Hash: 60f4d6584c7e6b16bead4a7e9d5f345f437c1c40fafec54d12e1f0998623b063
Instruction Fuzzy Hash: 00E0863A2097809FC756EFA9F5558427FECFB4A614304049AF185C3712CA65E801CFA6

Function 05AAA738 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d89f457c8d793a386855a9ecd690d7e929b769232a2fe2833bef0c5297c81f
Instruction ID: a3f7dcde8c74d4adbb265f46ad4694d7e273151b07801c3d9d20142e3f8370dc
Opcode Fuzzy Hash: d7d89f457c8d793a386855a9ecd690d7e929b769232a2fe2833bef0c5297c81f
Instruction Fuzzy Hash: ADD0A7323000145FC200A6AEE494CAF77DEEFCA66276410B9E109CF364CE21DC0347D5

Function 06AFC550 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5de47c87ba91564965773b8d3076353f0a181b6c8ba8ea8ed41f2e4e04afec
Instruction ID: 858fb7a7b155806d543e9a2e6619e7a2a0fc96df879e6b2c3254fb0a4c8c5383
Opcode Fuzzy Hash: 8f5de47c87ba91564965773b8d3076353f0a181b6c8ba8ea8ed41f2e4e04afec
Instruction Fuzzy Hash: A6D05B357401145BC714676EE818D1B7BEDDFC9A21B05407AF509C7360DD71DC0187A0

Function 06AFB8E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7845423ec2630abc733ff59e50d273c8c48836d08a29353665a97e8c9d183c94
Instruction ID: 5d9562f4cea950bffffc4b6ced464e91447e43ec7d155d9e7eaebcb66693a693
Opcode Fuzzy Hash: 7845423ec2630abc733ff59e50d273c8c48836d08a29353665a97e8c9d183c94
Instruction Fuzzy Hash: 6BE0C2312113158BC724A76AE40486AB7BAFEC03A1350443EE21687624DA71F8868790

Function 06AF5076 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5525253b90434886537e566741493e13b7902a174ef208a65bd262b64205af4e
Instruction ID: 8aefd85962d3de1fdf98837524291e6207c76e39302343ac9c8e68aadd1341ce
Opcode Fuzzy Hash: 5525253b90434886537e566741493e13b7902a174ef208a65bd262b64205af4e
Instruction Fuzzy Hash: CBD05E33B100246FDB18EAB9BC408BFB39ADBC8210305C53AF509C7004E9759C1282F0

Function 06223FB0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab152a43a91fa1298a66bfd41808484e4706d734e9d6562827dfc73f41ac9ea
Instruction ID: 0fdf37e09c4db8b7fa9543c6cef9bee520047a6c1161dcda3f93365194bc2fd0
Opcode Fuzzy Hash: fab152a43a91fa1298a66bfd41808484e4706d734e9d6562827dfc73f41ac9ea
Instruction Fuzzy Hash: 94E0C230B1E395AFC74662702C154677BFD8A42204314809DFC04CA142CD2AC802C7B2

Function 054375E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68de319257358d25c9e528bed4d4fdaa8729191666b65b3d5ec4298ee8150ae9
Instruction ID: 23dd5bb744dead80206cdc3b13e6699a319aff8341ffb93881820d5a0612b771
Opcode Fuzzy Hash: 68de319257358d25c9e528bed4d4fdaa8729191666b65b3d5ec4298ee8150ae9
Instruction Fuzzy Hash: B9D0A71235002023C714111CB8617DE595EEFC7956B56413BF086D7304CD404C430791

Function 0543F3D8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 613174c7ec015d7003c8f2d80c25400c74bf4a60ed623658be9aa18159f3ac82
Instruction ID: 79bfe0669148788f63b877ebb7996cff0db0cbb5feeddfc450fb6b782e8360da
Opcode Fuzzy Hash: 613174c7ec015d7003c8f2d80c25400c74bf4a60ed623658be9aa18159f3ac82
Instruction Fuzzy Hash: DFE082312002119F8300AA2AE489C8BBBF9EACA261300886AE05DCB310CBA0EC058BD0

Function 064D2220 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5986f9b5073f475cab2c056f52278f0ecc3430771f3ff44bab14d21472801704
Instruction ID: fa9d1704a7b05bc00cb4fb0e518849e225f1ff2d32f454ea2e396469506f956d
Opcode Fuzzy Hash: 5986f9b5073f475cab2c056f52278f0ecc3430771f3ff44bab14d21472801704
Instruction Fuzzy Hash: 1BD02B617092D15FD70633A464701DEBFA5EFC7660F0500DFE18AC7542EA950C0043F2

Function 05AAB5F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 726edb83694af3bd01f5735a0762dd3d64d2f80e2a4b237c6febd02ca6bde33c
Instruction ID: 6b1f2774fee35e9f99063b5fbc1cb6c9c52d65460727d3114e802ec6bcb22528
Opcode Fuzzy Hash: 726edb83694af3bd01f5735a0762dd3d64d2f80e2a4b237c6febd02ca6bde33c
Instruction Fuzzy Hash: EBE0ECB1E0520D8F8B50EFB8A945A69BBF4FB48200B0441A9D80DD7241FB31D9208B91

Function 05AACC70 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ea55deb13f8edd585fb456da1defc9238942d8cbaee8cbdee986573b898382
Instruction ID: b9fa494b368ecdb6df792ebd8798c3ff09afd223a763a5f832d0e508b335a5df
Opcode Fuzzy Hash: 28ea55deb13f8edd585fb456da1defc9238942d8cbaee8cbdee986573b898382
Instruction Fuzzy Hash: 77D0A7363001311702242A9D74A446E769FE6CA972345002EF60BC7340CE5A5C0503E5

Function 054111D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dcc54a1c8b11a04dcbf047e1fbee0a4f06263e75ed5a221c663086c8310ceaf
Instruction ID: d91e40ce4c76c13416de407aa231109297c5dfc5249e4e0a25cef2af65cd338f
Opcode Fuzzy Hash: 1dcc54a1c8b11a04dcbf047e1fbee0a4f06263e75ed5a221c663086c8310ceaf
Instruction Fuzzy Hash: 25E0EC31A10218AF8B15DFB9E8495DEBFF9FA48265F1084BAE409E6201EA319541CB80

Function 05411BA0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0994799ab2ae6f57177045be812f36ef8faf5429587608b83f23c77d3e3e8c1c
Instruction ID: a8da98612264b9b6e75f4c6492d49d70d717dc66c2e23f89f7ad1215dddeeb7a
Opcode Fuzzy Hash: 0994799ab2ae6f57177045be812f36ef8faf5429587608b83f23c77d3e3e8c1c
Instruction Fuzzy Hash: 50E01235714321CB8315AB39E40455277DBE7CD225320847AEC09C7708EE72DC02C780

Function 06AFCD60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d8ec9ebf5c4a539efe8db2e11031c60da21ae44120bb1ea82af987c30b5b7a
Instruction ID: 0c704e08e81e785140d0d5d11dfd74af12e7e0f9c5f9a972c9c9243f67a642b2
Opcode Fuzzy Hash: 26d8ec9ebf5c4a539efe8db2e11031c60da21ae44120bb1ea82af987c30b5b7a
Instruction Fuzzy Hash: 77D0A73312D2521BC34A523438209D32FBF8FCA10171EC282F805C7163CB180C1703A5

Function 02C7BB98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8331172218c9b8dfd20789515449a40fea4d25e6bce9c96f63c3bc0378ad099c
Instruction ID: 22ff127971f7193bd2b920384cb882005f9fff0e72b7a09ef76a6a451aed35df
Opcode Fuzzy Hash: 8331172218c9b8dfd20789515449a40fea4d25e6bce9c96f63c3bc0378ad099c
Instruction Fuzzy Hash: 35E092B4D0420D9F8B94EFAAD4416BFBFF4AB48300F10816AE958E2244E7395A51CFD5

Function 0622F769 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d064a02424204abd58729e6fb3f621c05875913c3254f752f4aebf1f9790c3a2
Instruction ID: f6f05a965033f616ce815147cdb43e9bca7de866656555c7dfe34d02ea76840f
Opcode Fuzzy Hash: d064a02424204abd58729e6fb3f621c05875913c3254f752f4aebf1f9790c3a2
Instruction Fuzzy Hash: BED01774072616AFD2759A18EA48FB23FEDAF4560EF5800E4B9484A622D660E521C6A2

Function 06222CC3 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e6ef166a409bfe78dd399e6f43d136277d624cd4d27372d5e20b7c361d1399
Instruction ID: ecf0976fc2611b16f9eb821cd505f90534a50a21cf4b29be746c2a73dadd284e
Opcode Fuzzy Hash: b1e6ef166a409bfe78dd399e6f43d136277d624cd4d27372d5e20b7c361d1399
Instruction Fuzzy Hash: 44D05E3061E7A62BC32216A59C08483BFAAEB43010B0985EBE945C2142EA65C84883A0

Function 05434410 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa82bcf362ad2c45a4b716604c83269877954911aee702d9d5792214411f6a3
Instruction ID: b0a918f04dc944c88c4d04f0c99f72a83eb4c861c3995d043e0d76ba7897762b
Opcode Fuzzy Hash: 4aa82bcf362ad2c45a4b716604c83269877954911aee702d9d5792214411f6a3
Instruction Fuzzy Hash: E4D02E307111368BCAA5B774F898BEEF399E786222F400228E0058B348DF682D818BC5

Function 02C73460 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 233b47e9d0461187af55ef5958d4a182d0539d290402a28f880034c1421787fd
Instruction ID: 4c46403f6deb5fa3f6726586163d0941d8caf2be15b382526259c3c453f2ca9c
Opcode Fuzzy Hash: 233b47e9d0461187af55ef5958d4a182d0539d290402a28f880034c1421787fd
Instruction Fuzzy Hash: CCE0BF36D10508CFCB04DFA8E4458DCBB70FF89325B004166D51577221EB306999CF50

Function 02C77E72 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c27d97445bd00be7d303ee0caaca070a08c9dd68def31f25ae1ab4ccb31207
Instruction ID: 75226390fc48aeb771305887b62038449dfdc5254d642be314b25e3937646e80
Opcode Fuzzy Hash: f1c27d97445bd00be7d303ee0caaca070a08c9dd68def31f25ae1ab4ccb31207
Instruction Fuzzy Hash: 4EE04F746241848BD755EF35D48670E7EA2AB86301F488559D041CB2DACA75EC419704

Function 0541BDE0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c01c160f8c05c14d8d7ebb34c3e5a21d4fa23331dbd8c943e4a0e321572e7c
Instruction ID: 0c603e8e42997b45183e9358ddfb008e04a8098a31b8c80981287112ccfeed9a
Opcode Fuzzy Hash: 61c01c160f8c05c14d8d7ebb34c3e5a21d4fa23331dbd8c943e4a0e321572e7c
Instruction Fuzzy Hash: D1E01235A01109EFCB00DFA4D55069DB7F9EB45301F5045A9E408DB344EA715F009791

Function 064D24D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda9816a8c55a02a2e034315c1fdc01254b39acf8b7c2499aaa92ffe8f77d037
Instruction ID: 7036f75a65a6f61dc84fa77a3c9306524f0990d809f67a577c5d092c3a3d8e64
Opcode Fuzzy Hash: eda9816a8c55a02a2e034315c1fdc01254b39acf8b7c2499aaa92ffe8f77d037
Instruction Fuzzy Hash: 01D0923A6016149FCB09AFA9F549846B7ADFB4E6153040465F609C3715CA75EC018BA6

Function 064D1958 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ce6174ee1c0eb77aff51b0a466738b84e0fe6e73cfcef90dd83dfb70f6375c
Instruction ID: 9054a10cbdc97a101024766b928a4d09b7f9bb4210188aea528ed0af94003c91
Opcode Fuzzy Hash: 53ce6174ee1c0eb77aff51b0a466738b84e0fe6e73cfcef90dd83dfb70f6375c
Instruction Fuzzy Hash: F3D0122016B6806FCA425265AE92AC33F24D753BA0BCA0682E8008B893C41E995793F3

Function 05AAFCB1 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8196fb4eb6804668756f9978ddc38f02e803cae63777e24b88461a22f1d7d0
Instruction ID: a78ab488bdfdbeee9d277224568d3fbd1e45d9ef69f834a742b1f531013a03db
Opcode Fuzzy Hash: 9a8196fb4eb6804668756f9978ddc38f02e803cae63777e24b88461a22f1d7d0
Instruction Fuzzy Hash: B4C0801000E3816FDB1107321C548FF2B759497551B0700C7F740C5042D50C87649732

Function 06223FC0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22b62ca32f1ee00041c6e01aa41454d33ce2d4ff7d3ed21255afdbcc9e3ff55
Instruction ID: 2a7eca2e4e8a85ab7931aa62a689f469b4ab9724e533711c090d21eb9f2ed1cc
Opcode Fuzzy Hash: d22b62ca32f1ee00041c6e01aa41454d33ce2d4ff7d3ed21255afdbcc9e3ff55
Instruction Fuzzy Hash: B5D012317153168B8B4466B5781452A33DED784648750447CED0DC6644EE3BDC11C551

Function 0543DF22 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d757e60dde46d440c9003c935a7f8d2620fa59c220d9c9a8b326f4f47378b9
Instruction ID: fe94c8a141df45fd8e7d3e2b991a67a8ab3eded1a3dbb33be9629ac919a4bea7
Opcode Fuzzy Hash: f5d757e60dde46d440c9003c935a7f8d2620fa59c220d9c9a8b326f4f47378b9
Instruction Fuzzy Hash: 4DC012223110610BCA5A26A8A8AA7CD96A4DBA6162F820B25E1AADB3C0D9000C8203E1

Function 064D2020 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09bb8c47442453ef2c91a9e980a33dd3b4160fb4ecbb0df174527258f1f510a2
Instruction ID: a0c75eaab952871de88a38d7d590facb79c9b944decfa7b0460712b717d42f8b
Opcode Fuzzy Hash: 09bb8c47442453ef2c91a9e980a33dd3b4160fb4ecbb0df174527258f1f510a2
Instruction Fuzzy Hash: D9D0A73511C3808FC301CB29E458C30BFE8FF0650830940CED0498B623C612F800C751

Function 064D2230 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7084d8961b324fc89119bfb71eb0e667796e10470dd78e849930222560bc74
Instruction ID: e130d012db28da07ba446d2ade27a0613fd6c5190e3df25ec7dbb3cf5d79a46d
Opcode Fuzzy Hash: ee7084d8961b324fc89119bfb71eb0e667796e10470dd78e849930222560bc74
Instruction Fuzzy Hash: F1C080B130002557D604319D70701DE75CDE7C5591B410056E10DC7740DDD55C0003D6

Function 064D0F40 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c3c6f3e65a7aa89e028821f37458a22875d24a41b23d1ce394abc0c963c753
Instruction ID: f1a8f9c4d2bcfdfc561cff15ce83f1e9e20c66dfc182e0e3eee015f094571bae
Opcode Fuzzy Hash: f1c3c6f3e65a7aa89e028821f37458a22875d24a41b23d1ce394abc0c963c753
Instruction Fuzzy Hash: 2BD0C936210118AF8B44DE89D840C95BBA9FF4D6607158096FA188B332C672EC11DB90

Function 064D1980 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32f62ebee1798f7185daf17b1cb636ec51ac3a8b80a4cd8cd69b96d1d1d4074
Instruction ID: f0d487a2a4a3b0e551277509f9db614288acaef8ce197502d29fd6f7008bee27
Opcode Fuzzy Hash: a32f62ebee1798f7185daf17b1cb636ec51ac3a8b80a4cd8cd69b96d1d1d4074
Instruction Fuzzy Hash: 8BD0C92112A6C11FC7125765AD168837F64DA43A207440A9AF094894A78629199A86A3

Function 05415C70 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0246c87e2128b3da9f02b35ab31d1b2a0a2a5ddfbe07f9ba1cc021024547ba
Instruction ID: f6754ac9334619be6d1259f5037aaf36a669b349b9d915bc22bef51ffa986b9a
Opcode Fuzzy Hash: cd0246c87e2128b3da9f02b35ab31d1b2a0a2a5ddfbe07f9ba1cc021024547ba
Instruction Fuzzy Hash: 90C0020100D7D02ECF0307B55C26AE27FA44D6720030EE0E791C98A4A3C0108416E292

Function 02C71F55 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1fb74d1a91b75f65c9267e0308e62f0cadffcaf44c7d015a62ddae075f59018
Instruction ID: dd60b5184d9b7b149283f6c451218fc8c891fdae239f74229393103e424fa553
Opcode Fuzzy Hash: d1fb74d1a91b75f65c9267e0308e62f0cadffcaf44c7d015a62ddae075f59018
Instruction Fuzzy Hash: 7BD0A734A00209DADB40DBD5D4023DC77B2FB84200F501166C10763040CF7016A4C673

Function 02C71F68 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84df70eb6534c8ccd0e9d57b4696e5142fafa47cfbf969f45bf2d3ecd5d404cd
Instruction ID: eef71c0e945f2945ed5db1d95a52fdae671b24ad07dd8571074edd52f01f1c0a
Opcode Fuzzy Hash: 84df70eb6534c8ccd0e9d57b4696e5142fafa47cfbf969f45bf2d3ecd5d404cd
Instruction Fuzzy Hash: 36D0A920A00209DADB80ABE9A8013DC7BA2EBC4200F54127AC10A960458FB042E4CAB3

Function 0622A698 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3b169795840201e06a552433299b35da267350d843fafecbee9288a2454ad6
Instruction ID: c8663f0f09c98b91016576ec47881bd94454e6c2090de45a63255d36580d6a77
Opcode Fuzzy Hash: 6b3b169795840201e06a552433299b35da267350d843fafecbee9288a2454ad6
Instruction Fuzzy Hash: A9C08C323201365F8B449B6EE844C61B3ECAF8997030580A6E90DCB332EA51EC0087D0

Function 062217C0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2f800ea7d824a7995ce532408635c53959e3ee77b940cd501f83d038ea784f
Instruction ID: 45558ac5a391e9f56ed8f6fc4669d50602687506c4f64e9fe1a6034629e39e5e
Opcode Fuzzy Hash: 7b2f800ea7d824a7995ce532408635c53959e3ee77b940cd501f83d038ea784f
Instruction Fuzzy Hash: 63D0C972589383AFD3231B606816A96BFF59F62712B15889EA1C1C5053C66944C4D732

Function 05AAA268 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1ae00db4f79e0157c040009feb3229da2b867df279d82e546f1b3be42699c2
Instruction ID: e0c24a325a12769bfdfffad54f02d53cfe8208dafc8fb0f484f429f8c6cbe3a7
Opcode Fuzzy Hash: ed1ae00db4f79e0157c040009feb3229da2b867df279d82e546f1b3be42699c2
Instruction Fuzzy Hash: DAD0CA352442048FCB08EB68C48891877E8BF4820430214E4F50ACB362EA21E8008B40

Function 05AAFF51 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dda1e4670fa9ae91ac3446b541c3070a0263ee8035be95c9201545d48a5c4d7
Instruction ID: 10205f3a4e08949fdf76d3c56061788d16153900e2d3c20eb41bb0d938bf8cf2
Opcode Fuzzy Hash: 9dda1e4670fa9ae91ac3446b541c3070a0263ee8035be95c9201545d48a5c4d7
Instruction Fuzzy Hash: A6C092EA40E3902FE38741242C206D72F6519D70183AF13E3D5A6CEF73C40A879682B2

Function 05410310 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd144f3ab13bbc09f5d247928f34a9c9691d2c2bdc23eef1f3fd864d396811d
Instruction ID: 540e42e4deb8f7edf3c79a66f4cc39d2d71052d1493967ab05f8793b216137f2
Opcode Fuzzy Hash: 3bd144f3ab13bbc09f5d247928f34a9c9691d2c2bdc23eef1f3fd864d396811d
Instruction Fuzzy Hash: 79C0807541015687D7105350DCD736D3FB0D7D1204F180091D685CE2D1DF5CC503D553

Function 02C71F78 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9767c0ae67f1392c7297207481b0a0e8a29292282d1e7f16b05adaffaa9be054
Instruction ID: c60adf0cfd28c157ec0cba10f22903857adc1c0fb9a6054ce1b005b720c07da5
Opcode Fuzzy Hash: 9767c0ae67f1392c7297207481b0a0e8a29292282d1e7f16b05adaffaa9be054
Instruction Fuzzy Hash: 18C01225740619DADBC0BBFCA90438C7A52DFD5700F500179D1058A15A8EE486F48AB3

Function 06228627 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c79ae6302bb12673e91217a7e13be3efe40a58a07da3abcd14328a4f47a5fd23
Instruction ID: 0982efb4e57496d149b9d3f53f33bdaef5815cfc1203175b8916d96a8f2abed5
Opcode Fuzzy Hash: c79ae6302bb12673e91217a7e13be3efe40a58a07da3abcd14328a4f47a5fd23
Instruction Fuzzy Hash: 4DC012734453494FCB016BB0F4492543765EA61202F500566D4484A556E9A9CC588B99

Function 06AFB911 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c63411780a3d4f70cd4ee913741440e17908a2754d94cf7bda7d637757e33e5
Instruction ID: 019934534c622c078b8562ee9e7b8e300332c051a02915a712a6bdfa800834f6
Opcode Fuzzy Hash: 0c63411780a3d4f70cd4ee913741440e17908a2754d94cf7bda7d637757e33e5
Instruction Fuzzy Hash: 04D022712423868FC301DB24E50CC46BF749F0223130040CAE0004F033C230A818DB21

Function 02C78DF8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c9d630640c5a574bd8363ab91bb7b078e325c0bd34a83b3d004b8bc2440409
Instruction ID: c0cbb80172c8a820dc4d6dda002b00aa7646d3e9cd86f569b57f23e640c33dc3
Opcode Fuzzy Hash: 22c9d630640c5a574bd8363ab91bb7b078e325c0bd34a83b3d004b8bc2440409
Instruction Fuzzy Hash: 1DC04C4512448502D643237888BA78A5E2DDFD218CFFA45D5568486382EA9D84207712

Function 0622F778 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492cccb23d7a460b0c5b9cab68c2f02c7e5df2d21aaa4f3bb9b299a9f92f7fa2
Instruction ID: 31a52fc4e5d00d16950103835831d5875c5093aa70c5a7878a753b1db5b3dfb9
Opcode Fuzzy Hash: 492cccb23d7a460b0c5b9cab68c2f02c7e5df2d21aaa4f3bb9b299a9f92f7fa2
Instruction Fuzzy Hash: 17C012304A1916AFD2689A08E608A3137A8AF0860AB6400F4E9084FA32C261E822CA91

Function 0622F741 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 021b37d9bec3f2123668be7cc73eea72cf885f93e3d69aab25cb09856f41d32a
Instruction ID: ad215c61cdf176a293880bd0329f306bf72f21833051d04bcce3adcfb8dd040a
Opcode Fuzzy Hash: 021b37d9bec3f2123668be7cc73eea72cf885f93e3d69aab25cb09856f41d32a
Instruction Fuzzy Hash: 0AD012301207448FD3119B65C404F62B7ECBF49B08F8904E4E9494B727C262F8108700

Function 06223F93 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5ea85edda0684ebe837feec8b31afb7181e46fdce7e383f451af22d7de0af82
Instruction ID: 79c856497a9e7f26f1c8614b41ee541c7b6f4e360f38414660263e772a901dd7
Opcode Fuzzy Hash: b5ea85edda0684ebe837feec8b31afb7181e46fdce7e383f451af22d7de0af82
Instruction Fuzzy Hash: 09C04856A1E3E15FDB0692300C788B66F3A8997202309C5CAE18A8A1A3C41A490AA372

Function 0543AA36 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180508353.0000000005430000.00000040.00000800.00020000.00000000.sdmp, Offset: 05430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5430000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d42a145a8d20499036538b231af8373888e0e43884f39e84dfce078d315649b
Instruction ID: 5586f6b5fc39e5670a70d81b258c1ff540da8e0a186280997fba6ba94a8ba945
Opcode Fuzzy Hash: 1d42a145a8d20499036538b231af8373888e0e43884f39e84dfce078d315649b
Instruction Fuzzy Hash: CCC08C3AE0002C8BCF008BE8F4000DCBB71EB8C232F008062E524B3300CA301518CF20

Function 0541C220 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4180431373.0000000005410000.00000040.00000800.00020000.00000000.sdmp, Offset: 05410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5410000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cf37e68888e8712a3aef49fd74e3ed5e35cc53acd08886266146acb5840267
Instruction ID: b18372d35c87b588d24073ab61544acc06a375dcf2dc85568a26d5cedd81cd6a
Opcode Fuzzy Hash: c5cf37e68888e8712a3aef49fd74e3ed5e35cc53acd08886266146acb5840267
Instruction Fuzzy Hash: 83C02B91851B4219FF700690CD0E3083E808B00733F0D0F6850B6448C3E85C00C0C101

Function 02C77220 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4177344990.0000000002C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2c70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c16ded1749f2d3aaaec0b3babfa0db169facb723f94f9a9a17466f8700f4fca
Instruction ID: 4f593e972583c6ecc699d59ca8af043a68dbf5508caaad45e2b7f2ec4b4a587f
Opcode Fuzzy Hash: 6c16ded1749f2d3aaaec0b3babfa0db169facb723f94f9a9a17466f8700f4fca
Instruction Fuzzy Hash: 17B09B225255504BCF05452558551553F315F5521178946B99055D5783C85949038650

Function 062216E1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22a587b3ace1892afe7f50f15ccd0621821c83c09fa3281e056b8ba89705a2b9
Instruction ID: 3cf877fd6a85d66c93f76701d16f0253aa8760c6e1fbc4b131dc85d27bbf869b
Opcode Fuzzy Hash: 22a587b3ace1892afe7f50f15ccd0621821c83c09fa3281e056b8ba89705a2b9
Instruction Fuzzy Hash: EBC02B2284D2822BEF424770DC0BF123B3283D2F40F08C0417100CE0C1DEA4843C8231

Function 064D2030 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea37b6cea62d40df410734184e5c43626299f01a35dbb0a8c3f936d9d13bb41f
Instruction ID: 4f1a3ac6db0f59e3f0d4f9a92a27a48c10cc8b74c58d88c87f1da974c996a5cc
Opcode Fuzzy Hash: ea37b6cea62d40df410734184e5c43626299f01a35dbb0a8c3f936d9d13bb41f
Instruction Fuzzy Hash: B0C09238260208CFC300DB59D588C10BBECFF49A0835580D8E50D8B732CB22FC01CA80

Function 06AFBB40 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462f806103f530d795e63e7cd30240698a3559f3884ee21002b46cc62c982ebf
Instruction ID: f707bdea17ef6f05949ddd7fcf6764e1162c816aa8560e0937fbef9c417e9d45
Opcode Fuzzy Hash: 462f806103f530d795e63e7cd30240698a3559f3884ee21002b46cc62c982ebf
Instruction Fuzzy Hash: FDB09237A1800889EB50AAC4F8813EDFB30F790225F104027D31162041C232016887E2

Function 0622F750 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a9bb855b66031527ad60d43b9bbe596700b8874c009695b8fe6633e9f835db
Instruction ID: 74d73ab9e6f381ab5f9d9b95b6852324e2f71f11f687843942c945560dc2aa6d
Opcode Fuzzy Hash: 94a9bb855b66031527ad60d43b9bbe596700b8874c009695b8fe6633e9f835db
Instruction Fuzzy Hash: 85B092302602088FC300DA59D444E4173ACFF48B08F5100E0E5088BB32C662FC008A40

Function 064D1990 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181783546.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_64d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88e62c60de91f7fe2d75e590ade2f20d81cd24493d72cc0d3755fa788498901
Instruction ID: e7815a808a9a2e21d05ac57810d53f0d49d271ccb2be349231980b45c05d5817
Opcode Fuzzy Hash: a88e62c60de91f7fe2d75e590ade2f20d81cd24493d72cc0d3755fa788498901
Instruction Fuzzy Hash: 50B0123205020D4FC5807754F606A46776DDA402047C00620B00C4592A9E7C6C998A84

Function 05AAD2C0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181424712.0000000005AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43b4e53f086b40d55f3fcda7f008fe127b6a91ae801af1caa07db2d267bbb7c
Instruction ID: d150c4afab4fbf9329870b4c1fc5b0db552579cd3534bf84325b03e2b716b7f2
Opcode Fuzzy Hash: c43b4e53f086b40d55f3fcda7f008fe127b6a91ae801af1caa07db2d267bbb7c
Instruction Fuzzy Hash: 52B0123004030E4FC7017755F808AD4772DF580704F405221E10C452299B646C8D4B84

Function 06AFB920 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4182231580.0000000006AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6af0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c5e80e5d161c6cd17717d7e90366d7df6c86bdedef1d8d57fbaaa881c347e6
Instruction ID: 1485e72821faeb6dd9078d765896f2924cff3babc4a0a417e0ffd36dedc08b16
Opcode Fuzzy Hash: 99c5e80e5d161c6cd17717d7e90366d7df6c86bdedef1d8d57fbaaa881c347e6
Instruction Fuzzy Hash: 69B092721502088F8300DB68E548C0277A8AB18A1031140A1E2048B232C621F8108A65

Function 06228638 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4181608368.0000000006220000.00000040.00000800.00020000.00000000.sdmp, Offset: 06220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6220000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf80863008eab4c02e484c291d7541a05b9a49d8a5a52ce122679b6851ab82f4
Instruction ID: 35bd4ea946b52fae0155f9fc3d2b27bcea7ecfddc8733ef5bc579dbc79edd2cd
Opcode Fuzzy Hash: bf80863008eab4c02e484c291d7541a05b9a49d8a5a52ce122679b6851ab82f4
Instruction Fuzzy Hash: DCB0123104030D4FCA007764F848608771DE540206B404120E10C462295EA4FC444FE4

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7zS498BA48F\ICSharpCode.SharpZipLib.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\Newtonsoft.Json.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe

C:\Users\user\AppData\Local\Temp\7zS498BA48F\WebCompanion-Installer.exe.config

C:\Users\user\AppData\Local\Temp\7zS498BA48F\de-DE\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\en-US\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\es-ES\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\fr-CA\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\it-IT\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\ja-JP\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\pt-BR\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\ru-RU\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\tr-TR\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS498BA48F\zh-CHS\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\WcInstaller.log

C:\Users\user\AppData\Local\Temp\WebCompanion.zip

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txt

Static File Info

General

File Icon

Windows Analysis Report
Setup.exe

Function 004148D4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81
COMMON

Function 00405434 Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Function 00401014 Relevance: 48.0, APIs: 8, Strings: 19, Instructions: 715
windowsynchronizationCOMMON

Function 0040AB05 Relevance: 14.2, APIs: 9, Instructions: 682
COMMON

Function 004051B7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102
threadCOMMON

Function 00404908 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36
filetimeCOMMON

Function 004083AB Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Function 00405620 Relevance: 4.6, APIs: 3, Instructions: 130
COMMON

Function 0040280E Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 384
COMMON

Function 004030FC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Function 00404A3E Relevance: 3.2, APIs: 2, Instructions: 166
COMMON

Function 00408755 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Function 0041468E Relevance: 3.0, APIs: 2, Instructions: 45
threadCOMMON

Function 00405892 Relevance: 3.0, APIs: 2, Instructions: 45
fileCOMMON

Function 00404965 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON