Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe (renamed file extension from ex to exe)
Original sample name:	Setup.ex
Analysis ID:	1539162
MD5:	fef9a20fcd13f76e4656a66a95ae336c
SHA1:	f21aca3de231ef5476913b40f3d52d31c5cb9eb8
SHA256:	28fcbf8a60bc702b59e1fb25ece117741822136b6aa755440eec15b229d3f84c
Infos:

Detection

Score:	45
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Setup.exe (PID: 6948 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: FEF9A20FCD13F76E4656A66A95AE336C)

WebCompanion-Installer.exe (PID: 6972 cmdline: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20622070018 --version=13.900.0.1080 MD5: A27F9713DB1688D03D2082BFA1827803)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.0.WebCompanion-Installer.exe.da0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.Setup.exe.20e38b8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.Setup.exe.20e4eb8.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.Setup.exe.20e64b8.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T09:45:38.857508+0200	2803305	3	Unknown Traffic	192.168.2.4	49732	104.16.149.130	80	TCP
2024-10-22T09:45:51.873975+0200	2803305	3	Unknown Traffic	192.168.2.4	49768	104.16.149.130	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

ReversingLabs: Detection: 20%

Multi AV Scanner detection for submitted file

Source: Setup.exe

ReversingLabs: Detection: 50%

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Jump to behavior

Source: Setup.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49767 version: TLS 1.2

Source:	Binary string: Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: &Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, WebCompanion-Installer.exe, 00000001.00000002.4135631589.0000000006CA2000.00000002.00000001.01000000.00000007.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: eApplication/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000352E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003536000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000352A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003532000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: Application/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000352E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003536000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000352A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003532000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanion-Installer.pdb source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405434 FindFirstFileA,FindFirstFileW,

0_2_00405434

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.0.WebCompanion-Installer.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.20e38b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.20e4eb8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.20e64b8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe, type: DROPPED

Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 447Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 398
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 508
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 646
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 515
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 482
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 515
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 488
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 527
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 466
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 527
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 458
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 460
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 475
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 491
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 517Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 485
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 728Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 674
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com

Source: Joe Sandbox View	IP Address: 104.18.27.149 104.18.27.149
Source: Joe Sandbox View	IP Address: 104.16.149.130 104.16.149.130
Source: Joe Sandbox View	IP Address: 104.16.148.130 104.16.148.130

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49732 -> 104.16.149.130:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49768 -> 104.16.149.130:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com

Source: global traffic	DNS traffic detected: DNS query: geo.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: featureflags.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: flwadw.com
Source: global traffic	DNS traffic detected: DNS query: wcdownloadercdn.lavasoft.com

Source: unknown

HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive

Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://aia.entrust.net/evcs2-chain.p7c01
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl.entrust.net/evcs2.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl.entrust.net/g2ca.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/UI/ResourceDictionary/icon-failed.pngd
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/WebCompanion-Installer;component/ui/installerfooter.xamld
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/WebCompanion-Installer;component/ui/installerheaderextension.xamld
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/UI/ResourceDictionary/icon-failed.png
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/ui/installerfooter.baml
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/ui/installerfooter.bamld
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/ui/resourcedictionary/icon-failed.png
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/ui/resourcedictionary/icon-failed.pngd
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/ui/installerfooter.xaml
Source: WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://geo.lavasoft.com/
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://localhost:9008Fhttp://localhost:9008/webcompanion/4http://rt.webcompanion.com
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net00
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net01
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003316000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://staging-cloudflow.lavasoft.net/v1/event-stat-wc
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/$
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/:WebHttpBinding4
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetComponentsInfoByProductT
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetComponentsInfoT
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetComponentsVersionInfoT
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetProductInfoT
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreen
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValues
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValuesResponse
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/SignZipInstallerByProductT
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/SignZipInstallerT
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/T
Source: Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wc-update-service.lavasoft.com/components.asmx
Source: Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wc-update-service.lavasoft.com/update.asmx
Source: Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip
Source: Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.entrust.net/rpa0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.lavasoft.com
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.webcompanion.com
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032FA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000329B000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/blacklist
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032FA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000329B000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/permanentwhitelist
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acs.lavasoft.comZhttps://acs.lavasoft.com/api/v2/url/blacklistlhttps://acs.lavasoft.com/api/
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acscdn.lavasoft.com/urlnotificationlist.json
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acscdn.lavasoft.comhhttps://acscdn.lavasoft.com/urlnotificationlist.json0https://webcompanio
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WC
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WCD
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032CD000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC$https://flwadw.comFhttps://flwadw.com/v1/event-stat
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flow.lavasoft.com/v1/event-stat/v1/event-stat
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003316000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003316000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flwadw.com/v1/event-stat
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003316000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flwadw.com/v1/event-stat-wc
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003486000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003486000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003486000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1hrR
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003316000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=Start&ProductID=wc&EventVersion=1
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flwadw.com/v1/event-statJhttp://staging-cloudflow.lavasoft.netlhttp://staging-cloudflow.lava
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://partner-tracking.lavasoft.com/api/Tracking/Decrypt
Source: Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032FA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000329B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WcInstaller.log.1.dr	String found in binary or memory: https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://sandbox-featureflags-api.lavasoft.net/api/Update/WC
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox-featureflags-api.lavasoft.net/api/feature/WC
Source: Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip
Source: Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip
Source: Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe
Source: Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-internal.zip
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wcdownloadercdn.lavasoft.com
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003542000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe
Source: Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exehrR
Source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003542000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/en/help.php
Source: WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/en/install.php?partner=
Source: WcInstaller.log.1.dr	String found in binary or memory: https://webcompanion.com/images/favicon.ico
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://www.adaware.com/privacy-policy
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://www.adaware.com/terms-of-use

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52553
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.4:49767 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00416076	0_2_00416076
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040E38E	0_2_0040E38E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00412480	0_2_00412480
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004039C8	0_2_004039C8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00418CC1	0_2_00418CC1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00418D9B	0_2_00418D9B
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_017B0DE0	1_2_017B0DE0
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_017BF0D0	1_2_017BF0D0
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_017BE390	1_2_017BE390
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_06AA05A8	1_2_06AA05A8
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_070DA738	1_2_070DA738
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_070D9E68	1_2_070D9E68
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_070DB1C0	1_2_070DB1C0
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_070D9B20	1_2_070D9B20

Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00413724 appears 176 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00403A63 appears 33 times

Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll4 vs Setup.exe
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: get_OriginalFilename vs Setup.exe
Source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000003.1675358016.0000000001FA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe
Source: Setup.exe, 00000000.00000000.1674652303.0000000000427000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe
Source: Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: get_OriginalFilename vs Setup.exe
Source: Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.1677688017.00000000020A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.1677688017.00000000020A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dll8 vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: ICSharpCode.SharpZipLib.dll.0.dr, InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.0.dr, DeflaterOutputStream.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.0.dr, ZipAESTransform.cs	Cryptographic APIs: 'TransformBlock'

Source: WebCompanion-Installer.exe, 00000001.00000002.4134119061.0000000005A26000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Dbu;.VBPl

Source: classification engine

Classification label: mal45.troj.winEXE@3/17@5/3

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Roaming\Lavasoft

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe

ReversingLabs: Detection: 50%

Source: WebCompanion-Installer.exe	String found in binary or memory: WebCompanion-Installer.resources
Source: WebCompanion-Installer.exe	String found in binary or memory: WebCompanion-Installer.resources.dll
Source: Setup.exe	String found in binary or memory: RunProgram="WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20622070018 --version=13.900.0.1080"

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20622070018 --version=13.900.0.1080
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20622070018 --version=13.900.0.1080	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Setup.exe

Static PE information: certificate valid

Source:	Binary string: Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: &Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, WebCompanion-Installer.exe, 00000001.00000002.4135631589.0000000006CA2000.00000002.00000001.01000000.00000007.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: eApplication/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000352E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003536000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000352A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003532000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: Application/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000352E000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003536000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000352A000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003532000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanion-Installer.pdb source: Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004180F0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004180F0

Source: Setup.exe	Static PE information: real checksum: 0x8a584 should be: 0x93fca
Source: WebCompanion-Installer.resources.dll8.0.dr	Static PE information: real checksum: 0x0 should be: 0xa6a7
Source: WebCompanion-Installer.resources.dll5.0.dr	Static PE information: real checksum: 0x0 should be: 0xc6c2
Source: WebCompanion-Installer.resources.dll1.0.dr	Static PE information: real checksum: 0x0 should be: 0x3e3f
Source: WebCompanion-Installer.resources.dll7.0.dr	Static PE information: real checksum: 0x0 should be: 0xcb69
Source: WebCompanion-Installer.resources.dll2.0.dr	Static PE information: real checksum: 0x0 should be: 0x4885
Source: WebCompanion-Installer.resources.dll4.0.dr	Static PE information: real checksum: 0x0 should be: 0x5659
Source: WebCompanion-Installer.resources.dll6.0.dr	Static PE information: real checksum: 0x0 should be: 0xd8a3
Source: WebCompanion-Installer.resources.dll0.0.dr	Static PE information: real checksum: 0x0 should be: 0xe72f
Source: WebCompanion-Installer.resources.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x2ab0
Source: WebCompanion-Installer.resources.dll3.0.dr	Static PE information: real checksum: 0x0 should be: 0x842b

Source: Setup.exe

Static PE information: section name: .sxdata

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00411130 push ecx; mov dword ptr [esp], ecx	0_2_00411131
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00413724 push eax; ret	0_2_00413742
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00413A90 push eax; ret	0_2_00413ABE
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_0D262050 push ss; retf	1_2_0D262073
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_017BC3C8 push eax; retf	1_2_017BC42D
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_070DF67A push esp; retf	1_2_070DF689
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_070DFB5D pushfd ; iretd	1_2_070DFB61
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_070DF1A2 pushad ; iretd	1_2_070DF1B1
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Code function: 1_2_070DF1B2 pushfd ; iretd	1_2_070DF1E1

Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zS42B6E125\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Memory allocated: 1770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Memory allocated: 3230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Memory allocated: 17D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597902	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597793	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597684	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597517	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597171	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 594977	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 594862	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Window / User API: threadDelayed 1829			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Window / User API: threadDelayed 8009			Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS42B6E125\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -599326s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -597902s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -597793s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -597684s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -597517s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -597390s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -597281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -597171s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -597062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -596953s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -595531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -595421s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -595093s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -594977s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -594862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe TID: 4412	Thread sleep time: -594625s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405434 FindFirstFileA,FindFirstFileW,

0_2_00405434

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597902	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597793	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597684	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597517	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597171	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 597062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 594977	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 594862	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: WebCompanion-Installer.exe.0.dr	Binary or memory string: vmware
Source: WebCompanion-Installer.exe, 00000001.00000002.4124919961.0000000001604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)

Source: C:\Users\user\Desktop\Setup.exe

API call chain: ExitProcess graph end node

graph_0-16392

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004180F0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004180F0

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0041561A SetUnhandledExceptionFilter,		0_2_0041561A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0041562C SetUnhandledExceptionFilter,		0_2_0041562C

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS42B6E125\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS42B6E125\en-US\WebCompanion-Installer.resources.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXmlLinq.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS42B6E125\ICSharpCode.SharpZipLib.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004148D4 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

0_2_004148D4

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	50%	ReversingLabs	Win32.Trojan.XWorm

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\7zS42B6E125\ICSharpCode.SharpZipLib.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\Newtonsoft.Json.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe	21%	ReversingLabs	Win32.PUA.Generic
C:\Users\user\AppData\Local\Temp\7zS42B6E125\de-DE\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\en-US\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\es-ES\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\fr-CA\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\it-IT\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\ja-JP\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\pt-BR\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\ru-RU\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\tr-TR\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zS42B6E125\zh-CHS\WebCompanion-Installer.resources.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
geo.lavasoft.com	104.16.149.130	true	false	unknown
wcdownloadercdn.lavasoft.com	104.16.149.130	true	false	unknown
featureflags.lavasoft.com	104.16.148.130	true	false	unknown
flwadw.com	104.18.27.149	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1	false	unknown
https://featureflags.lavasoft.com/api/feature/WC	false	unknown
https://featureflags.lavasoft.com/api/Update/WC	false	unknown
https://flwadw.com/v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1	false	unknown
https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip	false	unknown
https://flwadw.com/v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1	false	unknown
https://flwadw.com/v1/event-stat?Type=Start&ProductID=wc&EventVersion=1	false	unknown
http://geo.lavasoft.com/	false	unknown
https://flwadw.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1	false	unknown
https://flwadw.com/v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.entrust.net/g2ca.crl0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/GetComponentsVersionInfoT	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe	Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
https://flwadw.com/v1/event-stat-wc	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003316000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValuesResponse	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net02	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	URL Reputation: safe	unknown
http://ocsp.entrust.net01	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://ocsp.entrust.net00	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
https://flwadw.com/v1/event-stat	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003316000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloadercdn.lavasoft.com	WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://acs.lavasoft.com/api/v2/url/permanentwhitelist	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032FA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000329B000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.adaware.com/privacy-policy	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip	Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://tempuri.org/:WebHttpBinding4	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://webcompanion.com/images/favicon.ico	WcInstaller.log.1.dr	false		unknown
http://www.webcompanion.com	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip	Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032FA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000329B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WcInstaller.log.1.dr	false		unknown
http://defaultcontainer/WebCompanion-Installer;component/ui/installerheaderextension.xamld	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/csbr1.crl0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://sandbox-featureflags-api.lavasoft.net/api/feature/WC	WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032CD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://defaultcontainer/UI/ResourceDictionary/icon-failed.pngd	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValues	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://featureflags.lavasoft.com/api/feature/WC$https://flwadw.comFhttps://flwadw.com/v1/event-stat	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip	Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://aia.entrust.net/evcs2-chain.p7c01	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://acscdn.lavasoft.com/urlnotificationlist.json	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.entrust.net/rpa0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-internal.zip	Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://foo/UI/ResourceDictionary/icon-failed.png	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/GetProductInfoT	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://foo/bar/ui/installerfooter.baml	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/$	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://webcompanion.com/en/install.php?partner=	WebCompanion-Installer.exe.0.dr	false		unknown
https://webcompanion.com/en/help.php	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip	Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
https://www.adaware.com/terms-of-use	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/soap/encoding/	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreen	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://flwadw.com/v1/event-statJhttp://staging-cloudflow.lavasoft.netlhttp://staging-cloudflow.lava	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://foo/ui/installerfooter.xaml	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.entrust.net/rpa03	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	URL Reputation: safe	unknown
https://featureflags.lavasoft.com	WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032CD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://flow.lavasoft.com/v1/event-stat/v1/event-stat	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://foo/bar/ui/installerfooter.bamld	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe	Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
https://partner-tracking.lavasoft.com/api/Tracking/Decrypt	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://flwadw.com	WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003316000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://acs.lavasoft.comZhttps://acs.lavasoft.com/api/v2/url/blacklistlhttps://acs.lavasoft.com/api/	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://defaultcontainer/WebCompanion-Installer;component/ui/installerfooter.xamld	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1hrR	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003486000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe	WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003542000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr	false		unknown
http://localhost:9008Fhttp://localhost:9008/webcompanion/4http://rt.webcompanion.com	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://staging-cloudflow.lavasoft.net/v1/event-stat-wc	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003316000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://featureflags.lavasoft.com/api/Update/WCD	WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://james.newtonking.com/projects/json	Newtonsoft.Json.dll.0.dr	false	URL Reputation: safe	unknown
http://foo/bar/ui/resourcedictionary/icon-failed.pngd	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/GetComponentsInfoByProductT	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://www.lavasoft.com	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://acs.lavasoft.com/api/v2/url/blacklist	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032A4000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.00000000032FA000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000329B000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	false		unknown
https://acscdn.lavasoft.comhhttps://acscdn.lavasoft.com/urlnotificationlist.json0https://webcompanio	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/T	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://sandbox-featureflags-api.lavasoft.net/api/Update/WC	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/SignZipInstallerByProductT	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://foo/bar/ui/resourcedictionary/icon-failed.png	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003588000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip	Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://crl.entrust.net/evcs2.crl0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://wc-update-service.lavasoft.com/update.asmx	Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://wc-update-service.lavasoft.com/components.asmx	Setup.exe, 00000000.00000003.1675677496.00000000020A3000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://tempuri.org/SignZipInstallerT	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exehrR	WebCompanion-Installer.exe, 00000001.00000002.4125747232.000000000354F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/actor/next	WebCompanion-Installer.exe, 00000001.00000002.4125747232.0000000003231000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/GetComponentsInfoT	Setup.exe, 00000000.00000003.1677688017.00000000020E0000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1677860282.0000000000480000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.1678077338.0000000000DA2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.27.149	flwadw.com	United States	13335	CLOUDFLARENETUS	false
104.16.149.130	geo.lavasoft.com	United States	13335	CLOUDFLARENETUS	false
104.16.148.130	featureflags.lavasoft.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539162
Start date and time:	2024-10-22 09:44:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe (renamed file extension from ex to exe)
Original Sample Name:	Setup.ex
Detection:	MAL
Classification:	mal45.troj.winEXE@3/17@5/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 239 Number of non-executed functions: 29
Cookbook Comments:	Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, ocsp.entrust.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target WebCompanion-Installer.exe, PID 6972 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Setup.exe

Simulations

Behavior and APIs

Time	Type	Description
03:45:37	API Interceptor	12021632x Sleep call for process: WebCompanion-Installer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.18.27.149	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
	APInstaller (4).exe	Get hash	malicious	Unknown	Browse
	APInstaller.exe	Get hash	malicious	Unknown	Browse
104.16.149.130	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	flow.lavasoft.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	flow.lavasoft.com/v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1
	SecuriteInfo.com.Program.Unwanted.2818.3154.4230.exe	Get hash	malicious	Petite Virus	Browse	flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
104.16.148.130	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	flow.lavasoft.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	wcdownloadercdn.lavasoft.com/9.1.0.993/WebCompanion-9.1.0.993-prod.zip
	SecuriteInfo.com.Program.Unwanted.2818.3154.4230.exe	Get hash	malicious	Petite Virus	Browse	flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exe	Get hash	malicious	Unknown	Browse	downloadnada.lavasoft.com/update/12.10.158.0/win32/AdAwareWebInstaller.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geo.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
wcdownloadercdn.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
featureflags.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	LTEXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletbrunkagerne.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.21.56.189
	TT Swift copy1.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://freeaccessonline.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	188.114.96.3
	Quotation_final_buy_order_list_2024_po_nos_ART125673211020240000000000024.bat	Get hash	malicious	GuLoader	Browse	188.114.96.3
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	MDE_File_Sample_1a8e4ebbcc2e3f76efb2a55bb6179417263ebf3d.zip	Get hash	malicious	Unknown	Browse	172.64.41.3
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
CLOUDFLARENETUS	LTEXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletbrunkagerne.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.21.56.189
	TT Swift copy1.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://freeaccessonline.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	188.114.96.3
	Quotation_final_buy_order_list_2024_po_nos_ART125673211020240000000000024.bat	Get hash	malicious	GuLoader	Browse	188.114.96.3
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	MDE_File_Sample_1a8e4ebbcc2e3f76efb2a55bb6179417263ebf3d.zip	Get hash	malicious	Unknown	Browse	172.64.41.3
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
CLOUDFLARENETUS	LTEXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletbrunkagerne.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.21.56.189
	TT Swift copy1.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://freeaccessonline.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	188.114.96.3
	Quotation_final_buy_order_list_2024_po_nos_ART125673211020240000000000024.bat	Get hash	malicious	GuLoader	Browse	188.114.96.3
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	MDE_File_Sample_1a8e4ebbcc2e3f76efb2a55bb6179417263ebf3d.zip	Get hash	malicious	Unknown	Browse	172.64.41.3
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	MT103-539 PAYMENT (1).docx.doc	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	LTEXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletbrunkagerne.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	Quotation_final_buy_order_list_2024_po_nos_ART125673211020240000000000024.bat	Get hash	malicious	GuLoader	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	PO FOR CONNECTOR WITH TERMINAL.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	PO 0039499059996600 dtated 10222024.exe	Get hash	malicious	AgentTesla	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	Stima IMP87654 per l'esportazione dell'ultimo trimestre.vbs	Get hash	malicious	GuLoader	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	SecuriteInfo.com.Win32.CrypterX-gen.11226.22760.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	rEXSP5634HISP9005STMSDSDOKUME74247linierelet.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	z1DHL_Shipping_.cmd	Get hash	malicious	GuLoader	Browse	104.18.27.149 104.16.149.130 104.16.148.130

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\7zS42B6E125\ICSharpCode.SharpZipLib.dll	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\7zS42B6E125\Newtonsoft.Json.dll	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7zS42B6E125\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	213656
Entropy (8bit):	5.7590593524797615
Encrypted:	false
SSDEEP:	3072:LK1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4Q:Ge9OAQsFtJrGPBnmIRZUL
MD5:	0CFE19791546A96C6699657A94604596
SHA1:	5D1A1B74CCA9F74FFFEBCB583661C02E4CA626DD
SHA-256:	56FDFD148F0D60805B2873A5A49739909001D11789B75DAB2B0EA8E55BC60913
SHA-512:	586CC695A2C3C03008D0A1032C221CD3384B5F4363E83C9D903753FB1DAD65B340BC8CD0659F7F891A641F8BD7535C9B889219842045854AA98CD380F0FE4AA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......... ........... ........@.. .......................@......sC....@.................................d...W........................2... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS42B6E125\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	438424
Entropy (8bit):	6.09887709092106
Encrypted:	false
SSDEEP:	6144:fHerwzLkqCG3uKWf4g6tUwoOkErUx5/Rsnaszr0tZDPEaN+YB5+GonYy:fHerIacuKUtOkESbKQrvB5+qy
MD5:	461C476F474A5F13D2EA9344AE6F70F6
SHA1:	8F74702B99F08277D4514C63956E2E69E8090073
SHA-256:	4F0EC6439B24652F16DF066F4A38B64518B5A874080EDA63DE45968545830F67
SHA-512:	E69080C205CD82EA2C056FA1328BBEC4C03CA3FDC3EE381C4FB44CB356247BE5FE4B8ADD53036DCB19CAC2C6D59B8E02F81932320EA534B5BA50DB80A0647017
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.R...........!.....t............... ........... ..............................%.....@.....................................K.......8............~...2..........x................................................ ............... ..H............text....s... ...t.................. ..`.rsrc...8............v..............@..@.reloc...............\|..............@..B........................H.......h...................X...P ......................................yK.N...f....i5.#I..xV. ..%BR..^.....t0"..z.%./.G'.j....{...2...k)w...'>.c..P..X.......n...h....E...ex..X/H].R.e.{..;&.-.'....{...."..}....V.(x.....(......}....2.{....oy...2.{....oz...B..(....&..(.......0...........oo........YE....}...............}...n...............n.......I...I...I...I...3...I...X...8D....t......{.....or...o{....ow.....+U..o\|.....{.....o....oo...o}.....o....o....t.....o....o..

C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	438936
Entropy (8bit):	6.4311342686757245
Encrypted:	false
SSDEEP:	6144:p0CMChRMg/ZytotgM7/J/NMFkl619WTRIlY57pMF9v2aiSVRlY/8a:CGhGI1Wo/J1l619WQY57pMfi8a
MD5:	A27F9713DB1688D03D2082BFA1827803
SHA1:	B8DF4649659003609419D052757166499D2322E8
SHA-256:	2F86EB0D3902A11DA1F534D9734DABAE37D33E2C57B03F968198A1CFC2E652A9
SHA-512:	F952C6792F10CB60CA3ECC00B317C33AADB65C8471D106171660EC0FCB0603C8D18B8AD2A90AACDA6581D342647290099AF0ED0FDD897EDB390D5BF9209EA905
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf.....................t.......(... ...@....@.. ....................................@..................................(..K....@...q...............2..........X'............................................... ............... ..H............text........ ...................... ..`.rsrc....q...@...r..................@..@.reloc...............~..............@..B.................(......H..................{....i...9............................................~....}.....(......su...}......(....}.....r...pz.(....r'..p.{....(......(........0..j..........{....r...pov...,.(.....+.(......r...p(......(......r...p.{....o....o.......(........sG........o......z..........UU......N.(....r...p..(.....r...p.......{...."..}.....rA..p.rS..p.(....oV...f.~....}.....(......(.....ro..pN.(....r...p..(.....0..i.......~......(....(!...,.r...p.+..(.......(j.....(...+

C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe.config

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2273
Entropy (8bit):	5.064418012146103
Encrypted:	false
SSDEEP:	48:c5+qM3DzYnwAGvSy6ZYEcCUkmPlrAn6EVr6R841docr7S3tB:jV3f84CRvur+rAN3r7sz
MD5:	E3D3AA100B93504676414B9268DFBAD4
SHA1:	A7D1E59C9D8C48DFE259D2973C13B0E2965E67AA
SHA-256:	EA7747D876307B0022F055C311C4F8F8112FDDE380E0848FD35508C00EDF8E7A
SHA-512:	9470E0B4784CE3AA94248DDBD9C17BCA988B6A680754511CBE1F1C368270F6D18C75AD1EA0F3A438CA5BB1A12E55E8745F68F2EBC9F78C68B373A6541AC9EFBE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ProdSettings" type="System.Configuration.NameValueSectionHandler"/>.. <section name="StagingSettings" type="System.Configuration.NameValueSectionHandler"/>.. </configSections>.. <ProdSettings>.. <add key="Installer" value="https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe"/>.. <add key="WebProtectionZip" value="https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip"/>.. <add key="InstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip"/>.. <add key="WebInstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip"/>.. </ProdSettings>.. <StagingSettings>.. <add key="Installer" value="https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe"/>.. <add key="WebProtectionZip" va

C:\Users\user\AppData\Local\Temp\7zS42B6E125\de-DE\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.423116664692943
Encrypted:	false
SSDEEP:	96:5GfMjBmbsmYpthmv13DA+7ZaOrO2I72LYlty5dPolY:5GEjBmb/Ypthmd3k+7LBTUa5NolY
MD5:	A564D6AE745D289B599A010E570E609E
SHA1:	7A698D14CDAB971982B02AF5A9C49D8AEDA56A19
SHA-256:	E20A9695E1322491C57C8A0E61839E5AEEBA40F43AAB400C29F19531D18FA037
SHA-512:	2894F6832F6D20E97E18FF09780D34E7CC25074F0382742838C9A060AF7ADE3FFD3DA9F844E0475697E3854A97379F0961A7F65A1EB5F2ACBA2AF17E49D75B39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................1... ...@....... ....................................@..................................0..O....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......h-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS42B6E125\en-US\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.337584317889265
Encrypted:	false
SSDEEP:	96:tDXGBpbsiopCUoHve6v7ptEAT0VOGSxQ7F0ltEj8dPolY:trGBpbLopDoHm1MeGU8NolY
MD5:	88498F281D2BC857F09C3A0EFFE97A35
SHA1:	5560555DED4D2336EBAAC6AECBD80C2FC6F0AAE7
SHA-256:	2FBD9C10CEC246D5E6EE2F41635F283C3064773724253BAE598BFAEA735B702D
SHA-512:	2550C9C2E42E77A44520EC53418636721C3A56BE7B647C839B7A3063A9BDE4FFD304A6812F51A95DF19B1F04E05285FA9C23AF946472F07DE10F514DDB0DF9C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................N/... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0/......H........+..d...........P ..I...........................................E..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet.... .......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..............v.D\|-......."..&...'c$Q:#Uv=.9.W..Y`..[.F.^:1;jg.Jq........\.......i.......t...............z...O...L...<...5..........................E...........L...

C:\Users\user\AppData\Local\Temp\7zS42B6E125\es-ES\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.320496600456879
Encrypted:	false
SSDEEP:	96:wfMjBDbsPnpEaLv3lhC3E1Wb/xg/x9lt2EZdPolY:wEjBDbWnpEaLPlhC3fa9ZNolY
MD5:	A22C9231A5562DCA9F0BC186BDA3348D
SHA1:	D4D281A596E272A482C6917DC3CA67C150E72FCB
SHA-256:	AF899C47BDE2A325F3F9F22772F4E305F6B50EAF040670DE508226FEFBED649B
SHA-512:	C140934BF63AADB01F7C0A1A4A7E89FB7CC6DEAA5219BBCB64EB6FB9D29F8139DC4A17C990373BB008A891436BD60E8B21CF748DAB0FA263853663AD17BA9FB4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@.................................<0..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p0......H........,..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS42B6E125\fr-CA\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.4162624308031155
Encrypted:	false
SSDEEP:	96:vfMjBwbssSpcuov88johXbk3LFXRq7hltE5dPolY:vEjBwbJSpcuo0aX07hM5NolY
MD5:	07759138B75C31E8E62E2DCB9E5B4121
SHA1:	C78CAC2D69DD3770256EA1D22FE62F8991AE1735
SHA-256:	460E0EA0F891B4A7D8FCF4D7C1DAF4034B1A8C01F35C55B87C4DE4D34F7E1119
SHA-512:	7089069EFBE9109ED034C9538B16F482573757A6DAED2D870CF1711F15B1F39FFFC6E5F9FF5E3380514EAFCEE49797F63DD0C9E472D37647EE3FCF34E086B189
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@..................................0..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......8-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS42B6E125\it-IT\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.05939038461759
Encrypted:	false
SSDEEP:	48:64WHsDO4eUqFAjpI1UhCvEWRCYVl6TxNLu6hxPFraKuhuXahZ439M/oKx8Welt4u:UFfAjpI1fvC6StPPtM+7tlth8tdPolY
MD5:	320A49D5E8C225BF7D8C8FC8F0FBA1FE
SHA1:	6986D89BABDB474B16E3074865EEDFFCCECC9337
SHA-256:	53F48BF5DEB5FB756EB61D5EE78BB72EF4509ADB396EB40BEF9671ECAA8D9819
SHA-512:	6EC2883F6542F8EA3966F367E11359B3702B8E8E01FAFA3D3828E16D216CC77CC71B92BB1BFBC0C7F146C79FB4DBEE5FAD84288DFE1C5979F0C59841B92F03D6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................n,... ...@....... ....................................@..................................,..W....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P,......H........(..d...........P ..`...........................................\..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&#Uv=.9.W.F.^:1;j........a.......J...'...........(...............p.......E...........{...........b.......B...O............B.T.N._.C.L.O.S.E......

C:\Users\user\AppData\Local\Temp\7zS42B6E125\ja-JP\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.697358912630535
Encrypted:	false
SSDEEP:	96:KsC3ASpa3kvBYTnRDzIWI2dPRp0QltdHmdPolY:KsOASpa3kpXoR+Q1GNolY
MD5:	442654050F5E5EBFB286C75A6AD10485
SHA1:	7F9AB13C925DDDE3ADE1EBA334DD17F6BF341F7A
SHA-256:	B85CC7BA82B58AFD8FA00DFCCD820B5B34BC14A942EBDAB5380FCE8F7257C0AE
SHA-512:	E7F9F728603091728451127C02B1F8412C741C57C5ADFED91FECA37989C07570886ACA262ECBDB17A968474E05936C3485602115CBC26EDCEE65DD7764B76795
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................-... ...@....... ....................................@..................................-..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H....... *..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\7zS42B6E125\pt-BR\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.272201212454418
Encrypted:	false
SSDEEP:	96:afMjBsbswapvL6vu1667y4UNGaB3q4kUO6ltMNdPolY:aEjBsb9apvL6ms67yJ3hUNNolY
MD5:	01CCD85F0676258B5E4A223832E3258C
SHA1:	630CD9F369A81A7823905FD842FDDEEFAF23D3A1
SHA-256:	C482D074CFDA0B6921A6750F0CCC1279BA6FCFB9D2037CA6EAAF704D8DAF811F
SHA-512:	1BB2DB0ABF3E0BCA3B131D2DF5329006A56E3FAA4E540621E54AA98DBB0BF4E27093314B477AA66E4F10FE0AF5DF1887FF23CAD938C5B0F98E455433E14FAD01
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......\|,..d...........P ..,...........................................(..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS42B6E125\ru-RU\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.608207837862824
Encrypted:	false
SSDEEP:	96:41fMjBGbsSopXm7vGQdkxbdV2UCwbT+T/UA7+1styo36glt55odPolY:eEjBGbbopXm7eXxbWqExi1splHoNolY
MD5:	F2876EC061D1CC88E44104ED97FC36F8
SHA1:	68BFE2A32CA14B0C379EF725E426AB2FED09E075
SHA-256:	6071DAA27880FE3F6B9FB704890250CA655CAFE832A1B9A4E59F0CFFFB042E04
SHA-512:	E3DD2BAAB3C5AFB124DC9CC0BB2D9318D33707732B4F23C211C2E3BC5A8A8889FAF42003857DA98D43DD7F7368CAFB3A02591BE04DCA4E1343A00283CA071DB6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................3... ...@....... ....................................@..................................3..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H.......L0..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zS42B6E125\tr-TR\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.204809000235561
Encrypted:	false
SSDEEP:	48:6teH9O4G6ULy3ABApQe1eBpQvu18JvLh4jK0YuPx4S8zqeelt4833PPbknI5Klfy:TsC3AWpt1eYvJgjKZSJltkFdPolY
MD5:	D0009577C38F3338B2A3DCCEE9DF5169
SHA1:	D567D95A61B57885B55D7D70B93BC839EF162436
SHA-256:	598BAD964E2BED4A4EDAFAC5E8838C7B922C6EBBFBA70EDA0D400E543B91E54B
SHA-512:	95F766F541CA5EFC74C3DCC9D5C299798B581F1B302A4EFFDCA9B7ED4177DAF4E8547B7729DB724EB0A8A28C9770FC470BF9BDF2C616F70782DC96056CF8410E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................,... ...@....... ....................................@.................................<,..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p,......H........(..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\7zS42B6E125\zh-CHS\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.582926268925439
Encrypted:	false
SSDEEP:	96:vsC3AjpTfYGvqLH+/WZGrlqlt9kdPolY:vsOAjpTfxyb+/gGJq1kNolY
MD5:	322549094C487E49ACEB9899419D8EC6
SHA1:	DD0E5FF6BC3E4590203829DA1BB8BD7B00CBD07E
SHA-256:	7824381C18E86E72C0D4A8BB0ED377DFDB6E3B5374984ED67AF119B14268E70D
SHA-512:	80747F72196406993110D0DB5B736BCA21975C26615D34F771042E69CA0D519ED80C0E9267A90517A5B9862AB44CF9F9D96C354E952CB9CB0C32EB4887F80A1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................+... ...@....... ....................................@.................................t+..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........(..h...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\WcInstaller.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe
File Type:	ASCII text, with very long lines (912), with CRLF line terminators
Category:	modified
Size (bytes):	3301
Entropy (8bit):	5.323815650432605
Encrypted:	false
SSDEEP:	96:DK1qtAPy4COl++JSYDDYK7YK1qtAnSnWAs+H:DK1KAKis+8YoK7YK1KAtAjH
MD5:	57F6007F42EBAB87CABB9A1ACC8BB3B8
SHA1:	2FAEC901468E8C85BBF5533081B7D5E8F6EE988D
SHA-256:	4E14F6DF0AA0B082C4659912383CBA385DF3545021672605A5F45C1F94172230
SHA-512:	1E913DFD784FF9DBB3A5DF72B4B24279AEDE6A59EDEFAD55DAD4EAC7111D6A20CDDF5D0036044A9C9AF4D54AFE8630713DB9C9D0DFE19B0040CF9C2C85447F29
Malicious:	false
Preview:	Detecting windows culture..Preparing request for featureflag: {"Geo":"US","Partner":"IN240402","Campaign":"20622070018","InstallDate":"20241022","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}..Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklis

C:\Users\user\AppData\Local\Temp\WebCompanion.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	10494317
Entropy (8bit):	7.994463819622281
Encrypted:	true
SSDEEP:	196608:pKZsrAth9Vrdx45WtQbJtXWYxEwsOOXd/XUCv1uGJONYTr9udX6:U+rWVBx3WX7EJONION6f
MD5:	C0A2AAF917E6BC1D951EC481213D4138
SHA1:	56308BC1CF014F507E161B518736CD3D3666387D
SHA-256:	2F87DCD36A114502A3C80ECF8A8C5F5EF60475951F9C142A1A68BDEC6CAA3E23
SHA-512:	43EF07470F33BA0FF6A18E343C55ADAF0CDB2B88C3B37FA53F32608F1F78B6266BFACD2BB3BD92BF56EB0E28C4C20278212E06C1873DEA9098ECE5CDB117B9BC
Malicious:	false
Preview:	PK.........%.X....FF...$......Application/7za.exe.yxTE.8\|{I.YH'@CX.V[..%CP.4h_.MnCG@DQ..h..... .`'..\[...u..yg....QGY\........{..d.....S.......~.}y...N.:u..S.NU...`.......k....~.......e..o.`.......[`._..]U..g.s...?..~..J..:.~.s.t.}..q.>}2l.....u.....#.Y..Mt}.......6z......{.:.:.y^KW.]....ys."..Nu.........C.EB..$..P.k......s.(..zN..K.........iH..Z.....[..x.P.7.iB.6..Ta.,..I...#....g.r...<.wg.....zb......QUw..M.:...L...nHN..r...]#..TA.r...vO..5.'.:B]..p}<.lxU... ...6...........?i...o...g..7H...%E_..B...d.... .f.].&I..Q..G.S..x.o.K......../.~...g.Q_..^(..h^...Dq.J\Y2.....&...........Fo`...........}....98E'..Kne+c........._./..o.o.+g.z..M.6.....D.D.^I9..!..0HJ..?h.7..2"U.;...RY..=b..k.^y....0.l...m...h..9.........f....J-N..KU....HH."......Y...I)8..=s>.)MPH!.L....e...J..`bc(.:.-M=}...v...=..9.:..u.7.X.O...T..%e.)V...rS..s....o...[1.C... ...x7g)P..:............8. .u...lv-a..MB.TyW..D..p$..0.x>..'..K..l./g..U......b{.!_...,....<.....$#zh.e....+.

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.438976520573843
Encrypted:	false
SSDEEP:	3:asLGYrCSG6KBg:aqGY9G6Ka
MD5:	CEBF51A7378EC103CCAFE36E9B0A92F6
SHA1:	639ACB49025EE8378F9D4B6D96E26F50786F6727
SHA-256:	FA008D2279D9BF726AB299E9899EEF9CCA04B16190F4777B69A0ED8AB9896DEA
SHA-512:	B62BB82A70A9952E0B63820FB4FC0A0139E0519D2E145ED719F85528733FD264A327F480F0B0540157539511EA95113BB2B999F5C5C2329E7B320F09919323DC
Malicious:	false
Preview:	{ "install_id" : "faf43794-be76-41f2-97cd-2e67f16d433f"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.65366062702913
TrID:	Win32 Executable (generic) a (10002005/4) 99.40% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Setup.exe
File size:	545'352 bytes
MD5:	fef9a20fcd13f76e4656a66a95ae336c
SHA1:	f21aca3de231ef5476913b40f3d52d31c5cb9eb8
SHA256:	28fcbf8a60bc702b59e1fb25ece117741822136b6aa755440eec15b229d3f84c
SHA512:	42f025c9461bdc24e5ccacc050fd5adcbd975a02622f03474f65296cbdfc034edb626951e3e10cd1df145383a23bdca15a655ad7a65f281ad93d4e737be778e6
SSDEEP:	12288:nG5knZfFKeTDOydwORmV42Y5RBHtf8WS8sejGxUeRx7/7M:nG50ZfFKMDRCa0gDS8geevM
TLSH:	E4C4F1127DE089B5D5820431CC745FA6A2B6FE560A21887373997E3E7F7F642C232A1D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s..c}...s..Yy...s..w,...s...r./.s..w....s..Yx...s.......s.......s.Zyu...s.Rich..s.................PE..L......M...

File Icon


Icon Hash:	8011090b07071616

Static PE Info

General

Entrypoint:	0x4148d4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4DAC88CE [Mon Apr 18 18:54:06 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e00de6e48b9b06aceb12a81e7bf494c9

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Entrust Extended Validation Code Signing CA - EVCS2, O="Entrust, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	01/05/2024 15:39:26 01/05/2025 15:39:25
Subject Chain	CN=7270356 Canada Inc., SERIALNUMBER=1417258-2, OID.2.5.4.15=Private Organization, O=7270356 Canada Inc., OID.1.3.6.1.4.1.311.60.2.1.3=CA, L=Saint-Laurent, S=Quebec, C=CA
Version:	3
Thumbprint MD5:	0E3940FCE9D8B244F0D82DDEEBE28F5E
Thumbprint SHA-1:	EA06433E6F12D2AADA040F4A6EF7C927404A4CBA
Thumbprint SHA-256:	EB0A666D9DFD790059DF788FBA544ABC93E1690F1425147BA0A6E784AFC6F5B5
Serial:	25D0CB9D7B0D6C700CDAE43D243AB1C6

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0041B9E8h
push 004147FCh
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [0041B078h]
xor edx, edx
mov dl, ah
mov dword ptr [004233F0h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [004233ECh], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [004233E8h], ecx
shr eax, 10h
mov dword ptr [004233E4h], eax
push 00000001h
call 00007F4B752F704Bh
pop ecx
test eax, eax
jne 00007F4B752F61BAh
push 0000001Ch
call 00007F4B752F6278h
pop ecx
call 00007F4B752F6AFDh
test eax, eax
jne 00007F4B752F61BAh
push 00000010h
call 00007F4B752F6267h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007F4B752F8C6Ch
call dword ptr [0041B07Ch]
mov dword ptr [00425A5Ch], eax
call 00007F4B752F8B2Ah
mov dword ptr [00423360h], eax
call 00007F4B752F88D3h
call 00007F4B752F8815h
call 00007F4B752F8270h
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [0041B080h]
call 00007F4B752F87A6h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F4B752F61B8h
movzx eax, word ptr [ebp+00h]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[ C ] VS2010 build 30319
[ASM] VS2010 build 30319
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e9ac	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0x71d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x81fb0	0x3298
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x200	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x197c0	0x19800	206b62d600beb166f8bf863ad5301f8c	False	0.5831609987745098	DOS executable (COM)	6.60822715389085	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x4490	0x4600	b0314f39355cab7d4674a0928d3b15f2	False	0.312109375	data	4.383775518811042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x5a68	0x3200	8d44c03d32e0c923339cda9fae15827a	False	0.123828125	data	1.3793356235333818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sxdata	0x26000	0x4	0x200	35925cfdc1176bd9ffc634a58b40ec17	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27000	0x71d4	0x7200	cd606fe2fe8a9aaa6244d6a44a46010a	False	0.3919613486842105	data	4.655199945289653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27354	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.37231182795698925
RT_ICON	0x2763c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5472972972972973
RT_ICON	0x27764	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2833 x 2833 px/m			0.3200354609929078
RT_ICON	0x27bcc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2833 x 2833 px/m			0.23688524590163934
RT_ICON	0x28554	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2833 x 2833 px/m			0.1721388367729831
RT_ICON	0x295fc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2833 x 2833 px/m			0.1241701244813278
RT_ICON	0x2bba4	0x1a7b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9648915769287506
RT_DIALOG	0x2d620	0xb8	data	English	United States	0.6684782608695652
RT_STRING	0x2d6d8	0x94	data	English	United States	0.668918918918919
RT_STRING	0x2d76c	0x34	data	English	United States	0.6538461538461539
RT_GROUP_ICON	0x2d7a0	0x4c	data			0.8289473684210527
RT_GROUP_ICON	0x2d7ec	0x22	data	English	United States	1.0
RT_VERSION	0x2d810	0x344	data	English	United States	0.4318181818181818
RT_MANIFEST	0x2db54	0x67f	exported SGML document, ASCII text, with CRLF line terminators	English	United States	0.3692122669873722

Imports

DLL	Import
OLEAUT32.dll	VariantClear, SysAllocString
USER32.dll	SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, GetWindowLongA, SetWindowTextW, LoadIconA, LoadStringW, LoadStringA, CharUpperW, CharUpperA, DestroyWindow, EndDialog, PostMessageA, ShowWindow, MessageBoxW, GetDlgItem, KillTimer, SetWindowTextA
SHELL32.dll	ShellExecuteExA
KERNEL32.dll	GetCurrentDirectoryA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, InterlockedDecrement, GetProcAddress, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, GetFileType, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, HeapSize, GetCurrentProcess, TerminateProcess, IsBadWritePtr, HeapCreate, HeapDestroy, GetEnvironmentVariableA, SetUnhandledExceptionFilter, TlsAlloc, ExitProcess, GetVersion, GetCommandLineA, GetStartupInfoA, GetModuleHandleA, WaitForSingleObject, CloseHandle, CreateProcessA, GetCommandLineW, GetVersionExA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, GetLastError, LoadLibraryA, GetModuleFileNameW, GetModuleFileNameA, LocalFree, FormatMessageW, FormatMessageA, SetFileTime, CreateFileW, SetLastError, SetFileAttributesW, SetFileAttributesA, RemoveDirectoryW, RemoveDirectoryA, CreateDirectoryW, CreateDirectoryA, DeleteFileW, DeleteFileA, GetFullPathNameW, GetFullPathNameA, SetCurrentDirectoryW, SetCurrentDirectoryA, GetCurrentDirectoryW, GetTempPathW, GetTempPathA, GetCurrentProcessId, GetTickCount, GetCurrentThreadId, FindClose, FindFirstFileW, FindFirstFileA, FindNextFileW, FindNextFileA, CreateFileA, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, GetStdHandle, WaitForMultipleObjects, Sleep, VirtualAlloc, VirtualFree, CreateEventA, SetEvent, ResetEvent, InitializeCriticalSection, RtlUnwind, RaiseException, HeapAlloc, HeapFree, HeapReAlloc, CreateThread, TlsSetValue, TlsGetValue, ExitThread

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-22T09:45:38.857508+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49732	104.16.149.130	80	TCP
2024-10-22T09:45:51.873975+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49768	104.16.149.130	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 09:45:16.478292942 CEST	49732	80	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:16.483716011 CEST	80	49732	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:16.483774900 CEST	49732	80	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:16.484515905 CEST	49732	80	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:16.489815950 CEST	80	49732	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:17.197043896 CEST	80	49732	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:17.248172998 CEST	49732	80	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:17.336771011 CEST	49733	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:17.336854935 CEST	443	49733	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:17.337025881 CEST	49733	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:17.349134922 CEST	49733	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:17.349169970 CEST	443	49733	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:18.086715937 CEST	443	49733	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:18.086853027 CEST	49733	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:18.091382980 CEST	49733	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:18.091428995 CEST	443	49733	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:18.091810942 CEST	443	49733	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:18.138742924 CEST	49733	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:18.143707991 CEST	49733	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:18.191339970 CEST	443	49733	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:18.191414118 CEST	49733	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:18.191466093 CEST	443	49733	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:18.421363115 CEST	443	49733	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:18.421492100 CEST	443	49733	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:18.421675920 CEST	49733	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:18.423239946 CEST	49733	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:18.611851931 CEST	49734	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:18.611896992 CEST	443	49734	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:18.611980915 CEST	49734	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:18.615339041 CEST	49734	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:18.615379095 CEST	443	49734	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:19.232394934 CEST	443	49734	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:19.232557058 CEST	49734	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:19.235361099 CEST	49734	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:19.235372066 CEST	443	49734	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:19.235631943 CEST	443	49734	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:19.236936092 CEST	49734	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:19.279334068 CEST	443	49734	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:19.279424906 CEST	49734	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:19.279428959 CEST	443	49734	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:19.534162045 CEST	443	49734	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:19.534398079 CEST	443	49734	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:19.534471035 CEST	49734	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:19.534718037 CEST	49734	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:19.542323112 CEST	49735	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:19.542366982 CEST	443	49735	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:19.542448044 CEST	49735	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:19.542623997 CEST	49735	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:19.542638063 CEST	443	49735	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:20.157432079 CEST	443	49735	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:20.159137964 CEST	49735	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:20.159157038 CEST	443	49735	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:20.159214020 CEST	49735	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:20.159220934 CEST	443	49735	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:20.413590908 CEST	443	49735	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:20.413814068 CEST	443	49735	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:20.413892031 CEST	49735	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:20.417053938 CEST	49735	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:20.442559004 CEST	49736	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:20.442610025 CEST	443	49736	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:20.442682981 CEST	49736	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:20.442884922 CEST	49736	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:20.442907095 CEST	443	49736	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:21.065855026 CEST	443	49736	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:21.067329884 CEST	49736	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:21.067363024 CEST	443	49736	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:21.067425966 CEST	49736	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:21.067435026 CEST	443	49736	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:21.340735912 CEST	443	49736	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:21.340991020 CEST	443	49736	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:21.341073990 CEST	49736	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:21.343918085 CEST	49736	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:21.382808924 CEST	49737	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:21.382853985 CEST	443	49737	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:21.382910013 CEST	49737	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:21.383177996 CEST	49737	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:21.383196115 CEST	443	49737	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:22.005206108 CEST	443	49737	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:22.007097960 CEST	49737	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:22.007131100 CEST	443	49737	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:22.007189035 CEST	49737	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:22.007199049 CEST	443	49737	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:23.220288992 CEST	443	49737	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:23.220375061 CEST	443	49737	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:23.220442057 CEST	49737	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:23.220936060 CEST	49737	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:23.711369991 CEST	49738	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:23.711407900 CEST	443	49738	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:23.711468935 CEST	49738	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:23.711720943 CEST	49738	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:23.711731911 CEST	443	49738	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:24.335288048 CEST	443	49738	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:24.336731911 CEST	49738	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:24.336749077 CEST	443	49738	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:24.336803913 CEST	49738	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:24.336813927 CEST	443	49738	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:24.591455936 CEST	443	49738	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:24.591756105 CEST	443	49738	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:24.591829062 CEST	49738	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:24.593491077 CEST	49738	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:24.598392010 CEST	49741	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:24.598490953 CEST	443	49741	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:24.598598003 CEST	49741	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:24.598817110 CEST	49741	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:24.598850965 CEST	443	49741	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:25.750854015 CEST	443	49741	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:25.753118992 CEST	49741	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:25.753180027 CEST	443	49741	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:25.753263950 CEST	49741	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:25.753285885 CEST	443	49741	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:26.002579927 CEST	443	49741	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:26.002644062 CEST	443	49741	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:26.002832890 CEST	49741	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:26.003164053 CEST	49741	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:26.015058994 CEST	49742	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:26.015089989 CEST	443	49742	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:26.015327930 CEST	49742	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:26.015394926 CEST	49742	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:26.015399933 CEST	443	49742	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:27.162614107 CEST	443	49742	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:27.164556026 CEST	49742	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:27.164588928 CEST	443	49742	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:27.164673090 CEST	49742	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:27.164680958 CEST	443	49742	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:27.450270891 CEST	443	49742	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:27.450373888 CEST	443	49742	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:27.450467110 CEST	49742	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:27.450917006 CEST	49742	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:27.455322027 CEST	49744	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:27.455379009 CEST	443	49744	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:27.455471039 CEST	49744	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:27.455671072 CEST	49744	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:27.455684900 CEST	443	49744	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:28.056276083 CEST	443	49744	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:28.057784081 CEST	49744	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:28.057843924 CEST	443	49744	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:28.057921886 CEST	49744	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:28.057934999 CEST	443	49744	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:28.310724974 CEST	443	49744	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:28.310806036 CEST	443	49744	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:28.310935020 CEST	49744	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:28.342922926 CEST	49744	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:28.565761089 CEST	49745	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:28.565819979 CEST	443	49745	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:28.565901041 CEST	49745	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:28.566121101 CEST	49745	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:28.566133022 CEST	443	49745	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:29.234436989 CEST	443	49745	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:29.236148119 CEST	49745	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:29.236166000 CEST	443	49745	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:29.236212015 CEST	49745	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:29.236221075 CEST	443	49745	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:29.440881968 CEST	443	49745	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:29.441154957 CEST	443	49745	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:29.441219091 CEST	49745	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:29.441700935 CEST	49745	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:29.447415113 CEST	49747	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:29.447460890 CEST	443	49747	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:29.447520971 CEST	49747	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:29.447730064 CEST	49747	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:29.447772980 CEST	443	49747	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:30.065978050 CEST	443	49747	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:30.067625999 CEST	49747	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:30.067653894 CEST	443	49747	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:30.067794085 CEST	49747	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:30.067810059 CEST	443	49747	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:30.309344053 CEST	443	49747	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:30.309581995 CEST	443	49747	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:30.309653997 CEST	49747	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:30.310069084 CEST	49747	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:30.333281040 CEST	49749	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:30.333318949 CEST	443	49749	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:30.333590031 CEST	49749	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:30.333590031 CEST	49749	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:30.333621979 CEST	443	49749	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:30.933762074 CEST	443	49749	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:30.950887918 CEST	49749	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:30.950901985 CEST	443	49749	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:30.951262951 CEST	49749	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:30.951267958 CEST	443	49749	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:31.199609995 CEST	443	49749	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:31.199887037 CEST	443	49749	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:31.199937105 CEST	49749	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:31.200547934 CEST	49749	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:31.230226040 CEST	49750	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:31.230288029 CEST	443	49750	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:31.230357885 CEST	49750	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:31.230590105 CEST	49750	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:31.230607986 CEST	443	49750	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:31.850004911 CEST	443	49750	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:31.852010012 CEST	49750	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:31.852034092 CEST	443	49750	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:31.852164030 CEST	49750	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:31.852173090 CEST	443	49750	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:32.147027016 CEST	443	49750	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:32.147120953 CEST	443	49750	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:32.147257090 CEST	49750	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:32.147628069 CEST	49750	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:32.157605886 CEST	49752	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:32.157695055 CEST	443	49752	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:32.158474922 CEST	49752	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:32.158710957 CEST	49752	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:32.158739090 CEST	443	49752	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:32.781399012 CEST	443	49752	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:32.782999992 CEST	49752	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:32.783039093 CEST	443	49752	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:32.783159018 CEST	49752	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:32.783169985 CEST	443	49752	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.040397882 CEST	443	49752	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.040669918 CEST	443	49752	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.040826082 CEST	49752	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.041177034 CEST	49752	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.047188997 CEST	49754	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.047223091 CEST	443	49754	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.047308922 CEST	49754	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.047606945 CEST	49754	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.047624111 CEST	443	49754	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.670118093 CEST	443	49754	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.679342031 CEST	49754	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.679371119 CEST	443	49754	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.679536104 CEST	49754	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.679547071 CEST	443	49754	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.929460049 CEST	443	49754	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.929689884 CEST	443	49754	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.929752111 CEST	49754	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.930089951 CEST	49754	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.973525047 CEST	49757	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.973570108 CEST	443	49757	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:33.973651886 CEST	49757	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.974011898 CEST	49757	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:33.974029064 CEST	443	49757	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:34.585074902 CEST	443	49757	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:34.597073078 CEST	49757	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:34.597095966 CEST	443	49757	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:34.597131014 CEST	49757	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:34.597138882 CEST	443	49757	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:34.854546070 CEST	443	49757	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:34.854768038 CEST	443	49757	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:34.854820967 CEST	49757	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:34.855240107 CEST	49757	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:34.860404015 CEST	49759	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:34.860428095 CEST	443	49759	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:34.860491037 CEST	49759	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:34.860795021 CEST	49759	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:34.860807896 CEST	443	49759	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:35.581964016 CEST	443	49759	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:35.583417892 CEST	49759	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:35.583441973 CEST	443	49759	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:35.583647013 CEST	49759	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:35.583652020 CEST	443	49759	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:35.870018959 CEST	443	49759	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:35.870238066 CEST	443	49759	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:35.870320082 CEST	49759	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:35.870901108 CEST	49759	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:35.894607067 CEST	49760	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:35.894695997 CEST	443	49760	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:35.894777060 CEST	49760	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:35.895114899 CEST	49760	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:35.895148993 CEST	443	49760	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:36.505008936 CEST	443	49760	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:36.515172958 CEST	49760	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:36.515234947 CEST	443	49760	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:36.515371084 CEST	49760	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:36.515391111 CEST	443	49760	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:36.764751911 CEST	443	49760	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:36.764967918 CEST	443	49760	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:36.765052080 CEST	49760	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:36.765310049 CEST	49760	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:36.777081966 CEST	49762	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:36.777138948 CEST	443	49762	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:36.777236938 CEST	49762	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:36.777437925 CEST	49762	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:36.777468920 CEST	443	49762	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:38.368218899 CEST	443	49762	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:38.377621889 CEST	49762	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:38.377636909 CEST	443	49762	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:38.377753019 CEST	49762	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:38.377758026 CEST	443	49762	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:38.568409920 CEST	443	49762	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:38.568505049 CEST	443	49762	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:38.568706036 CEST	49762	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:38.569042921 CEST	49762	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:38.576781034 CEST	49732	80	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:38.582165003 CEST	80	49732	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:38.801189899 CEST	80	49732	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:38.803895950 CEST	49764	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:38.803929090 CEST	443	49764	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:38.804039001 CEST	49764	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:38.804286003 CEST	49764	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:38.804299116 CEST	443	49764	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:38.857507944 CEST	49732	80	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:39.531141996 CEST	443	49764	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:39.545058012 CEST	49764	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:39.545085907 CEST	443	49764	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:39.545160055 CEST	49764	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:39.545164108 CEST	443	49764	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:39.785857916 CEST	443	49764	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:39.786153078 CEST	443	49764	104.16.148.130	192.168.2.4
Oct 22, 2024 09:45:39.786238909 CEST	49764	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:39.786601067 CEST	49764	443	192.168.2.4	104.16.148.130
Oct 22, 2024 09:45:39.793124914 CEST	49732	80	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:39.795006037 CEST	49765	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:39.795030117 CEST	443	49765	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:39.795099020 CEST	49765	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:39.795361996 CEST	49765	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:39.795368910 CEST	443	49765	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:39.799130917 CEST	80	49732	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:39.799212933 CEST	49732	80	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:40.411053896 CEST	443	49765	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:40.412605047 CEST	49765	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:40.412620068 CEST	443	49765	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:40.412678003 CEST	49765	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:40.412684917 CEST	443	49765	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:40.674302101 CEST	443	49765	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:40.674552917 CEST	443	49765	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:40.674608946 CEST	49765	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:40.675129890 CEST	49765	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:40.681875944 CEST	49766	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:40.681963921 CEST	443	49766	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:40.682040930 CEST	49766	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:40.682243109 CEST	49766	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:40.682279110 CEST	443	49766	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:41.310749054 CEST	443	49766	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:41.312148094 CEST	49766	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:41.312180996 CEST	443	49766	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:41.312351942 CEST	49766	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:41.312371969 CEST	443	49766	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:41.639512062 CEST	443	49766	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:41.639750957 CEST	443	49766	104.18.27.149	192.168.2.4
Oct 22, 2024 09:45:41.639945984 CEST	49766	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:41.640141010 CEST	49766	443	192.168.2.4	104.18.27.149
Oct 22, 2024 09:45:41.658961058 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:41.659008980 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:41.659344912 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:41.659476995 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:41.659496069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.401264906 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.401432991 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.405617952 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.405628920 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.406398058 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.407828093 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.455323935 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.544841051 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.544951916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.545038939 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.545047998 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.545061111 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.545089960 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.545123100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.545265913 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.545303106 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.545308113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.545407057 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.545485020 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.545510054 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.545536041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.545578957 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.545672894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.591892958 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.662003994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.662127972 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.662215948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.662231922 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.662247896 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.662322044 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.662328005 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.662422895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.662487030 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.662492037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.662903070 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.662956953 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.662962914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.663072109 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.663117886 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.663122892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.663223028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.663266897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.663271904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.716958046 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.716974020 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.763859034 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.778814077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.778909922 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.778956890 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.778985977 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.778999090 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.779047012 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.779088974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.779103041 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.779108047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.779628992 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.779673100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.779716015 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.779721022 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.779814005 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.779851913 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.779858112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.779937983 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.779973984 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.779978037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.826524973 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.826538086 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.873568058 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.895809889 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.895994902 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.896049976 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.896061897 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.896114111 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.896167040 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.896173000 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.896212101 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.896689892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.896712065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.896748066 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.896889925 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.896914959 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.896948099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.896953106 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:42.896965981 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:42.951594114 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.012744904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.012764931 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.012897968 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.012994051 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.013024092 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.013041019 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.013089895 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.013117075 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.013137102 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.013190985 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.013703108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.013781071 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.013787985 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.013816118 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.013834000 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.013839006 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.013880014 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.130451918 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.130525112 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.130585909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.130628109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.130692005 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.130742073 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.130860090 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.130913019 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.131397963 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.131450891 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.181159973 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.181319952 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.247437954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.247559071 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.247610092 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.247689962 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.247736931 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.247814894 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.248034954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.248085022 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.248440027 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.248497009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.290558100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.290680885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.364228964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.364352942 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.364578009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.364629030 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.365031958 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.365077019 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.365195990 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.365237951 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.365660906 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.365704060 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.407624960 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.407728910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.481945038 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.482083082 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.482084990 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.482110023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.482137918 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.482162952 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.482218981 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.482276917 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.482336044 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.482400894 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.482964039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.483021021 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.525005102 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.525149107 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.598412037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.598474979 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.598546982 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.598567009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.598599911 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.598613977 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.598759890 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.598802090 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.599200964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.599245071 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.599730015 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.599771976 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.599901915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.599941969 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.716551065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.716643095 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.716830015 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.716850996 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.716890097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.717051983 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.717051983 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.717061043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.717099905 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.759912968 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.759962082 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.760010004 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.760023117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.760052919 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.760052919 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.834847927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.834913969 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.834956884 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.834976912 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.835015059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.835068941 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.949711084 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.949732065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.949815035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.949826956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.949866056 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.951220989 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.951241016 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.951293945 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:43.951301098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:43.951334953 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.066967964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.066984892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.067054987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.067068100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.067106009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.068196058 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.068211079 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.068273067 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.068279982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.068317890 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.184994936 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.185061932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.185086012 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.185096979 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.185107946 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.185132027 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.185765028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.185811043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.185833931 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.185837984 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.185862064 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.185872078 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.301806927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.301873922 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.301876068 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.301891088 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.301909924 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.301919937 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.301948071 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.302676916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.302725077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.302742958 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.302755117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.302779913 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.302793980 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.418697119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.418759108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.418893099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.418909073 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.418981075 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.419641018 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.419687033 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.419758081 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.419763088 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.419882059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.461883068 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.461942911 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.462033987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.462047100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.462074041 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.462094069 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.536354065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.536412954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.536489964 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.536515951 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.536530972 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.536552906 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.537728071 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.537774086 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.537837982 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.537843943 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.537941933 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.537997007 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.652973890 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.653038025 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.653048038 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.653069973 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.653090954 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.653105974 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.654028893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.654084921 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.654095888 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.654108047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.654138088 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.654154062 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.695733070 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.695785999 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.695812941 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.695822001 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.695842981 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.695888996 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.770586014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.770653963 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.770735025 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.770765066 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.770781040 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.770812035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.771509886 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.771563053 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.771584988 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.771589994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.771617889 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.771629095 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.813359976 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.813435078 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.813458920 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.813467026 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.813513994 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.887906075 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.887976885 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.887986898 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.888005018 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.888020039 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.888058901 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.929650068 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.929697037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.929759979 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.929769993 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:44.929804087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:44.929811001 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.004995108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.005059004 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.005171061 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.005188942 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.005312920 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.005470991 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.005513906 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.005542040 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.005548000 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.005580902 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.046762943 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.046828985 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.046993017 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.047007084 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.047046900 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.121748924 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.121822119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.122056961 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.122066975 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.122140884 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.124301910 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.124352932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.124408960 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.124414921 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.124453068 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.165437937 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.165504932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.165564060 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.165570974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.165724993 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.165724993 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.239448071 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.239511967 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.239589930 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.239600897 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.239695072 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.240541935 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.240588903 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.240603924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.240618944 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.240649939 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.240655899 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.281783104 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.281851053 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.281871080 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.281881094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.281909943 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.281987906 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.282856941 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.282908916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.283004999 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.283010960 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.283082008 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.357319117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.357356071 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.357515097 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.357527971 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.357572079 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.358500957 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.358527899 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.358581066 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.358586073 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.358623981 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.399529934 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.399569035 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.399677038 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.399713039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.399733067 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.399749994 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.472830057 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.472881079 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.472906113 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.472917080 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.472927094 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.472949982 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.473959923 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.474008083 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.474049091 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.474054098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.474082947 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.474104881 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.514926910 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.514985085 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.515008926 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.515017986 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.515041113 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.515050888 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.516091108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.516135931 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.516165018 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.516170025 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.516196966 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.516211033 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.590425014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.590471983 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.590656042 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.590667009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.590714931 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.591522932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.591569901 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.591595888 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.591600895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.591643095 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.632276058 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.632325888 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.632397890 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.632411003 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.632426977 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.632452011 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.706697941 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.706747055 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.706841946 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.706847906 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.706875086 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.707463026 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.707495928 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.707503080 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.707525969 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.707528114 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.707561970 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.707566023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.707595110 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.707622051 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.708655119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.708699942 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.708735943 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.708740950 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.708770990 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.708782911 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.749558926 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.749600887 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.749650955 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.749658108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.749687910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.749708891 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.823859930 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.823906898 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.824012995 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.824043036 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.824055910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.824084997 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.824762106 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.824803114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.824839115 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.824843884 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.824870110 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.824888945 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.825627089 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.825654030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.825690031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.825694084 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.825719118 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.825728893 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.866501093 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.866552114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.866626024 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.866632938 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.866678953 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.867588043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.867630959 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.867655993 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.867661953 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.867691040 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.867700100 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.942894936 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.942945957 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.942996025 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.943006039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.943037033 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.943051100 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.943844080 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.943887949 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.943919897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.943924904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.943949938 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.943957090 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.983732939 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.983792067 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.983829975 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.983836889 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.983885050 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.984580040 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.984622955 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.984644890 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.984649897 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:45.984673023 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:45.984690905 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.059447050 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.059510946 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.059576035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.059590101 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.059621096 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.059633970 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.060280085 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.060333014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.060334921 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.060353994 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.060367107 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.060385942 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.060409069 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.100172043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.100225925 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.100258112 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.100266933 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.100305080 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.100816011 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.100857973 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.100871086 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.100871086 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.100908041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.100935936 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.100982904 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.146980047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.147023916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.147066116 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.147075891 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.147113085 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.186800003 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.186850071 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.186862946 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.186872005 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.186897993 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.186909914 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.188004017 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.188045979 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.188075066 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.188081026 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.188110113 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.188122988 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.217331886 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.217375040 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.217413902 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.217422009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.217451096 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.217464924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.218226910 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.218271971 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.218306065 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.218310118 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.218333006 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.218346119 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.303189993 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.303210974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.303251982 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.303267002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.303286076 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.303297997 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.303956032 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.303972960 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.304020882 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.304028034 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.304058075 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.304644108 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.304821014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.304836035 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.304902077 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.304908991 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.304944992 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.334350109 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.334377050 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.334481955 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.334495068 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.334634066 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.335259914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.335282087 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.335331917 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.335340023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.335376978 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.410022020 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.410044909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.410356998 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.410387993 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.410439014 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.420964956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.420979977 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.421072960 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.421081066 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.421224117 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.421576977 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.421590090 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.421633005 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.421639919 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.421667099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.421685934 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.451267958 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.451282024 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.451364994 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.451373100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.451419115 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.454586983 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.454602003 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.454659939 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.454668045 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.454705000 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.455666065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.455722094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.455729008 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.455758095 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.455785036 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.498200893 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.537436962 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.537453890 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.537579060 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.537599087 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.537642956 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.538239956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.538253069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.538309097 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.538316011 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.538350105 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.539017916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.539031982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.539088964 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.539096117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.539174080 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.571295977 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.571310997 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.571413040 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.571422100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.571465969 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.572063923 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.572077990 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.572137117 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.572143078 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.572196007 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.644345045 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.644361019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.644536972 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.644547939 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.644592047 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.655205011 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.655219078 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.655292988 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.655302048 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.655343056 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.655855894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.655869961 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.655927896 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.655935049 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.655975103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.685436964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.685456038 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.685570002 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.685605049 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.685672998 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.688818932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.688836098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.688900948 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.688910007 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.688951015 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.689539909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.689557076 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.689606905 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.689616919 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.689656019 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.761400938 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.761420012 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.761589050 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.761604071 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.761647940 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.772630930 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.772650003 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.772716045 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.772723913 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.772763968 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.773195982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.773210049 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.773257017 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.773264885 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.773303032 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.802587986 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.802606106 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.802685976 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.802706957 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.802752972 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.805948019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.805960894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.806027889 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.806036949 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.806075096 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.806763887 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.806777000 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.806832075 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.806838989 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.806878090 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.851041079 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.851068020 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.851128101 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.851140976 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.851181030 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.889389992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.889419079 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.889457941 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.889472008 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.889487028 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.889511108 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.890019894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.890033960 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.890074968 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.890093088 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.890127897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.891040087 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.891053915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.891088009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.891099930 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.891125917 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.891139030 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.923103094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.923125029 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.923187017 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.923199892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.923235893 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.923866987 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.923883915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.923938990 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.923949003 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.923996925 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.966850996 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.966865063 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.966974974 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:46.966989994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:46.967032909 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.005966902 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.005980015 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.006189108 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.006222010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.006272078 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.006762028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.006777048 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.006834984 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.006845951 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.006886959 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.007644892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.007658005 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.007723093 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.007731915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.007769108 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.037251949 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.037265062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.037446976 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.037481070 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.037528038 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.040386915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.040400028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.040481091 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.040489912 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.040528059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.041232109 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.041244984 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.041304111 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.041311026 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.041351080 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.112776041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.112792969 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.112927914 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.112957001 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.113003969 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.123647928 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.123665094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.123728037 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.123734951 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.123775959 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.124394894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.124414921 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.124475002 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.124481916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.124520063 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.125344992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.125361919 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.125417948 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.125426054 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.125461102 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.154455900 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.154485941 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.154613972 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.154625893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.154795885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.157536983 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.157553911 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.157604933 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.157613039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.157636881 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.157651901 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.158545017 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.158565044 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.158621073 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.158627033 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.158667088 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.202063084 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.202084064 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.202158928 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.202172995 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.202328920 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.240602016 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.240617990 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.240696907 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.240710974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.240751982 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.241384029 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.241398096 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.241456032 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.241463900 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.241506100 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.242137909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.242151022 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.242206097 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.242213964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.242252111 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.271272898 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.271286964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.271404982 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.271421909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.271465063 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.274439096 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.274451971 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.274509907 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.274521112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.274561882 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.275234938 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.275248051 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.275305033 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.275316954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.275353909 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.275916100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.275928020 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.275983095 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.275990009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.276024103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.356841087 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.356859922 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.356990099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.357018948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.357060909 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.358184099 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.358196974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.358257055 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.358266115 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.358303070 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.358994007 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.359009981 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.359067917 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.359075069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.359112978 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.359682083 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.359694958 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.359749079 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.359755993 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.359788895 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.390913010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.390928030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.391052008 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.391062975 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.391103029 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.391762018 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.391776085 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.391827106 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.391834974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.391870022 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.392503023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.392517090 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.392575026 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.392582893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.392620087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.432951927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.432967901 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.433007002 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.433020115 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.433037996 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.433054924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.474508047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.474526882 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.474597931 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.474613905 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.474657059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.475318909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.475332975 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.475389004 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.475398064 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.475435972 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.476044893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.476059914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.476114035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.476123095 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.476164103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.476752043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.476772070 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.476824999 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.476831913 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.476865053 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.506491899 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.506508112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.506601095 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.506616116 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.506656885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.508910894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.508925915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.508981943 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.508989096 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.509030104 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.509505033 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.509517908 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.509577036 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.509587049 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.509624004 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.510189056 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.510200977 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.510246992 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.510253906 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.510278940 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.510292053 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.581299067 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.581320047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.581423998 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.581438065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.581484079 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.592114925 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.592132092 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.592195034 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.592204094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.592243910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.592717886 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.592732906 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.592786074 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.592794895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.592833996 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.593463898 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.593486071 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.593528032 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.593534946 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.593558073 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.593569040 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.623181105 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.623198032 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.623265028 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.623281956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.623326063 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.625365019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.625377893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.625436068 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.625443935 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.625482082 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.626189947 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.626203060 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.626257896 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.626266956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.626305103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.626866102 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.626878023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.626935005 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.626941919 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.626979113 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.669845104 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.669873953 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.669995070 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.670025110 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.670073986 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.708745003 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.708771944 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.708858013 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.708887100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.708900928 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.708925962 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.709419012 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.709443092 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.709486961 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.709494114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.709518909 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.709526062 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.710165024 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.710186958 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.710242033 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.710249901 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.710285902 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.710680008 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.710696936 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.710735083 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.710741997 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.710764885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.710772038 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.740483999 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.740509987 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.740602016 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.740612030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.740650892 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.742908001 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.742928982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.742991924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.742997885 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.743036985 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.743160009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.743179083 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.743216991 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.743222952 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.743247986 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.743266106 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.744016886 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.744040012 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.744086027 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.744091988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.744118929 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.744127989 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.787007093 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.787026882 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.787095070 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.787103891 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.787142992 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.825897932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.825915098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.826003075 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.826013088 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.826148987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.826592922 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.826606989 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.826667070 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.826673985 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.826716900 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.827373981 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.827389002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.827444077 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.827450991 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.827498913 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.828202009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.828222036 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.828258038 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.828264952 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.828289032 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.828300953 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.857263088 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.857276917 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.857469082 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.857479095 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.857522011 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.859381914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.859396935 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.859447956 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.859456062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.859494925 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.860207081 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.860220909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.860274076 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.860280991 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.860320091 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.860932112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.860953093 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.861002922 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.861010075 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.861048937 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.861439943 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.861454964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.861510992 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.861517906 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.861552954 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.932981014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.933001041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.933065891 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.933077097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.933114052 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.943326950 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.943353891 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.943442106 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.943453074 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.943490028 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.943891048 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.943909883 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.943952084 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.943962097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.943984985 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.944006920 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.944706917 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.944722891 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.944775105 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.944782019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.944811106 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.945432901 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.945447922 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.945478916 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.945485115 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.945504904 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.945519924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.974806070 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.974827051 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.974884987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.974900007 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.974936008 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.976972103 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.976986885 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.977035046 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.977044106 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.977077007 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.977643013 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.977657080 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.977705002 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.977714062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.977751017 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.978358030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.978370905 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.978410959 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.978418112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:47.978439093 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:47.978462934 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.019011974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.019026041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.019073963 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.019090891 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.019156933 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.049863100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.049877882 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.049971104 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.049984932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.050029039 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.060813904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.060827971 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.060893059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.060902119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.060935974 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.061470985 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.061484098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.061537981 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.061546087 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.061584949 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.062122107 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.062141895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.062194109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.062201023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.062239885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.062839031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.062851906 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.062910080 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.062917948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.062953949 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.092081070 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.092101097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.092370987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.092401981 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.092453003 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.095782995 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.095804930 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.095854998 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.095861912 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.095892906 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.095900059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.096530914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.096545935 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.096604109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.096611023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.096648932 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.097198009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.097212076 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.097269058 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.097276926 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.097313881 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.098869085 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.098884106 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.098937035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.098942995 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.098982096 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.139988899 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.140007973 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.140100956 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.140110970 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.140151978 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.184205055 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.184230089 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.184432983 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.184463978 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.184604883 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.184879065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.184895039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.184952021 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.184961081 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.185002089 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.185825109 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.185841084 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.185893059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.185900927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.185937881 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.186311007 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.186327934 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.186378002 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.186386108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.186419964 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.187558889 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.187576056 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.187630892 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.187638044 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.187673092 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.209233999 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.209250927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.209474087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.209498882 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.209650040 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.213069916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.213084936 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.213149071 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.213156939 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.213200092 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.213634014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.213654041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.213704109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.213711023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.213748932 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.214186907 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.214201927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.214267015 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.214274883 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.214313984 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.214778900 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.214793921 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.214845896 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.214853048 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.214890003 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.256849051 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.256876945 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.256947994 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.256962061 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.257100105 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.301132917 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.301152945 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.301238060 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.301266909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.301311016 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.301541090 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.301553965 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.301614046 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.301621914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.301660061 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.302062988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.302077055 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.302129030 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.302136898 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.302175999 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.302644014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.302658081 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.302717924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.302726030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.302763939 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.303318977 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.303333998 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.303391933 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.303397894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.303440094 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.326972008 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.326996088 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.327097893 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.327111006 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.327157021 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.330976009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.330991030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.331067085 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.331075907 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.331115007 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.331916094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.331932068 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.331995010 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.332003117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.332037926 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.332503080 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.332516909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.332578897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.332586050 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.332623005 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.332982063 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.332995892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.333055019 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.333062887 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.333098888 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.371484041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.371515036 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.371714115 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.371726990 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.371777058 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.401611090 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.401637077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.401930094 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.401961088 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.402021885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.418653011 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.418669939 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.418749094 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.418756962 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.418993950 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.419307947 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.419327974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.419488907 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.419502020 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.419548035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.420455933 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.420479059 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.420537949 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.420547009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.420586109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.421072006 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.421087980 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.421144962 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.421153069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.421195030 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.421967983 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.421988010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.422043085 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.422049999 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.422087908 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.443955898 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.443972111 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.444149971 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.444178104 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.444235086 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.447750092 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.447767019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.447860003 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.447875023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.447922945 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.448982954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.449006081 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.449162006 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.449173927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.449220896 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.449665070 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.449681997 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.449745893 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.449758053 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.449793100 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.450514078 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.450526953 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.450591087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.450598001 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.450628042 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.451219082 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.451232910 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.451308966 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.451325893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.451375008 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.490303993 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.490323067 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.490468025 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.490480900 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.490526915 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.534744024 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.534764051 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.534826994 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.534826994 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.534838915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.534869909 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.535396099 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.535410881 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.535458088 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.535465002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.535499096 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.536096096 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.536117077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.536166906 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.536174059 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.536212921 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.536884069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.536904097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.536951065 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.536957979 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.536993027 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.537626028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.537642002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.537689924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.537695885 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.537735939 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.538280010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.538294077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.538331032 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.538338900 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.538362980 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.538374901 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.560617924 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.560631037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.560671091 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.560682058 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.560718060 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.564388037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.564400911 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.564449072 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.564460039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.564493895 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.565085888 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.565099001 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.565155983 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.565164089 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.565203905 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.565815926 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.565829039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.565948009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.565954924 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.565996885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.566484928 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.566498041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.566546917 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.566553116 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.566576958 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.566586018 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.604548931 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.604562998 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.604621887 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.604635000 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.604676962 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.635284901 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.635298014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.635405064 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.635416031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.635449886 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.651878119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.651890993 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.651962996 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.651972055 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.652009964 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.652534008 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.652550936 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.652606964 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.652614117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.652648926 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.653413057 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.653425932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.653479099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.653486013 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.653520107 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.653753996 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.653769016 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.653812885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.653820038 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.653855085 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.654712915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.654731989 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.654777050 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.654783010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.654819012 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.655508995 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.655523062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.655567884 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.655575991 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.655664921 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.677649021 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.677661896 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.677723885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.677737951 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.677773952 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.682723999 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.682738066 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.682792902 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.682801962 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.682837009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.683120966 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.683139086 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.683187962 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.683196068 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.683235884 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.684034109 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.684050083 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.684097052 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.684104919 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.684142113 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.684432030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.684444904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.684494972 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.684501886 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.684540033 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.684935093 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.684947968 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.684997082 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.685003996 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.685041904 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.724407911 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.724430084 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.724667072 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.724694967 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.724746943 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.769028902 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.769048929 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.769151926 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.769176960 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.769305944 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.769490004 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.769505024 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.769562006 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.769568920 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.769607067 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.770124912 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.770139933 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.770195007 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.770203114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.770241022 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.771044970 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.771060944 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.771112919 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.771121025 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.771158934 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.771764040 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.771779060 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.771831989 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.771840096 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.771878004 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.772552967 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.772573948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.772624969 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.772631884 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.772670031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.794280052 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.794306993 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.794513941 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.794522047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.794568062 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.798886061 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.798902988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.798971891 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.798978090 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.799019098 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.799480915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.799498081 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.799561977 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.799570084 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.799607038 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.800270081 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.800297022 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.800360918 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.800368071 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.800405979 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.800853968 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.800873995 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.800924063 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.800934076 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.800971985 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.801517963 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.801537037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.801590919 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.801598072 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.801634073 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.801903009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.801922083 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.801970005 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.801978111 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.802014112 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.841706991 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.841728926 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.841809988 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.841820955 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.841969013 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.886195898 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.886209965 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.886300087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.886322021 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.886370897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.886742115 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.886755943 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.886812925 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.886821032 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.886857986 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.887412071 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.887425900 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.887480021 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.887487888 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.887525082 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.888223886 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.888237000 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.888278961 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.888284922 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.888312101 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.888324022 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.889075041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.889090061 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.889138937 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.889147043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.889179945 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.889978886 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.889996052 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.890044928 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.890052080 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.890089989 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.890568018 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.890582085 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.890635014 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.890641928 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.890676975 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.911799908 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.911818981 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.911891937 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.911919117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.912053108 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.916383982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.916399002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.916456938 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.916465044 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.916506052 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.916980982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.916994095 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.917049885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.917057037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.917094946 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.917495966 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.917510033 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.917566061 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.917573929 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.917613029 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.918111086 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.918128014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.918183088 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.918190956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.918229103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.918730021 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.918745995 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.918800116 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.918807983 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.918844938 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.956088066 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.956104040 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.956296921 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.956324100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.956377029 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.958985090 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.959000111 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.959053040 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:48.959062099 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:48.959101915 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.003339052 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.003370047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.003474951 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.003494024 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.003542900 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.004448891 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.004466057 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.004512072 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.004519939 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.004547119 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.004565954 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.005343914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.005363941 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.005417109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.005424023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.005435944 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.005455017 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.005465031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.005474091 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.005495071 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.005532026 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.006318092 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.006337881 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.006386042 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.006392956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.006433010 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.007320881 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.007334948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.007385015 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.007392883 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.007446051 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.008142948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.008160114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.008210897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.008219004 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.008255959 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.028795004 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.028820992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.028893948 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.028902054 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.028940916 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.033364058 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.033381939 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.033473015 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.033480883 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.033682108 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.033930063 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.033945084 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.034003019 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.034015894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.034056902 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.034818888 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.034836054 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.034889936 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.034898043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.034934998 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.035450935 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.035473108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.035526991 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.035535097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.035572052 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.035871983 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.035887957 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.035940886 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.035948992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.035985947 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.073101997 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.073127031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.073302031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.073328018 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.073400021 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.075786114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.075805902 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.075865030 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.075872898 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.075910091 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.103703976 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.103733063 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.103765011 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.103775978 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.103790998 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.103810072 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.120699883 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.120719910 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.120753050 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.120762110 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.120783091 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.120801926 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.121164083 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.121176958 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.121226072 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.121234894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.121268034 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.121814013 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.121826887 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.121865988 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.121872902 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.121900082 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.121913910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.122383118 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.122396946 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.122457981 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.122466087 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.122503042 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.123007059 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.123020887 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.123097897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.123105049 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.123145103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.123424053 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.123437881 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.123486042 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.123493910 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.123533010 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.124233007 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.124252081 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.124294996 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.124305010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.124327898 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.124346972 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.146198988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.146225929 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.146301031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.146311998 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.146349907 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.150341988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.150358915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.150410891 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.150418997 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.150454044 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.150935888 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.150949955 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.151001930 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.151010036 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.151045084 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.151681900 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.151698112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.151740074 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.151746988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.151762009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.151773930 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.152174950 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.152194023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.152240992 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.152249098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.152281046 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.152748108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.152764082 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.152825117 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.152825117 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.152832985 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.152892113 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.153227091 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.153248072 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.153301954 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.153310061 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.153361082 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.192689896 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.192704916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.192796946 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.192806959 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.192996025 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.220722914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.220750093 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.220813036 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.220822096 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.220860958 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.238104105 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.238125086 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.238182068 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.238192081 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.238231897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.238835096 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.238852024 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.238907099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.238914013 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.238956928 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.239340067 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.239357948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.239406109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.239413977 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.239453077 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.239774942 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.239789963 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.239842892 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.239850998 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.239890099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.240350962 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.240367889 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.240413904 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.240422010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.240441084 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.240463018 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.240953922 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.240979910 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.241025925 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.241033077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.241066933 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.241580963 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.241596937 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.241650105 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.241656065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.241693974 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.262763977 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.262782097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.262960911 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.262973070 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.263179064 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.263479948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.263504982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.263572931 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.263580084 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.263619900 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.267630100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.267659903 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.267801046 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.267801046 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.267827988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.267875910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.268266916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.268282890 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.268332958 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.268341064 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.268381119 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.268835068 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.268851042 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.268903971 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.268912077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.268949986 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.269387960 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.269402981 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.269459963 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.269468069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.269510984 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.270116091 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.270143986 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.270194054 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.270201921 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.270240068 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.270507097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.270529032 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.270584106 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.270591021 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.270628929 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.310141087 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.310158968 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.310257912 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.310272932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.310417891 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.310724974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.310741901 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.310803890 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.310812950 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.310851097 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.355170012 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.355200052 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.355338097 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.355351925 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.355396986 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.355782986 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.355798006 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.355835915 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.355844021 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.355870962 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.355884075 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.356580973 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.356601954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.356652975 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.356659889 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.356694937 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.357196093 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.357218027 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.357263088 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.357270956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.357306957 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.357917070 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.357934952 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.357983112 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.357990026 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.358026981 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.358766079 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.358783007 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.358831882 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.358838081 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.358858109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.358869076 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.359075069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.359091043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.359131098 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.359138012 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.359164953 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.359174967 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.360075951 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.360093117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.360131979 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.360137939 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.360162973 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.360181093 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.380295992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.380311012 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.380372047 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.380378962 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.380414963 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.384318113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.384337902 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.384381056 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.384387970 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.384416103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.384429932 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.385071993 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.385088921 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.385138035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.385145903 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.385179996 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.385915041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.385930061 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.385982037 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.385988951 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.386023998 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.386553049 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.386570930 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.386616945 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.386624098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.386641979 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.386657000 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.386956930 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.386972904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.387023926 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.387031078 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.387065887 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.387711048 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.387727976 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.387773037 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.387778997 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.387804985 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.387818098 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.388305902 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.388325930 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.388366938 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.388372898 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.388396978 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.388408899 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.427405119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.427427053 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.427602053 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.427611113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.427653074 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.428107023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.428122044 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.428294897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.428303957 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.428345919 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.472237110 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.472260952 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.472457886 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.472469091 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.472512007 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.472913027 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.472928047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.472978115 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.472985983 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.473022938 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.474193096 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.474211931 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.474247932 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.474253893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.474277020 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.474294901 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.474960089 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.474977970 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.475023031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.475029945 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.475055933 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.475063086 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.475207090 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.475228071 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.475259066 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.475265026 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.475281000 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.475305080 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.475905895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.475923061 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.475995064 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.476001978 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.476039886 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.476533890 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.476555109 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.476593971 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.476599932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.476615906 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.476638079 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.477436066 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.477452993 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.477485895 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.477492094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.477544069 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.477555990 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.497378111 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.497399092 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.497473955 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.497483969 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.497524023 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.498007059 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.498020887 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.498063087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.498070002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.498092890 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.498104095 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.502258062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.502278090 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.502362967 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.502371073 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.502413034 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.502676010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.502698898 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.502837896 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.502844095 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.502886057 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.503462076 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.503485918 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.503535986 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.503541946 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.503577948 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.504189968 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.504204035 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.504250050 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.504256964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.504292011 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.504789114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.504803896 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.504853964 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.504861116 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.504894972 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.505534887 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.505553961 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.505605936 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.505613089 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.505646944 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.541768074 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.541789055 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.541975021 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.542001009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.542042971 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.544631004 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.544646025 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.544718027 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.544725895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.544761896 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.573184967 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.573220015 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.573394060 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.573394060 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.573405981 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.574661016 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.590346098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.590365887 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.590478897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.590503931 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.590550900 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.590919971 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.590934992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.590976000 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.590982914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.591010094 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.591017962 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.591692924 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.591710091 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.591758966 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.591766119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.591799974 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.592597008 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.592612028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.592664003 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.592672110 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.592711926 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.593358994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.593374014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.593417883 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.593425035 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.593451023 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.593457937 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.593733072 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.593753099 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.593791008 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.593797922 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.593815088 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.593830109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.594746113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.594764948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.594831944 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.594839096 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.594876051 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.595623016 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.595643997 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.595693111 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.595700026 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.595733881 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.614195108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.614219904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.614427090 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.614453077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.614594936 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.614994049 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.615020037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.615073919 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.615082026 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.615120888 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.619196892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.619223118 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.619263887 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.619271994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.619283915 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.619311094 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.619416952 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.619436979 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.619492054 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.619499922 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.619538069 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.620039940 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.620054007 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.620111942 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.620117903 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.620152950 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.620637894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.620654106 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.620707035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.620712996 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.620748997 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.621155977 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.621175051 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.621222019 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.621228933 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.621265888 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.621720076 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.621741056 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.621803045 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.621809959 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.621851921 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.622417927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.622433901 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.622487068 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.622494936 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.622529984 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.659007072 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.659033060 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.659106016 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.659121037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.659154892 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.661792994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.661817074 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.661871910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.661880970 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.661895990 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.661920071 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.690129042 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.690155983 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.690191031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.690201998 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.690217018 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.690237999 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.707127094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.707149982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.707196951 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.707206011 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.707218885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.707242012 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.707984924 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.708003998 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.708054066 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.708061934 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.708105087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.708647966 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.708662033 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.708726883 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.708750010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.708787918 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.709125996 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.709140062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.709182978 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.709192038 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.709223986 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.710355997 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.710371971 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.710412025 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.710422039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.710444927 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.710453987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.711062908 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.711086035 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.711136103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.711146116 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.711165905 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.711196899 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.711672068 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.711694956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.711734056 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.711741924 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.711766005 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.711781979 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.712620974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.712640047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.712681055 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.712688923 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.712698936 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.712699890 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.712722063 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.712724924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.712732077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.712752104 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.712781906 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.732002020 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.732027054 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.732062101 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.732074022 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.732084036 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.732110023 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.735671997 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.735687017 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.735752106 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.735761881 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.735796928 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.736287117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.736300945 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.736346960 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.736355066 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.736385107 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.737112045 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.737158060 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.737168074 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.737174988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.737200975 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.737704992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.737723112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.737756968 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.737787962 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.737793922 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.737823009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.738285065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.738301039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.738332987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.738342047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.738358974 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.738384008 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.739034891 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.739048004 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.739085913 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.739094019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.739109993 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.739123106 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.739465952 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.739481926 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.739525080 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.739531994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.739547014 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.739567041 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.740065098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.740080118 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.740127087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.740134001 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.740142107 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.740165949 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.778961897 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.778985023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.779066086 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.779093981 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.779134035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.779572010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.779587984 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.779643059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.779652119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.779690027 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.824331045 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.824352026 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.824439049 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.824450970 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.824496031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.825073957 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.825095892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.825156927 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.825165033 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.825201988 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.825736046 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.825751066 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.825808048 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.825814962 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.825859070 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.826432943 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.826447964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.826505899 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.826513052 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.826550961 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.826881886 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.826901913 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.826955080 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.826961994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.826998949 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.827713013 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.827734947 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.827788115 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.827795982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.827831984 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.828520060 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.828541040 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.828591108 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.828598022 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.828634024 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.829185009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.829201937 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.829250097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.829267979 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.829274893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.829313040 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.829339027 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.830164909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.830179930 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.830246925 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.830255032 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.849317074 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.849339008 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.849386930 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.849395037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.849423885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.849852085 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.849864960 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.849920988 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.849930048 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.853403091 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.853425980 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.853462934 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.853471994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.853501081 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.854074955 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.854087114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.854242086 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.854249954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.854739904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.854756117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.854809046 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.854818106 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.854846001 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.855287075 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.855300903 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.855348110 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.855356932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.856007099 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.856031895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.856066942 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.856075048 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.856103897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.856679916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.856694937 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.856739998 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.856749058 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.857292891 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.857309103 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.857343912 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.857351065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.857374907 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.893254042 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.893268108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.893559933 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.893587112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.896035910 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.896060944 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.896101952 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.896112919 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.896152973 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.896754980 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.896768093 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.896825075 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.896833897 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.941721916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.941751957 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.941893101 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.941893101 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.941925049 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.942047119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.942066908 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.942099094 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.942107916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.942126989 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.942831039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.942848921 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.942879915 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.942888021 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.942914963 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.943459034 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.943475008 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.943525076 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.943533897 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.944041014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.944057941 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.944093943 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.944102049 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.944128990 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.944931984 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.944946051 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.944979906 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.944988012 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.945004940 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.945806026 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.945822954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.945858002 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.945866108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.945889950 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.946841002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.946854115 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.946899891 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.946903944 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.946913958 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.946949005 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.946976900 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.947036028 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.947041035 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.947051048 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.947076082 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.948038101 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.948057890 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.948126078 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.948133945 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.948168993 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.965961933 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.965985060 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.966137886 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.966161966 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.966207981 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.966590881 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.966604948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.966655970 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.966665030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.966711998 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.970192909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.970220089 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.970277071 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.970285892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.970323086 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.970926046 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.970948935 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.970999956 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.971009016 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.971044064 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.971504927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.971523046 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.971559048 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.971565962 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.971592903 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.971609116 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.972301006 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.972323895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.972359896 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.972366095 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.972388983 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.972409964 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.972780943 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.972796917 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.972850084 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.972857952 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.972896099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.973320007 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.973335981 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.973387957 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.973395109 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.973433018 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.973810911 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.973825932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.973886967 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.973893881 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.973931074 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.974371910 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.974386930 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.974431038 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:49.974438906 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:49.974476099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.010561943 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.010581017 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.010951042 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.010982037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.011044025 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.013219118 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.013241053 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.013298988 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.013307095 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.013346910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.013860941 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.013883114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.013956070 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.013963938 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.014005899 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.058612108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.058638096 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.058742046 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.058768988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.059017897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.059726954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.059751034 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.059910059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.059921980 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.059962988 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.060033083 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.060048103 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.060103893 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.060111046 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.060152054 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.060837984 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.060853958 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.060893059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.060899973 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.060929060 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.060946941 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.061563015 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.061578035 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.061624050 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.061630964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.061666965 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.061686039 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.062076092 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.062092066 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.062134027 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.062140942 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.062194109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.062314987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.062764883 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.062779903 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.062819004 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.062825918 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.062851906 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.062865019 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.063693047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.063707113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.063774109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.063780069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.063815117 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.064618111 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.064632893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.064680099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.064687014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.064722061 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.065462112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.065479040 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.065521955 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.065526009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.065538883 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.065582037 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.065602064 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.065637112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.065660954 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.065675974 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.083549023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.083566904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.083631039 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.083637953 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.083673954 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.087089062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.087105036 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.087162971 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.087169886 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.087203979 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.087783098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.087798119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.087856054 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.087862968 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.087898016 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.088450909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.088468075 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.088512897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.088521004 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.088558912 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.089190006 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.089204073 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.089255095 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.089262962 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.089297056 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.089891911 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.089910984 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.089962006 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.089968920 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.090004921 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.090456963 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.090468884 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.090518951 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.090526104 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.090564966 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.090765953 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.090778112 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.090827942 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.090836048 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.090871096 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.091363907 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.091378927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.091427088 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.091434956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.091470003 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.091984034 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.091999054 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.092040062 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.092068911 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.092087030 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.092101097 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.127773046 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.127789974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.127928972 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.127940893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.127986908 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.130404949 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.130419016 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.130482912 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.130490065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.130532026 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.131020069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.131036043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.131091118 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.131098032 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.131134987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.182533979 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.182549953 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.182677031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.182693005 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.182730913 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.183142900 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.183156967 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.183208942 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.183217049 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.183249950 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.184037924 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.184051991 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.184130907 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.184139967 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.184175014 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.184948921 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.184964895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.185012102 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.185029030 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.185036898 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.185065985 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.185097933 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.185935974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.185950041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.185997963 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.186006069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.186016083 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.186898947 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.186918974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.186970949 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.186980009 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.187006950 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.187736988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.187756062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.187828064 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.187835932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.187894106 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.187911034 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.187944889 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.187952042 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.187961102 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.188836098 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.188848972 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.188910961 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.188920021 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.189826965 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.189846039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.189901114 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.189909935 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.200182915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.200196028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.200282097 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.200290918 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.200989008 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.201004982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.201049089 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.201056957 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.201085091 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.204329967 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.204343081 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.204406977 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.204416037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.204929113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.204946995 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.204998016 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.205007076 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.205475092 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.205488920 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.205534935 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.205543041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.206147909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.206163883 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.206206083 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.206212044 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.206233978 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.206733942 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.206747055 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.206871986 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.206877947 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.207330942 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.207348108 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.207403898 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.207412958 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.207854986 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.207869053 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.207921028 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.207928896 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.208409071 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.208425999 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.208466053 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.208475113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.208482027 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.208875895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.208889008 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.208942890 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.208950996 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.244791031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.244816065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.244882107 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.244891882 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.247373104 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.247386932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.247437000 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.247445107 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.248074055 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.248090982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.248163939 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.248172045 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.292885065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.292898893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.292956114 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.292970896 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.292987108 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.293437004 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.293452978 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.293508053 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.293517113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.293524981 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.295320988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.295332909 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.295386076 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.295394897 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.295419931 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.296003103 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.296020985 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.296055079 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.296062946 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.296072960 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.296468973 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.296482086 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.296519041 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.296529055 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.296555042 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.297202110 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.297219992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.297249079 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.297256947 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.297274113 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.297755957 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.297770023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.297815084 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.297823906 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.298115969 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.298134089 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.298171043 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.298178911 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.298198938 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.298763037 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.298775911 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.298839092 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.298839092 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.298847914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.299458027 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.299474001 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.299501896 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.299510002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.299535036 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.299762011 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.299774885 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.299804926 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.299812078 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.299820900 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.301961899 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.301980019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.302041054 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.302051067 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.302078009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.317420006 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.317437887 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.317529917 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.317542076 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.317862988 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.317879915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.317925930 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.317936897 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.317945957 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.321360111 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.321374893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.321446896 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.321455002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.321882963 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.321901083 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.321940899 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.321949005 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.321969032 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.322401047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.322415113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.322460890 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.322467089 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.322491884 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.322802067 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.322820902 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.322861910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.322869062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.322896004 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.323290110 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.323303938 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.323344946 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.323354006 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.323379040 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.323745966 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.323765039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.323808908 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.323817015 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.323841095 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.324373007 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.324388027 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.324440002 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.324449062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.324911118 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.324928999 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.324966908 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.324975014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.324995041 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.325314999 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.325330019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.325380087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.325387955 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.325815916 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.325834036 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.325870991 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.325879097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.325889111 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.364226103 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.364243984 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.364347935 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.364357948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.364757061 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.364773989 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.364820957 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.364826918 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.364864111 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.365248919 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.365262032 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.365308046 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.365314960 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.365331888 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.410511971 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.410541058 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.410799980 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.410829067 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.410861969 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.410875082 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.410909891 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.410918951 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.410929918 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.412620068 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.412637949 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.412678003 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.412687063 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.412697077 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.413239956 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.413254023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.413295031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.413301945 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.413317919 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.413685083 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.413702011 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.413737059 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.413746119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.413754940 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.414298058 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.414309025 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.414352894 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.414360046 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.414370060 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.414715052 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.414732933 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.414769888 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.414777040 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.414787054 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.415393114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.415405989 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.415447950 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.415455103 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.415463924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.415765047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.415781975 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.415817976 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.415827990 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.415838957 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.416167974 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.416182041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.416235924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.416244984 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.416693926 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.416708946 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.416893959 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.416903019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.417124987 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.417140961 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.417182922 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.417191029 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.417205095 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.434407949 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.434429884 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.434475899 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.434485912 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.434504032 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.435003042 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.435014963 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.435055971 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.435064077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.435072899 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.438298941 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.438316107 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.438370943 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.438380003 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.438889980 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.438906908 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.438962936 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.438971043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.439522028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.439538002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.439577103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.439583063 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.439595938 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.439973116 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.439984083 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.440037012 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.440042973 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.440339088 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.440356970 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.440391064 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.440397024 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.440407038 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.440736055 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.440747976 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.440810919 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.440819025 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.441276073 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.441291094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.441328049 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.441337109 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.441345930 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.441623926 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.441636086 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.441685915 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.441693068 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.442047119 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.442060947 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.442097902 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.442105055 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.442116022 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.442462921 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.442473888 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.442524910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.442532063 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.479031086 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.479047060 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.479113102 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.479123116 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.481410027 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.481421947 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.481478930 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.481486082 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.481901884 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.481916904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.481957912 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.481964111 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.481975079 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.509907961 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.509921074 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.510050058 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.510063887 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.528101921 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.528124094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.528374910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.528403044 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.528743982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.528754950 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.528825045 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.528834105 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.530477047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.530498028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.530543089 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.530551910 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.530581951 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.531008959 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.531021118 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.531068087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.531076908 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.531090021 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.531572104 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.531594992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.531629086 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.531636000 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.531646013 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.532393932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.532407045 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.532464027 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.532470942 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.532648087 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.532668114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.532705069 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.532712936 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.532721996 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.533365965 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.533377886 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.533422947 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.533430099 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.533444881 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.533862114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.533880949 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.533924103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.533931017 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.533942938 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.534378052 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.534389973 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.534444094 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.534452915 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.534945011 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.534961939 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.534998894 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.535007000 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.535023928 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.535219908 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.535232067 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.535279989 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.535286903 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.535306931 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.535741091 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.535761118 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.535798073 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.535804987 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.535831928 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.551906109 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.551918030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.552078009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.552105904 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.552606106 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.552622080 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.552674055 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.552685022 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.552696943 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.556097031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.556108952 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.556155920 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.556163073 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.556190014 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.556596994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.556615114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.556653976 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.556660891 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.556672096 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.557296038 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.557312965 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.557363987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.557372093 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.557991982 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.558016062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.558054924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.558063030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.558073997 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.558481932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.558505058 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.558537960 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.558546066 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.558561087 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.558851957 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.558871031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.558902979 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.558909893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.558932066 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.559493065 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.559504986 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.559546947 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.559554100 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.559566021 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.559854031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.559870958 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.559911013 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.559917927 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.559928894 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.560348034 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.560359955 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.560415030 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.560422897 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.560863018 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.560880899 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.560918093 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.560925007 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.560935020 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.596105099 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.596117020 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.596311092 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.596338034 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.598628044 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.598647118 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.598690987 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.598699093 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.598710060 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.599140882 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.599153042 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.599206924 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.599215031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.599678993 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.599697113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.599731922 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.599740028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.599749088 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.644717932 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.644738913 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.644823074 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.644840002 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.645199060 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.645221949 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.645248890 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.645257950 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.645282984 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.646933079 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.646946907 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.646987915 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.646995068 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.647006035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.647284031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.647310019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.647350073 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.647356987 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.647386074 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.647881031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.647897005 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.647941113 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.647948980 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.647979021 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.648437023 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.648456097 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.648498058 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.648505926 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.648516893 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.648885012 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.648899078 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.648952007 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.648960114 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.649372101 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.649393082 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.649424076 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.649431944 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.649451017 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.649900913 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.649914980 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.649952888 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.649960041 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.649985075 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.650326014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.650346994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.650377035 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.650384903 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.650415897 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.650840998 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.650854111 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.650913954 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.650923014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.651336908 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.651356936 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.651391983 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.651401043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.651412964 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.651766062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.651779890 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.651815891 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.651823997 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.651833057 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.668587923 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.668606043 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.668665886 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.668673992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.668705940 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.669058084 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.669070959 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.669127941 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.669136047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.669538975 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.669555902 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.669589043 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.669595003 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.669612885 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.672791004 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.672804117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.672857046 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.672864914 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.672888041 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.673408985 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.673429966 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.673466921 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.673474073 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.673491001 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.673934937 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.673954010 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.674015999 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.674022913 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.674375057 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.674391031 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.674427986 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.674437046 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.674452066 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.674815893 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.674829960 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.674870968 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.674880028 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.674891949 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.675273895 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.675292015 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.675334930 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.675349951 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.675357103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.675757885 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.675770998 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.675808907 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.675817013 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.675849915 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.676203966 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.676220894 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.676255941 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.676263094 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.676280975 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.676637888 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.676651955 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.676692009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.676698923 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.676711082 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.676940918 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.676956892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.676990032 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.676997900 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.677012920 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.677339077 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.677350998 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.677390099 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.677397966 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.677411079 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.713778019 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.713794947 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.713906050 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.713917971 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.716051102 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.716062069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.716113091 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.716121912 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.716140985 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.716586113 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.716603994 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.716646910 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.716654062 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.716684103 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.761867046 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.761884928 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.761977911 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.761989117 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.772816896 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.772840977 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.773010015 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.773019075 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.773268938 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.773286104 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.773340940 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.773349047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.773885012 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.773910999 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.773947954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.773951054 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.773957968 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.773963928 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.773983002 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.774024010 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.774606943 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.774621964 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.774672985 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.774674892 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.774687052 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.774729967 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.774750948 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.774802923 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.774812937 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.774842978 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.775609970 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.775624990 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.775662899 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.775676012 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.775682926 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.775721073 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.775727034 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.775748014 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.775779009 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.775790930 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.776576996 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.776596069 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.776664019 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.776670933 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.776705027 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.777432919 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.777452946 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.777493954 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.777504921 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.777513027 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.777544022 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.777573109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.778363943 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.778377056 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.778424978 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.778429031 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.778434992 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.778470039 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.778470039 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.778526068 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.778531075 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.789994955 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.790013075 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.790059090 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.790080070 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.790087938 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.790555000 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.790575981 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.790613890 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.790621996 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.790635109 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.791019917 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.791033030 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.791070938 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.791074038 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.791084051 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.791098118 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.791106939 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.791134119 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.791140079 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.791151047 CEST	443	49767	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.791172028 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.791197062 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.791614056 CEST	49767	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.990159988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.990253925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:50.990353107 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.990582943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:50.990602970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.734683037 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.736229897 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.736289978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.873980045 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.874023914 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.874058008 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.874084949 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.874094009 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.874155045 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.874198914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.874218941 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.874253988 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.874262094 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.874279022 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.874325037 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.874336958 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.874798059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.874847889 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.874860048 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.920080900 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.993120909 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.993186951 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.993217945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.993236065 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.993268013 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.993314028 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.993371010 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.993473053 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.993516922 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.993524075 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.994108915 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.994148970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.994155884 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.994162083 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.994203091 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.994204044 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.994213104 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.994249105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.995068073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.995131016 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.995157957 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.995176077 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.995181084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.995217085 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.996205091 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.996277094 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.996305943 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.996321917 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.996326923 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:51.996364117 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:51.996370077 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.045152903 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.112226963 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.112302065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.112333059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.112365961 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.112427950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.112581968 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.112591028 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.112601995 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.112667084 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.112680912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.112720966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.112759113 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.112771034 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.114022017 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.114101887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.114111900 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.114130020 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.114161015 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.114200115 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.114200115 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.114217997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.114972115 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.115025043 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.115036011 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.115053892 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.115084887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.115096092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.115125895 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.115894079 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.115953922 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.115967035 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.116027117 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.116839886 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.116909027 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.116919994 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.116961956 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.117746115 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.117810965 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.117917061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.117973089 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.118643999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.118705988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.231677055 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.231781960 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.231842041 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.231910944 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.232027054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.232217073 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.232275963 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.232336998 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.232415915 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.232598066 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.232713938 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.232764006 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.233124971 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.233177900 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.233244896 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.233304024 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.233457088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.233525991 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.233562946 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.233577967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.233608007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.233628988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.234184027 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.234234095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.234257936 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.234273911 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.234303951 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.234322071 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.234364986 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.234421015 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.235037088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.235095024 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.235199928 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.235263109 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.235322952 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.235375881 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.235984087 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.236048937 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.236073017 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.236136913 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.236243010 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.236300945 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.236871958 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.236944914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.236973047 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.237031937 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.237054110 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.237117052 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.237744093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.237782001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.237834930 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.237850904 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.237874985 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.237874985 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.237924099 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.237936020 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.238001108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.238063097 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.238074064 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.238167048 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.238722086 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.238791943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.238823891 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.238890886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.350795984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.350924015 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.351095915 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.351104021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.351181984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.351221085 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.351238966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.351269007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.351289988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.351572037 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.351592064 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.351655960 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.351669073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.351713896 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.352076054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.352093935 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.352144003 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.352154970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.352199078 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.356507063 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.356523991 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.356586933 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.356600046 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.356647015 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.356961012 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.356973886 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.357027054 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.357038021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.357084036 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.357345104 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.357358932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.357410908 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.357422113 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.357465982 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.357758999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.357775927 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.357841015 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.357851982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.357896090 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.358148098 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.358163118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.358217955 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.358228922 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.358269930 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.358453035 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.358469009 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.358515024 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.358525991 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.358566999 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.358858109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.358872890 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.358921051 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.358933926 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.358973980 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.358994961 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.359385014 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.359399080 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.359442949 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.359455109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.359496117 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.359673023 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.359693050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.359746933 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.359759092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.359808922 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.360110998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.360130072 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.360188007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.360199928 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.360239983 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.360600948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.360615969 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.360658884 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.360671997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.360712051 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.470478058 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.470495939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.470607996 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.470669031 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.470731974 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.470781088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.470796108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.470834017 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.470848083 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.470877886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.470894098 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.471491098 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.471504927 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.471575022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.471586943 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.471631050 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.471868992 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.471883059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.471944094 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.471955061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.471997023 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.472405910 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.472424030 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.472486973 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.472498894 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.472517967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.472534895 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.472543955 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.472558975 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.472594023 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.472594023 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.472619057 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.473344088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.473356962 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.473417044 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.473428965 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.473485947 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.473939896 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.473953009 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.474008083 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.474020004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.474061012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.474133968 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.474148989 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.474185944 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.474196911 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.474225044 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.474245071 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.474894047 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.474925995 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.474958897 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.474971056 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.475002050 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.475023031 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.475547075 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.475559950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.475616932 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.475629091 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.475645065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.475660086 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.475672007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.475687981 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.475718021 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.475718021 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.475739002 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.476309061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.476320982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.476377964 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.476388931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.476430893 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.476938009 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.476949930 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.477009058 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.477020025 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.477049112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.477061987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.477071047 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.477081060 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.477113008 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.477113008 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.477134943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.477843046 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.477854013 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.477917910 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.477930069 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.477971077 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.478212118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.478224993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.478271008 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.478281975 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.478322983 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.589579105 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.589597940 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.589672089 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.589732885 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.589790106 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.590152979 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.590172052 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.590219021 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.590233088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.590262890 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.590281963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.590631962 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.590651035 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.590704918 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.590722084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.590750933 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.590770006 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.591095924 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.591116905 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.591176033 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.591187954 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.591234922 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.591492891 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.591507912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.591558933 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.591572046 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.591619968 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.592025995 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.592077017 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.592113018 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.592128992 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.592155933 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.592643976 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.592658997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.592696905 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.592722893 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.592750072 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.593065977 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.593077898 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.593127966 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.593141079 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.593173027 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.593369961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.593386889 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.593427896 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.593440056 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.593468904 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.593669891 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.593683004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.593739986 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.593754053 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.594202995 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.594214916 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.594269991 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.594281912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.594595909 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.594608068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.594641924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.594654083 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.594705105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.595139027 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.595150948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.595186949 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.595199108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.595226049 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.595735073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.595748901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.595810890 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.595824957 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.596024036 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.596035957 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.596079111 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.596092939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.596118927 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.596503019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.596518040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.596551895 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.596566916 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.596600056 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.596759081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.596771002 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.596816063 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.596827984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.638828993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.916708946 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.916731119 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.916912079 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.916969061 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.917011023 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.917051077 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.917062998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.917093039 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.917267084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.917279005 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.917336941 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.917355061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.917654037 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.917669058 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.917809963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.917810917 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.917880058 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.918107033 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.918118954 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.918246984 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.918312073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.918428898 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.918761015 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.918775082 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.918853045 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.918869019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.918946028 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.918962002 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.918976068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.919022083 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.919034958 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.919066906 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.919087887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.919773102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.919787884 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.919852972 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.919864893 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.919904947 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.919920921 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.919923067 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.919936895 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.919964075 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.919990063 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.920003891 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.920013905 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.920032024 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.920059919 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.920059919 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.920084000 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.920850039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.920867920 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.920934916 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.920936108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.920950890 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.920986891 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.921005964 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.921039104 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.921049118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.921075106 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.921099901 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.921720982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.921736956 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.921847105 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.921890974 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.921901941 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.921925068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.921930075 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.921957016 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.921984911 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.921997070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.922025919 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.922756910 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.922775984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.922852993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.922871113 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.922907114 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.923182011 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.923199892 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.923237085 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.923249006 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.923276901 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.923321962 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.923341990 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.923405886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.923405886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.923419952 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924139023 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924155951 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924196959 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.924209118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924238920 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.924453974 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924473047 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924504995 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.924516916 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924544096 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.924606085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924621105 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924657106 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.924669981 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924695969 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.924753904 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924771070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924803019 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.924814939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.924843073 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.925360918 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.925374985 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.925419092 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.925430059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.925458908 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.925641060 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.925658941 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.925707102 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.925715923 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.925744057 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.925774097 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.925787926 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.925827026 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.925837994 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.925863981 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.925961971 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.925978899 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.926009893 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.926021099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.926048040 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.926558018 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.926572084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.926606894 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.926618099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.926644087 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.926826954 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.926845074 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.926878929 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.926888943 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.926914930 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.926964998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.926978111 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.927011967 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.927023888 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.927051067 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.927155972 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.927181005 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.927213907 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.927226067 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.927251101 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.927977085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.927990913 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928028107 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.928039074 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928059101 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928065062 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.928078890 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928123951 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.928139925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928157091 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928162098 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.928172112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928210974 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.928220987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928246975 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.928286076 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928303957 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928342104 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.928353071 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.928376913 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.929181099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.929193974 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.929255009 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.929260015 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.929271936 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.929303885 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.929316044 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.929341078 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.929354906 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.929374933 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.929378986 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.929404974 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.929414034 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.929436922 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.929474115 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.930025101 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.930042028 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.930075884 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.930087090 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.930114985 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.934422016 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.934422016 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.947696924 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.947711945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.947885990 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.947897911 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.947946072 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.948329926 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.948343039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.948401928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.948412895 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.948453903 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.948913097 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.948925972 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.948982954 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.948993921 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.949032068 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.949191093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.949206114 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.949264050 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.949275970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.949327946 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.949824095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.949840069 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.949892044 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.949903965 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.949949026 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.951724052 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.951740026 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.951796055 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.951813936 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.951862097 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.952054024 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.952073097 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.952131987 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.952142954 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.952167988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.952187061 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.952423096 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.952436924 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.952486992 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.952497959 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.952544928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.952838898 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.952852964 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.952903986 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.952914000 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.952954054 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.953186035 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.953200102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.953239918 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.953249931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.953274965 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.953290939 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.953505039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.953541994 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.953566074 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.953577042 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.953604937 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.953641891 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.953937054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.953950882 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.953994989 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.954005003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.954034090 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.954047918 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.954288006 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.954302073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.954344034 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.954355001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.954379082 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.954395056 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.954679966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.954693079 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.954757929 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.954770088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.954811096 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.955142975 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.955156088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.955209017 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.955219984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.955260992 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.955833912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.955847979 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.955900908 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.955913067 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.955952883 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.956059933 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.956073046 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.956123114 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.956134081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.956172943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.956394911 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.956408978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.956459045 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.956469059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.956509113 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.956944942 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.956959009 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.957006931 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.957016945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.957056999 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.959216118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.959228992 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.959271908 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:52.959278107 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:52.959323883 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.066608906 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.066634893 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.066785097 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.066848040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.066907883 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.067394018 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.067414999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.067481995 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.067497015 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.067540884 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.067609072 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.067625046 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.067656994 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.067677021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.067707062 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.067724943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.068306923 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.068321943 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.068387032 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.068397999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.068458080 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.068655968 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.068670988 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.068739891 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.068752050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.068802118 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.069231033 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.069247961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.069309950 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.069322109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.069366932 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.071140051 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.071155071 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.071222067 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.071232080 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.071275949 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.071419954 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.071434021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.071516037 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.071527958 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.071584940 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.071985960 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.072001934 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.072065115 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.072077036 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.072109938 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.072312117 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.072333097 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.072391033 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.072402954 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.072449923 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.072743893 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.072765112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.072824955 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.072837114 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.072880030 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.073920965 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.073936939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074003935 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.074013948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074054003 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.074242115 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074260950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074305058 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.074316978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074372053 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.074496984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074517965 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074584961 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.074596882 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074645042 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.074728012 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074743986 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074804068 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.074815035 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.074862957 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.075078011 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.075093031 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.075146914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.075156927 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.075203896 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.075445890 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.075465918 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.075527906 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.075539112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.075573921 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.075582981 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.075593948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.075629950 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.075649977 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.075680971 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.075691938 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.075722933 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.075738907 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.076025009 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.076040983 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.076088905 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.076101065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.076128960 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.076148033 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.077343941 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.077368021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.077430010 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.077445984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.077478886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.077500105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.078226089 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.078243017 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.078308105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.078320980 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.078361034 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.079004049 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.079022884 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.079082012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.079098940 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.079123974 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.079143047 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.186361074 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.186422110 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.186528921 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.186598063 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.186649084 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.186649084 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.186724901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.186750889 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.186781883 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.186794996 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.186827898 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.186844110 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.187062979 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.187076092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.187139988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.187153101 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.187197924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.187613964 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.187628031 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.187680006 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.187693119 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.187737942 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.188033104 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.188050032 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.188097000 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.188107014 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.188150883 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.188601971 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.188617945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.188678980 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.188690901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.188733101 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.190392971 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.190406084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.190468073 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.190479040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.190522909 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.190859079 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.190872908 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.190929890 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.190941095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.190982103 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.191194057 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.191206932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.191255093 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.191266060 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.191306114 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.191514015 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.191536903 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.191581964 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.191593885 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.191634893 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.192092896 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.192106962 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.192166090 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.192178011 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.192219973 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.192795038 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.192811012 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.192877054 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.192887068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.192929029 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.193133116 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.193147898 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.193202972 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.193213940 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.193253040 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.193499088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.193512917 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.193558931 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.193569899 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.193610907 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.193861961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.193876028 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.193931103 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.193941116 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.193980932 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.194185019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.194197893 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.194255114 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.194266081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.194308996 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.194570065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.194585085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.194636106 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.194648027 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.194689035 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.194894075 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.194910049 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.194946051 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.194956064 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.194981098 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.194999933 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.195173025 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.195188999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.195241928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.195254087 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.195296049 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.195420980 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.195436001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.195493937 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.195507050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.195549011 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.195883989 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.195899010 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.195940971 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.195952892 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.195997000 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.197706938 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.197722912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.197782040 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.197793007 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.197834015 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.305366993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.305386066 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.305521011 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.305583954 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.305646896 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.305690050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.305704117 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.305763006 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.305777073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.305845976 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.306123972 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.306142092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.306180954 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.306195021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.306224108 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.306246996 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.306719065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.306735039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.306801081 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.306813002 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.306869030 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.307367086 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.307379961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.307425022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.307440042 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.307467937 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.307487965 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.308052063 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.308065891 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.308099985 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.308109999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.308136940 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.308152914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.308157921 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.308167934 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.308212996 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.308237076 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.308252096 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.308279037 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.308300018 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.309735060 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.309750080 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.309806108 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.309823990 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.309851885 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.309866905 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.310750961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.310765982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.310818911 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.310830116 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.310857058 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.310877085 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.311088085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.311104059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.311136007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.311146975 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.311177015 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.311194897 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.311342001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.311357021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.311403990 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.311414003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.311440945 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.311461926 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.311587095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.311599970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.311638117 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.311649084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.311678886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.311698914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.312483072 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.312496901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.312530994 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.312541962 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.312578917 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.312578917 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.312839985 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.312854052 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.312910080 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.312922001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.312948942 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.312966108 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.313241005 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.313255072 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.313302040 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.313313007 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.313342094 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.313359022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.313625097 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.313637972 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.313673019 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.313683033 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.313709021 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.313729048 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.313920021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.313935995 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.313961029 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.313971043 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.314001083 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.314016104 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.314081907 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.314112902 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.314135075 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.314146042 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.314172983 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.314193964 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.314260960 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.314276934 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.314307928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.314318895 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.314346075 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.314366102 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.314574003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.314590931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.314621925 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.314632893 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.314668894 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.314668894 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.315114975 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.315128088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.315154076 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.315165043 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.315191984 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.315212011 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.315651894 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.315665960 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.315699100 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.315710068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.315749884 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.315749884 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.315865993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.315880060 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.315917969 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.315928936 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.315956116 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.315977097 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.317662001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.317676067 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.317728043 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.317739010 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.317770958 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.317785978 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.424751997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.424768925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.424901962 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.424963951 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.425013065 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.425313950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.425326109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.425384045 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.425398111 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.425445080 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.425740004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.425751925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.425806999 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.425818920 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.425868988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.426035881 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.426048040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.426099062 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.426110029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.426152945 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.426367998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.426382065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.426424980 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.426435947 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.426476955 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.426753044 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.426765919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.426820040 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.426831007 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.426877975 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.427139044 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.427151918 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.427203894 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.427216053 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.427257061 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.428864002 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.428875923 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.428925037 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.428936005 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.428978920 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.429811954 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.429830074 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.429883957 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.429894924 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.429935932 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.430218935 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.430231094 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.430274963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.430285931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.430327892 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.430517912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.430530071 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.430576086 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.430587053 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.430630922 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.430948973 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.430963993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.431013107 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.431022882 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.431062937 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.431196928 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.431210995 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.431258917 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.431268930 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.431327105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.431813002 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.431827068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.431885958 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.431896925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.431941986 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.432224989 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.432238102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.432284117 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.432293892 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.432336092 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.432449102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.432461977 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.432502031 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.432513952 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.432543039 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.432559013 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.432816982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.432831049 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.432884932 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.432895899 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.432935953 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.433026075 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.433037043 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.433079004 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.433090925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.433120012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.433139086 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.433478117 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.433490992 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.433537006 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.433548927 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.433590889 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.433804035 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.433815956 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.433866024 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.433876038 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.433922052 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.434072018 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.434083939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.434123993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.434134007 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.434166908 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.434168100 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.434432983 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.434446096 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.434494019 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.434504986 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.434554100 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.434978008 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.434989929 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.435034990 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.435045958 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.435087919 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.435925961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.435945034 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.435987949 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.436000109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.436039925 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.436882019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.436893940 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.436942101 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.436953068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.436999083 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.543971062 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.543989897 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.544292927 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.544325113 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.544384956 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.544491053 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.544513941 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.544559956 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.544567108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.544610023 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.544956923 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.544970989 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.545068026 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.545078993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.545130968 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.545248032 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.545258999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.545314074 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.545325994 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.545372963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.545934916 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.545948029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.546005011 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.546016932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.546061993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.546271086 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.546283960 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.546329021 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.546339989 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.546385050 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.546513081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.546525955 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.546583891 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.546595097 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.546638966 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.548029900 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.548043013 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.548094034 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.548105001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.548146963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.548475981 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.548487902 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.548532963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.548544884 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.548574924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.548595905 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.549293995 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.549307108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.549357891 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.549369097 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.549410105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.549880028 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.549892902 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.549932957 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.549945116 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.549968958 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.549985886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.550218105 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.550240993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.550271988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.550282955 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.550309896 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.550324917 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.550436974 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.550447941 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.550492048 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.550503016 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.550546885 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.550820112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.550838947 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.550905943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.550916910 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.550957918 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.551192999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.551206112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.551249027 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.551261902 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.551304102 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.551695108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.551707029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.551768064 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.551779032 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.551821947 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.552088976 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.552100897 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.552150965 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.552161932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.552202940 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.552469969 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.552483082 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.552531958 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.552542925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.552582979 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.552885056 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.552898884 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.552934885 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.552944899 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.552968979 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.552989006 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.553250074 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.553262949 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.553293943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.553304911 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.553334951 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.553354979 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.553751945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.553765059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.553813934 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.553824902 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.553864956 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.553930998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.553942919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.553970098 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.553981066 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.554008007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.554027081 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.554363966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.554375887 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.554430008 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.554440975 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.554481030 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.554610014 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.554624081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.554673910 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.554683924 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.554728985 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.555022955 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.555037022 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.555080891 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.555092096 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.555140972 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.556200981 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.556212902 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.556257010 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.556268930 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.556312084 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.663356066 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.663372040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.663537979 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.663599968 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.663650036 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.663851976 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.663863897 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.664009094 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.664071083 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.664132118 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.664309978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.664330959 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.664469957 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.664531946 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.664592981 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.664654970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.664668083 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.664729118 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.664743900 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.664793015 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.664922953 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.664936066 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.664975882 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.664989948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.665029049 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.665287971 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.665301085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.665359974 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.665370941 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.665415049 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.665569067 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.665580034 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.665623903 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.665635109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.665678024 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.665921926 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.665944099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.666009903 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.666009903 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.666024923 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.666068077 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.667486906 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.667500019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.667557001 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.667567968 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.667606115 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.668483019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.668494940 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.668549061 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.668560982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.668602943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.668697119 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.668709993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.668759108 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.668768883 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.668811083 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.669168949 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.669183016 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.669230938 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.669240952 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.669285059 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.669575930 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.669588089 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.669634104 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.669644117 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.669687033 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.669825077 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.669836998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.669877052 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.669888973 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.669917107 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.669936895 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.670165062 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.670187950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.670216084 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.670228004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.670253038 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.670273066 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.670479059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.670490980 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.670550108 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.670562029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.670604944 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.670936108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.670948982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.671001911 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.671014071 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.671053886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.671545982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.671566010 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.671621084 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.671633005 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.671674013 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.671814919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.671828032 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.671865940 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.671876907 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.671900988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.671917915 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.672141075 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.672153950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.672189951 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.672200918 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.672226906 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.672243118 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.672549009 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.672559977 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.672600985 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.672611952 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.672641993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.672662020 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.672856092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.672868013 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.672915936 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.672928095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.672967911 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.673151016 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.673162937 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.673202991 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.673214912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.673253059 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.673670053 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.673681974 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.673736095 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.673747063 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.673789978 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.673969030 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.673980951 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.674024105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.674035072 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.674074888 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.674649000 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.674663067 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.674705029 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.674716949 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.674765110 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.675080061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.675102949 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.675147057 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.675158978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.675199032 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.712080002 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.712102890 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.712239027 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.712301970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.712356091 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.782654047 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.782671928 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.782881975 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.782912016 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.783020020 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.783355951 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.783370018 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.783420086 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.783427000 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.783579111 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.783659935 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.783673048 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.783719063 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.783724070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.783850908 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.784060001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.784073114 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.784117937 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.784122944 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.784236908 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.784328938 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.784349918 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.784396887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.784404039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.784507990 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.784723043 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.784737110 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.784782887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.784789085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.784889936 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.785041094 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.785057068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.785096884 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.785104036 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.785120010 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.785142899 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.785739899 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.785765886 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.785792112 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.785798073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.785819054 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.785832882 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.787130117 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.787151098 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.787201881 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.787208080 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.787281036 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.787900925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.787915945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.787962914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.787969112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.788064003 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.788163900 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.788182974 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.788225889 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.788232088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.788304090 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.788921118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.788934946 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.788985014 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.788990974 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.789066076 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.789313078 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.789328098 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.789371014 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.789377928 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.789448023 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.789942026 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.789957047 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790007114 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.790013075 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790043116 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790060997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790091991 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.790098906 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790121078 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.790214062 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.790328026 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790344000 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790386915 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.790394068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790462971 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.790678024 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790699959 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790747881 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.790754080 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790823936 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.790848970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790874004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790901899 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.790909052 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.790927887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.790942907 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.791050911 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.791064978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.791094065 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.791100979 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.791120052 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.791141033 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.791640997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.791661978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.791704893 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.791712999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.791819096 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.791935921 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.791961908 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.791985989 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.791992903 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.792009115 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.792027950 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.792164087 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.792179108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.792220116 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.792226076 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.792301893 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.792562962 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.792577982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.792617083 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.792623997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.792695999 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.793232918 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.793246984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.793298006 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.793304920 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.793378115 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.793461084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.793477058 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.793514967 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.793520927 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.793571949 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.793615103 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.793629885 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.793668985 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.793677092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.793771029 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.794194937 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.794209957 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.794250965 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.794256926 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.794328928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.794689894 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.794711113 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.794750929 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.794758081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.794830084 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.878798008 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.878820896 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.878959894 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.879030943 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.879103899 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.902518988 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.902542114 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.902595997 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.902657986 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.902704000 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.902757883 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.902771950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.902815104 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.902833939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.902858019 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.902879000 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.902968884 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.902988911 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.903033018 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.903044939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.903119087 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.903271914 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.903289080 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.903350115 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.903351068 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.903364897 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.903434992 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.903809071 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.903821945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.903856993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.903868914 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.903898954 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.903986931 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.904057980 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.904077053 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.904115915 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.904131889 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.904159069 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.904181004 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.904434919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.904449940 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.904501915 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.904515028 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.904733896 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.904736042 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.904747009 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.904798031 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.904820919 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.904836893 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.904864073 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.904885054 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.906316996 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.906331062 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.906373024 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.906383991 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.907273054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.907289028 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.907345057 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.907356977 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.907387018 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.907464027 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.907481909 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.907491922 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.907537937 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.907548904 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.907619953 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.908044100 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.908058882 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.908104897 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.908116102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.908163071 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.908586979 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.908607006 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.908663988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.908694029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.908730030 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.908761978 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.908777952 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.908792019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.908819914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.908835888 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.908863068 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.908956051 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.909379005 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.909392118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.909423113 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.909432888 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.909460068 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.909501076 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.910022974 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910037041 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910079956 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.910090923 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910141945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910159111 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910171032 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.910187006 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910211086 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.910237074 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.910237074 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.910609007 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910623074 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910659075 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.910670042 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910701990 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.910722017 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.910924911 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910938025 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.910988092 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.911005974 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.911097050 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.911098003 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.911453009 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.911468029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.911516905 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.911528111 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.911561012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.911576986 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.911674976 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.911693096 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.911731005 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.911742926 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.911770105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.911808968 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.912005901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912019968 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912060976 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.912074089 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912307978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912326097 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912357092 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.912369013 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912394047 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.912524939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912537098 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912580013 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.912592888 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912638903 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912656069 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912681103 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.912698030 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.912724972 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.913050890 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913062096 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913100004 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.913113117 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913420916 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913438082 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913464069 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.913480043 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913505077 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.913522959 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.913805962 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913817883 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913862944 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.913872957 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913950920 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913966894 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.913995028 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.914006948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.914032936 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.914052963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.950464964 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.950478077 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.950545073 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.950607061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:53.950649977 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:53.950735092 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.021452904 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.021471977 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.021610022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.021671057 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.021986008 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.022136927 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.022149086 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.022283077 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.022345066 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.022397041 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.022455931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.022469997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.022514105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.022526979 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.022680044 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.022794962 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.022814035 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.022850037 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.022862911 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.022888899 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.022907972 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.023164988 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.023179054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.023230076 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.023242950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.023356915 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.023416042 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.023436069 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.023492098 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.023503065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.023607969 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.023863077 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.023879051 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.023924112 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.023933887 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.024033070 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.024163008 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.024177074 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.024220943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.024233103 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.024303913 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.025001049 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.025022030 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.025079966 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.025090933 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.025150061 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.025680065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.025700092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.025737047 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.025748014 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.025775909 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.025796890 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.026793003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.026807070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.026858091 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.026869059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.026967049 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.027069092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.027081966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.027132988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.027143002 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.027231932 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.027352095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.027364016 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.027406931 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.027419090 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.027489901 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.028052092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.028067112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.028115034 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.028126001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.028191090 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.028307915 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.028321028 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.028362989 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.028373003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.028445959 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.028564930 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.028577089 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.028615952 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.028626919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.028655052 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.028676033 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.029719114 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.029731035 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.029787064 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.029798031 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.030131102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.030162096 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.030191898 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.030210018 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.030232906 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.030323029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.030333996 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.030384064 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.030401945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.030427933 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.030447960 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.030793905 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.030807018 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.030858040 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.030869007 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.030977964 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.031368017 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.031384945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.031434059 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.031445026 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.031514883 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.031891108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.031903982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.031955004 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.031968117 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.032031059 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.032433987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.032447100 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.032483101 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.032494068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.032521963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.032541990 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.032628059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.032643080 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.032675982 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.032689095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.032793999 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.033143044 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033159018 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033214092 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.033219099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033229113 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033262014 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.033282995 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033314943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.033324957 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033354044 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.033375978 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.033452988 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033467054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033504963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.033518076 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033576012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.033745050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033756971 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033799887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.033809900 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033838987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033855915 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033883095 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.033898115 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.033926010 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.034003973 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.034029961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.034040928 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.034080029 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.034090996 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.034168005 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.034228086 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.034240007 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.034281969 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.034292936 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.034388065 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.117660999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.117681980 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.117832899 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.117896080 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.118166924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.141942978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.141971111 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.142059088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.142062902 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.142132998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.142199039 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.142222881 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.142319918 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.142333031 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.142525911 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.142525911 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.142590046 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.142898083 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.142920971 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.142956018 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.142971992 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.143002033 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.143421888 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.143434048 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.143476009 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.143492937 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.143898010 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.143913984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.143944979 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.143961906 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.143991947 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.144736052 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.144750118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.144784927 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.144798040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.144826889 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.144980907 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.144999027 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.145031929 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.145045042 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.145072937 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.145339966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.145353079 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.145389080 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.145401001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.145426989 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.145940065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.145960093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.145987988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.145998955 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.146024942 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.146069050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.146081924 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.146107912 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.146121025 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.146146059 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.147053957 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147070885 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147108078 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.147118092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147150993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.147190094 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147201061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147238016 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.147253990 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147278070 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.147396088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147413015 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147449017 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.147464991 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147491932 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.147572994 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147586107 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147619963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.147630930 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147659063 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.147898912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147917032 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147947073 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.147958040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.147989988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.148643970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.148657084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.148696899 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.148708105 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.148734093 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.149220943 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.149239063 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.149276018 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.149286985 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.149316072 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.149472952 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.149491072 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.149544001 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.149555922 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.150377989 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.150397062 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.150427103 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.150439024 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.150465965 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.150609970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.150624037 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.150660992 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.150672913 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.150696993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.150830984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.150847912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.150891066 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.150904894 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.150928974 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.151174068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.151185989 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.151222944 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.151233912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.151797056 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.151814938 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.151844978 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.151854992 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.151879072 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.151972055 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.151983976 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.152017117 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.152029037 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.152056932 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.152461052 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.152478933 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.152509928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.152520895 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.152546883 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.152766943 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.152779102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.152812004 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.152822971 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.152853012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.153052092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153069973 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153104067 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.153115034 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153140068 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.153193951 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153207064 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153233051 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.153244972 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153270006 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.153570890 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153589010 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153620005 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.153630972 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153661966 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.153783083 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153795958 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.153831005 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.153842926 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.154000044 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.154017925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.154051065 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.154062033 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.154088020 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.201505899 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.231899023 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.231914043 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.232131004 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.232192993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.232251883 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.260771036 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.260797977 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.260880947 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.260942936 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.261051893 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.261070967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.261079073 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.261095047 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.261128902 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.261128902 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.261152029 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.261332035 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.261346102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.261395931 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.261408091 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.261495113 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.261660099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.261673927 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.261718035 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.261729956 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.261760950 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.261837006 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.261977911 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.262000084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.262058020 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.262068987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.262145042 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.262573004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.262589931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.262648106 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.262658119 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.262758017 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.263556957 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.263571978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.263618946 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.263631105 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.263725996 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.264069080 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.264084101 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.264127970 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.264137983 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.264380932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.264399052 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.264434099 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.264445066 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.264471054 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.264620066 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.264794111 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.264806986 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.264853954 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.264864922 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.265131950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.265150070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.265186071 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.265197039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.265223026 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.265244007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.265960932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.265974998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266021967 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.266032934 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266344070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266360998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266396999 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.266407967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266433001 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.266449928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.266482115 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266499043 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266537905 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.266547918 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266576052 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.266593933 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.266810894 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266825914 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266885996 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.266896963 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.266999960 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.267086029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.267107010 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.267148972 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.267159939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.267235041 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.267241955 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.267251968 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.267266989 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.267287016 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.267326117 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.267467022 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.267481089 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.267524004 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.267535925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.267658949 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.268362999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.268383026 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.268424988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.268439054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.268533945 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.268778086 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.268794060 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.268837929 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.268848896 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.268929958 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.269154072 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.269172907 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.269222021 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.269233942 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.269301891 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.269980907 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.269996881 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.270037889 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.270049095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.270144939 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.270229101 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.270245075 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.270287037 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.270298004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.270373106 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.270495892 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.270514965 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.270551920 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.270562887 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.270591974 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.270612001 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.271089077 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.271107912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.271162033 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.271173000 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.271243095 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.271403074 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.271418095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.271461964 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.271472931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.271564960 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.271822929 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.271843910 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.271889925 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.271900892 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.271969080 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.272104979 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.272120953 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.272160053 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.272171021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.272248030 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.273317099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.273333073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.273386955 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.273396969 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.273466110 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.273700953 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.273715019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.273761034 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.273772001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.273860931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.273866892 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.273875952 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.273910046 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.273933887 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.273967028 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.273977041 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.274004936 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.274133921 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.274142027 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.274147987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.274163961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.274197102 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.274214983 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.274370909 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.274394035 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.274441957 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.274452925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.274518967 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.274630070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.274657011 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.274694920 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.274703979 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.274732113 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.274753094 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.351023912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.351046085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.351272106 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.351334095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.351407051 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.380202055 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.380229950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.380331993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.380388021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.380480051 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.380500078 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.380557060 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.380558014 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.380573988 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.380625010 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.380907059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.380930901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.380989075 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.380999088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.381125927 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.381177902 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.381196976 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.381242037 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.381253004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.381328106 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.381478071 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.381498098 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.381546021 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.381556034 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.381623983 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.381766081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.381781101 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.381828070 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.381838083 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.381907940 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.382215023 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.382230043 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.382272005 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.382282019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.382399082 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.383097887 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.383114100 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.383167982 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.383177996 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.383286953 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.383481979 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.383505106 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.383536100 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.383547068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.383573055 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.383591890 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.383750916 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.383764982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.383805037 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.383815050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.383891106 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.384195089 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.384215117 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.384270906 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.384280920 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.384347916 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.384537935 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.384561062 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.384593010 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.384603024 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.384628057 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.384645939 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.385423899 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.385438919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.385487080 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.385497093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.385571957 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.385798931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.385814905 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.385860920 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.385871887 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.385941982 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.386106968 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386121988 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386162043 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.386171103 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386271954 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.386307955 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386322021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386362076 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.386370897 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386450052 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.386579990 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386595011 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386643887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.386653900 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386718988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.386881113 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386895895 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.386950016 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.386960030 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.387031078 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.387252092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.387285948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.387315989 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.387329102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.387373924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.387373924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.387784958 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.387799978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.387844086 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.387854099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.387965918 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.388058901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.388073921 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.388118029 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.388128042 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.388226032 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.388508081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.388521910 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.388576984 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.388587952 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.388654947 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.389235973 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.389256001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.389297962 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.389308929 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.389401913 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.389544964 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.389568090 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.389616966 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.389628887 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.389693022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.390306950 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.390326023 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.390367985 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.390378952 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.390408993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.390427113 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.390573978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.390594006 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.390635014 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.390645981 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.390717983 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.390944004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.390959024 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.391005993 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.391016960 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.391114950 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.391333103 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.391346931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.391387939 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.391400099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.391470909 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.391688108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.391710997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.391746044 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.391756058 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.391793013 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.391793966 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.391942978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.391957045 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.391993999 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.392004013 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.392081022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.392827988 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.392842054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.392879009 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.392889023 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.392916918 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.392932892 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.393178940 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393198967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393239975 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.393250942 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393321991 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.393460989 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393476009 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393515110 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.393526077 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393598080 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.393753052 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393774033 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393812895 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.393822908 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393893003 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.393930912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393944979 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.393980980 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.393992901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.394093037 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.427762032 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.427776098 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.428021908 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.428021908 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.428037882 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.428586960 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.475225925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.475238085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.475389004 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.475450993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.475691080 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.499484062 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.499496937 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.499666929 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.499728918 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.499771118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.499784946 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.499811888 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.499828100 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.499856949 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.499876022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.500189066 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.500200987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.500289917 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.500302076 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.500334024 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.500462055 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.500464916 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.500478029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.500519037 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.500531912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.500613928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.500839949 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.500852108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.500890970 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.500901937 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.500935078 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.500962019 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.501076937 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.501091003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.501140118 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.501157045 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.501357079 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.501491070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.501503944 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.501554012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.501570940 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.501596928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.501626015 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.502373934 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.502387047 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.502434969 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.502445936 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.502562046 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.502751112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.502763987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.502804041 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.502815008 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.502892971 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.503021002 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.503034115 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.503079891 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.503092051 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.503143072 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.503633976 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.503648043 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.503693104 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.503705025 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.503781080 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.503905058 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.503916025 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.503954887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.503966093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.503995895 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.504015923 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.504703045 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.504714966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.504762888 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.504774094 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.504803896 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.505059004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.505075932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.505122900 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.505134106 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.505167961 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.505183935 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.505291939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.505304098 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.505347013 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.505362034 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.505389929 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.505527020 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.505549908 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.505584002 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.505599976 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.505628109 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.505642891 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.505954027 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.505964994 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.506009102 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.506027937 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.506052017 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.506058931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.506074905 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.506109953 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.506125927 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.506150961 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.506190062 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.518591881 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.518613100 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.518663883 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.518682003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.518757105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.518865108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.518879890 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.518930912 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.518943071 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519196987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519215107 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519272089 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.519289970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519341946 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.519529104 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519543886 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519587040 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.519598961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519632101 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.519651890 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.519903898 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519918919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519962072 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.519977093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519994974 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.519999981 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.520014048 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.520020962 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.520030022 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.520056009 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.520091057 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.520425081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.520440102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.520483017 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.520493031 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.520524025 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.520539045 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.520704985 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.520720005 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.520766973 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.520777941 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.520803928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.520965099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.520982981 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.521020889 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.521030903 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.521058083 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.521081924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.521095991 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.521110058 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.521147013 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.521158934 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.521188021 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.521203041 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.525427103 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.525444984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.525504112 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.525522947 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.525578022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.525787115 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.525799036 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.525862932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.525896072 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.525908947 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.525943041 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.525969028 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.526207924 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526218891 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526257992 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.526268959 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526298046 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.526494026 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526509047 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526546001 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.526557922 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526583910 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.526796103 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526810884 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526854038 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.526865959 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526885986 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526891947 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.526902914 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526938915 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.526956081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.526983023 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.527056932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.527067900 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.527096987 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.527107954 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.527132034 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.527323008 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.527335882 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.527369022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.527383089 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.527410030 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.576304913 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.601352930 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.601372004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.601479053 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.601495981 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.601778984 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.618976116 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619007111 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619051933 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.619069099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619102001 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.619117022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.619254112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619275093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619343042 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.619354963 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619424105 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.619503021 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619517088 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619560957 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.619574070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619649887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.619752884 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619766951 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619821072 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.619832039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.619899035 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.620157003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.620172024 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.620213032 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.620224953 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.620250940 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.620271921 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.620527029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.620546103 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.620595932 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.620606899 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.620686054 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.620738983 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.620753050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.620795012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.620805025 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.620878935 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.621263027 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.621274948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.621329069 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.621339083 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.621433973 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.622034073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622047901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622093916 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.622103930 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622176886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.622306108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622318983 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622361898 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.622371912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622447968 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.622586012 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622605085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622654915 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.622665882 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622731924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.622891903 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622905016 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.622946978 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.622958899 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.623075962 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.623215914 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.623229980 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.623275042 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.623289108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.623785973 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.623804092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.623836994 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.623847961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.623874903 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.624520063 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.624532938 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.624577999 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.624588966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.624905109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.624923944 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.624963045 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.624977112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625019073 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.625130892 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625147104 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625201941 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.625214100 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625422955 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625442982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625474930 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.625490904 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625514984 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.625535011 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.625677109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625699997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625735044 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.625746012 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625771999 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.625787973 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.625865936 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625880003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.625924110 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.625933886 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.626590014 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.626952887 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.626974106 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.627023935 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.627026081 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.627034903 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.627079010 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.627104998 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.627104998 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.627120972 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.627147913 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.627168894 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.627895117 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.627908945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.627950907 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.627960920 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.628397942 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.628416061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.628456116 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.628472090 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.628499985 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.628725052 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.628736973 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.628779888 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.628792048 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.628998041 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629021883 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629053116 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.629065990 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629091978 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.629112959 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.629301071 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629316092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629349947 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.629364967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629389048 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.629405975 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.629522085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629540920 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629585028 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.629595041 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629872084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629888058 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629919052 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.629930019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.629956961 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.629976988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.630067110 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.630080938 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.630117893 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.630129099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.630155087 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.630175114 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.630321026 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.630335093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.630376101 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.630387068 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.630640984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.630656004 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.630687952 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.630698919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.630726099 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.630745888 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.630954981 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.630976915 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.631020069 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.631031990 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.632597923 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.642210007 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642236948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642332077 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.642348051 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642636061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642658949 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642695904 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.642707109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642734051 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.642752886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.642868996 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642888069 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642918110 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.642932892 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642951965 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642956972 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.642973900 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.642976999 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.642986059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.643018007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.643018007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.643042088 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.643341064 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.643353939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.643405914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.643416882 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.643446922 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.643767118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.643784046 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.643815994 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.643827915 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.643856049 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.643872976 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.645952940 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.708597898 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.708616972 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.708725929 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.708745956 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.708940029 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.720490932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.720510006 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.720674992 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.720736980 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.720794916 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.737961054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.737978935 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.738133907 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.738194942 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.738245010 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.738501072 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.738512993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.738557100 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.738569975 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.738646030 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.738780975 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.738802910 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.738863945 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.738877058 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739018917 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.739026070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739037037 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739087105 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739109039 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.739125967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739152908 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.739172935 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.739248037 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739265919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739308119 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.739320040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739392042 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.739546061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739567041 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739614964 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.739625931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739690065 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.739823103 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739837885 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739878893 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.739888906 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.739999056 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.740868092 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.740884066 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.740935087 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.740946054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.741056919 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.741493940 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.741508007 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.741552114 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.741563082 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.741672039 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.741797924 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.741811037 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.741853952 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.741863966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.741938114 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.742058039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.742072105 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.742121935 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.742132902 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.742196083 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.742316008 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.742328882 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.742372036 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.742382050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.742450953 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.742647886 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.742661953 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.742713928 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.742724895 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.742789984 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.743463039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.743477106 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.743542910 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.743552923 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.743601084 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.744209051 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.744229078 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.744272947 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.744282961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.744385004 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.744594097 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.744607925 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.744651079 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.744661093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.744735956 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.744764090 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.744776964 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.744817972 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.744828939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.744901896 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.745007038 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745023012 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745064974 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.745074987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745147943 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.745259047 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745273113 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745317936 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.745330095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745423079 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.745448112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745461941 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745491982 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.745501995 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745529890 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.745552063 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.745731115 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745744944 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745786905 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.745799065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.745915890 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.746184111 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.746196985 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.746244907 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.746257067 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.746361017 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.747019053 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.747034073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.747076988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.747088909 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.747157097 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.747402906 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.747417927 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.747454882 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.747463942 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.747493982 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.747514009 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.747845888 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.747859001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.747908115 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.747917891 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.747982025 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.748055935 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748069048 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748135090 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.748147011 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748172998 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.748188972 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.748317003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748331070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748373985 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.748385906 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748486042 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.748569012 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748581886 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748625040 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.748636007 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748702049 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.748836040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748847961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748884916 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.748889923 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.748965025 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.749123096 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.749140978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.749182940 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.749187946 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.749258995 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.749337912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.749351978 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.749392033 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.749397993 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.749492884 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.749557972 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.749572039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.749608040 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.749614000 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.749627113 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.749646902 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.749998093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.750010967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.750051975 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.750056982 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.750132084 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.750294924 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.750308037 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.750346899 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.750353098 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.750420094 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.761337042 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.761348963 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.761400938 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.761405945 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.761590004 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.761678934 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.761692047 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.761734962 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.761740923 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.761816025 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.761956930 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.761970043 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762012959 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.762018919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762089014 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.762171984 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762187958 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762228012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.762233019 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762247086 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.762265921 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.762545109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762559891 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762598991 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.762603998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762715101 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.762800932 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762814999 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762856007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.762861967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.762932062 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.785485029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.785499096 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.785610914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.785640955 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.785777092 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.829171896 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.829186916 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.829360962 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.829371929 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.829416990 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.858390093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.858407974 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.858557940 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.858587980 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.858764887 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.858916044 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.858935118 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.858980894 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.858987093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.859047890 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.859606981 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.859627962 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.859668016 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.859674931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.859697104 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.859716892 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.859977961 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.859994888 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.860042095 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.860047102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.860146046 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.860476971 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.860490084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.860537052 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.860543013 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.860594988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.860747099 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.860763073 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.860797882 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.860804081 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.860845089 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.860863924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.861299992 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.861314058 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.861361980 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.861367941 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.861453056 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.861638069 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.861653090 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.861700058 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.861706018 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.861783981 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.862588882 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.862605095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.862653971 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.862659931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.862679005 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.862694979 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.863106966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.863121033 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.863162041 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.863167048 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.863773108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.863790989 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.863821030 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.863826990 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.863841057 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.863869905 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.863934994 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.863946915 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.863976955 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.863982916 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.863996029 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.864017963 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.864458084 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.864470959 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.864507914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.864511967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.864536047 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.864550114 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.864933968 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.864953041 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.864999056 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.865005016 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.865154028 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.865420103 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.865434885 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.865468979 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.865474939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.865499020 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.865515947 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.865902901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.865916967 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.865935087 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.865969896 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.865974903 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.866064072 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.866461039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.866477966 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.866509914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.866516113 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.866528988 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.866569996 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.866802931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.866823912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.866868019 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.866873980 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.866918087 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.867082119 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.867098093 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.867139101 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.867145061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.867167950 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.867181063 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.867446899 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.867463112 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.867517948 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.867523909 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.867635012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.867924929 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.867939949 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.867985964 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.867991924 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.868124008 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.868273973 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.868288040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.868330002 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.868335962 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.868422985 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.868443012 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.868457079 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.868495941 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.868500948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.868521929 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.868541002 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.868653059 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.869463921 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.869479895 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.869523048 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.869532108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.869622946 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.869730949 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.869745970 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.869787931 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.869793892 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.869915009 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.870058060 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.870074987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.870112896 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.870119095 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.870156050 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.870358944 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.870374918 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.870417118 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.870423079 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.870565891 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.870656013 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.870671034 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.870713949 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.870721102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.870768070 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.871155977 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.871170998 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.871212959 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.871218920 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.871294022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.871355057 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.871367931 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.871398926 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.871403933 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.871428967 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.871448994 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.871659040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.871674061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.871700048 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.871706963 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.871730089 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.871752024 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.872014046 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.872030020 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.872071981 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.872076988 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.872123957 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.872313976 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.872333050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.872365952 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.872371912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.872400045 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.872410059 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.872694969 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.872709990 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.872755051 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.872760057 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.872874022 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.873239040 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.873254061 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.873326063 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.873331070 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.873354912 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.873387098 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.873405933 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.873420000 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.873451948 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.873457909 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.873481989 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.873493910 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.881550074 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.881562948 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.881617069 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.881622076 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.881638050 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.881658077 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.882169008 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.882180929 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.882219076 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.882225037 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.882241011 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.882258892 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.882524014 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.882536888 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.882581949 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.882586956 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.882800102 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.882817030 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.882847071 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.882853031 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.882867098 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.882889986 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.883265972 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.883279085 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.883321047 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.883326054 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.883627892 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.883642912 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.883673906 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.883681059 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.883698940 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.883714914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.905210018 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.905221939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.905339003 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.905339003 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.905369997 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.905416012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.948254108 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.948270082 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.948321104 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.948352098 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.948373079 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.948390007 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.976429939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.976459026 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.976589918 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.976619959 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.976999998 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.977179050 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.977209091 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.977229118 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.977237940 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.977255106 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.977269888 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.977669001 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.977683067 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.977722883 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.977729082 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.977746964 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.977761030 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.978205919 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.978224039 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.978255033 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.978262901 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.978277922 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.978291035 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.978698969 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.978715897 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.978750944 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.978756905 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.978773117 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.978785992 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.979197025 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.979219913 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.979258060 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.979263067 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.979748964 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.979768038 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.979794025 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.979799986 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.979820013 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.979835987 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.980372906 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.980390072 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.980422974 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.980427980 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.980457067 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.980884075 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.980901003 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.980912924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.980916977 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.980930090 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.980957031 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.981295109 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.981316090 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.981344938 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.981350899 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.981364012 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.981376886 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.981754065 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.981766939 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.981797934 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.981801987 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.981818914 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.981833935 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.982232094 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.982250929 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.982280016 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.982285023 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.982305050 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.982317924 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.982465029 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.982496977 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.982530117 CEST	443	49768	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:54.982531071 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.982563972 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:54.982918978 CEST	49768	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:55.196660042 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:55.196743011 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:55.196846008 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:55.197068930 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:55.197110891 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:55.942240000 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:55.943892002 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:55.943950891 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.080106974 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.080153942 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.080183983 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.080218077 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.080251932 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.080256939 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.080296993 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.080329895 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.080346107 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.080385923 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.080394983 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.080432892 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.080780983 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.081053019 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.082734108 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.082798004 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.123328924 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.199103117 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.199191093 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.199228048 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.199383020 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.199449062 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.199523926 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.199820995 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.199949980 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.199989080 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.200027943 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.200103998 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.200155020 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.200155020 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.200155020 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.200233936 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.200294018 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.200911999 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.200958967 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.200994015 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.201019049 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.201042891 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.201067924 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.201716900 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.201761007 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.201808929 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.201837063 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.201853991 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.201877117 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.241219044 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.242681980 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.242742062 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.295114040 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.319349051 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.319443941 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.319492102 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.319540024 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.319576025 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.319581985 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.319628954 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.319663048 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.319695950 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.319736004 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.319747925 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.319762945 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.319789886 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.319814920 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.319883108 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.319895983 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.320425034 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.320470095 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.320483923 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.320502043 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.320525885 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.320538044 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.320574045 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.320585012 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.320631027 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.321357965 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.321430922 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.321435928 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.321449995 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.321490049 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.321511030 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.322307110 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.322367907 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.322429895 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.322478056 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.322484016 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.322494984 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.322530031 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.360217094 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.360291004 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.360328913 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.360347033 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.360374928 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.404426098 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.437441111 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.437463999 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.437506914 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.437546015 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.437585115 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.437589884 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.437602997 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.437616110 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.437627077 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.437642097 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.437880993 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.437922955 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.437937975 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.437977076 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.438236952 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.438282013 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.438292980 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.438335896 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.438348055 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.438386917 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.439017057 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.439066887 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.439091921 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.439138889 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.439197063 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.439235926 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.439240932 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.439261913 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.439343929 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.440028906 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.440069914 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.440078020 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.440092087 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.440112114 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.440148115 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.440182924 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.440190077 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.440227032 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.440913916 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.440957069 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.440958977 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.440972090 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.440996885 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.441020012 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.441083908 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.441127062 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.441132069 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.441144943 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.441173077 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.441189051 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.441927910 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.441983938 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.442035913 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.442075014 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.442078114 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.442090988 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.442110062 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.442831993 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.442884922 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.442890882 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.442903996 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.442933083 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.442946911 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.442986012 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.442996025 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.443027973 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.480559111 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.480667114 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.480727911 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.480745077 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.480745077 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.480772018 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.480811119 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.480858088 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.480858088 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.480906963 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.556483030 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.556757927 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.556817055 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.556869984 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.557023048 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.557024002 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.557087898 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.557151079 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.557393074 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.557401896 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.557583094 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.557646036 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.557713985 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.557997942 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.558020115 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.558064938 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.558085918 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.558111906 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.558504105 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.558528900 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.558567047 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.558584929 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.558609009 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.558629036 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.563076019 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.563107967 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.563150883 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.563163042 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.563193083 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.563637018 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.563666105 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.563811064 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.563811064 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.563874960 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.563927889 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.564238071 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.564261913 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.564414024 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.564414978 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.564477921 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.564851999 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.564879894 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.564919949 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.564944029 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.564970970 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.565633059 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.565669060 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.565711975 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.565731049 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.565772057 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.565903902 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.565932989 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.565973997 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.565987110 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.566015959 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.566593885 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.566777945 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.566802979 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.566843033 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.566859007 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.566881895 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.567378998 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.567405939 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.567441940 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.567459106 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.567481995 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.570593119 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.599251032 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.599280119 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.599467039 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.599467039 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.599533081 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.599566936 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.599596977 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.599651098 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.599651098 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.599684000 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.599739075 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.676064968 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.676090002 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.676225901 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.676289082 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.676353931 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.676501036 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.676527977 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.676573038 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.676594019 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.676620007 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.676665068 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.677051067 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.677073002 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.677117109 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.677129030 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.677155018 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.677618980 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.677644014 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.677681923 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.677699089 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.677722931 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.678100109 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.678118944 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.678162098 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.678174973 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.678203106 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.678488016 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.678513050 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.678550959 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.678563118 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.678589106 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.678606987 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.678952932 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.678973913 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.679022074 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.679037094 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.679059982 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.679476976 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.679497957 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.679542065 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.679557085 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.679580927 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.679970980 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.679996014 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.680032969 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.680054903 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.680080891 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.681050062 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.681073904 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.681117058 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.681133032 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.681157112 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.681572914 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.681591034 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.681634903 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.681648016 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.681674004 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.681998968 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.682022095 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.682063103 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.682074070 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.682102919 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.682379007 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.682399035 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.682440996 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.682452917 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.682481050 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.682605028 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.682759047 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.682777882 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.682820082 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.682837009 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.682861090 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.683170080 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.683192968 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.683232069 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.683248043 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.683271885 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.683532953 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.683552027 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.683597088 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.683609009 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.683634996 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.683959007 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.683981895 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.684024096 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.684041023 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.684063911 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.684357882 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.684377909 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.684425116 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.684437037 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.684463978 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.690248966 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.690269947 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.690428019 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.690428972 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.690453053 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.690500021 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.690534115 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.690551043 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.690551043 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.690574884 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.690603018 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.690624952 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.717881918 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.717910051 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.718054056 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.718092918 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.718157053 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.718297005 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.718316078 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.718352079 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.718367100 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.718394995 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.718580961 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.794867992 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.794902086 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.795145988 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.795167923 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.795228004 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.795469999 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.795492887 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.795546055 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.795557976 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.795586109 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.795607090 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.795937061 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.795955896 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.796041965 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.796053886 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.796103001 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.796508074 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.796530008 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.796578884 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.796590090 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.796613932 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.796632051 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.797044992 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.797065020 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.797110081 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.797121048 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.797144890 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.797171116 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.797602892 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.797626019 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.797687054 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.797687054 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.797702074 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.797741890 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.798036098 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.798058033 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.798095942 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.798113108 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.798135996 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.798152924 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.798499107 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.798520088 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.798563957 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.798576117 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.798600912 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.798616886 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.799012899 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.799035072 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.799077988 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.799088955 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.799114943 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.799132109 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.799535036 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.799565077 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.799602985 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.799614906 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.799642086 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.799659014 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.800084114 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.800108910 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.800153017 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.800163984 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.800190926 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.800209045 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.800632954 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.800654888 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.800698996 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.800709963 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.800735950 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.800753117 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.801013947 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.801034927 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.801079035 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.801090002 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.801116943 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.801134109 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.801444054 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.801464081 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.801506996 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.801517963 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.801542997 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.801559925 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.802004099 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.802026987 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.802067995 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.802078962 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.802103043 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.802139997 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.802417994 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.802439928 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.802479982 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.802490950 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.802515030 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.802535057 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.802855968 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.802897930 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.802931070 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.802942038 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.802967072 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.802985907 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.803250074 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.803272009 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.803311110 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.803340912 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.803366899 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.803388119 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.803642988 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.803663015 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.803705931 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.803716898 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.803744078 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.803761005 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.805234909 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.805258989 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.805311918 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.805329084 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.805351019 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.805366993 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.805542946 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.805565119 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.805604935 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.805615902 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.805639982 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.805655956 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.805862904 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.805883884 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.805927038 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.805938005 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.805964947 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.805982113 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.837251902 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.837279081 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.837430954 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.837450027 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.837516069 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.837675095 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.837694883 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.837747097 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.837759018 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.837783098 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.837800980 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.914484978 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.914520025 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.914688110 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.914707899 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.914774895 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.915057898 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.915079117 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.915147066 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.915163994 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.915213108 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.915672064 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.915695906 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.915739059 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.915750980 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.915780067 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.915801048 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.916193962 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.916214943 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.916259050 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.916270018 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.916294098 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.916312933 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.916764975 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.916785955 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.916840076 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.916851044 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.916877031 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.916897058 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.917268038 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.917288065 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.917330980 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.917341948 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.917366982 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.917382956 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.917706966 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.917726994 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.917771101 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.917781115 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.917807102 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.917824030 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.918231964 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.918251991 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.918292999 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.918303013 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.918328047 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.918375015 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.918791056 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.918809891 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.918883085 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.918905020 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.918929100 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.918955088 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.919282913 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.919301987 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.919357061 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.919368982 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.919394970 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.919414997 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.919912100 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.919931889 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.919984102 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.919994116 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.920027971 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.920047045 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.920340061 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.920361042 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.920401096 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.920412064 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.920435905 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.920454979 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.920825005 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.920844078 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.920890093 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.920901060 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.920924902 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.920942068 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.921329975 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.921350956 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.921401978 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.921411991 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.921437025 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.921457052 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.921783924 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.921806097 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.921855927 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.921873093 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.921907902 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.921926022 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.922137976 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.922174931 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.922226906 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.922238111 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.922264099 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.922280073 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.922544003 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.922564983 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.922693014 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.922704935 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.922760963 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.922933102 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.922951937 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.922995090 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.923006058 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.923031092 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.923051119 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.923275948 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.923295975 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.923338890 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.923350096 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.923377037 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.923396111 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.923686028 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.923706055 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.923749924 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.923760891 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.923784971 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.923804998 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.924228907 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.924247980 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.924293041 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.924303055 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.924329042 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.924345016 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.924859047 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.924880981 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.924926996 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.924937963 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.924962044 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.924982071 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.956338882 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.956373930 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.956526041 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.956526041 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.956589937 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.956634998 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.956650972 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.956664085 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.956676006 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.956712961 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.956712961 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.957473993 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.957496881 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.957639933 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.957639933 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:56.957703114 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:56.957756996 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.034107924 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.034142971 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.034297943 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.034298897 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.034363985 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.034418106 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.034444094 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.034445047 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.034457922 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.034545898 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.034568071 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.034881115 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.034909010 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.035089016 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.035089970 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.035154104 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.035203934 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.035602093 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.035621881 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.035661936 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.035681963 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.035706997 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.035732031 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.036237955 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.036257029 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.036298037 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.036309958 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.036334991 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.036351919 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.036875010 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.036910057 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.036948919 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.036961079 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.036988974 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.037005901 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.037400961 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.037429094 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.037468910 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.037489891 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.037513971 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.037532091 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.037898064 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.037926912 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.037964106 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.037974119 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.038002014 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.038027048 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.038320065 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.038340092 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.038381100 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.038407087 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.038429022 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.038446903 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.038692951 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.038714886 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.038749933 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.038759947 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.038784981 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.038805008 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.039087057 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.039113998 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.039159060 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.039179087 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.039202929 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.039223909 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.039480925 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.039501905 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.039540052 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.039551973 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.039578915 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.039602995 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.040986061 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.041006088 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.041050911 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.041062117 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.041089058 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.041110039 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.042253017 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.042274952 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.042310953 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.042320967 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.042351007 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.042371035 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.042834044 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.042854071 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.042890072 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.042907000 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.042931080 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.042960882 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.043262005 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.043282032 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.043334961 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.043353081 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.043382883 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.043404102 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.043843985 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.043868065 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.043912888 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.043922901 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.043950081 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.043971062 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.044291019 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.044311047 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.044347048 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.044358015 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.044387102 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.044404030 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.044609070 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.044629097 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.044670105 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.044680119 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.044707060 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.044725895 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.045178890 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.045203924 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.045238018 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.045248985 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.045267105 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.045288086 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.045567036 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.045595884 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.045628071 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.045639992 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.045666933 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.045686960 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.046000957 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.046025991 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.046058893 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.046071053 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.046102047 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.046120882 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.046428919 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.046458006 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.046478987 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.046506882 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.046519995 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.046561956 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.077423096 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.077455044 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.077545881 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.077589989 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.077626944 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.077627897 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.077627897 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.077694893 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.077749968 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.078006029 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.078025103 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.078206062 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.078207016 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.078274012 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.123192072 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.154007912 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.154045105 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.154392004 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.154454947 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.154540062 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.154745102 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.154777050 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.154836893 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.154859066 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.154886961 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.154908895 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.155525923 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.155546904 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.155724049 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.155724049 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.155791044 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.155857086 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.156002045 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.156021118 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.156065941 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.156085968 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.156111956 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.156131029 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.156461954 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.156486988 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.156531096 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.156543016 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.156574011 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.156590939 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.157001019 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.157021999 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.157068968 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.157079935 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.157109022 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.157126904 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.157444000 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.157464981 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.157505989 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.157516956 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.157546043 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.157565117 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.157947063 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.157968998 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.158018112 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.158027887 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.158056974 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.158073902 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.158765078 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.158787966 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.158837080 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.158847094 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.158874989 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.158893108 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.159265995 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.159292936 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.159336090 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.159348011 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.159377098 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.159394979 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.159720898 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.159742117 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.159785986 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.159796953 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.159822941 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.159840107 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.160211086 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.160239935 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.160283089 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.160299063 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.160322905 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.160342932 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.160708904 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.160728931 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.160773039 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.160784006 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.160816908 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.160836935 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.161207914 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.161228895 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.161272049 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.161283016 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.161309004 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.161329985 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.161540031 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.161562920 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.161607981 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.161618948 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.161645889 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.161664963 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.162259102 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.162278891 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.162332058 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.162344933 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.162391901 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.162636042 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.162657022 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.162695885 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.162708998 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.162735939 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.162751913 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.163062096 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.163083076 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.163139105 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.163152933 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.163203001 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.163527966 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.163548946 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.163598061 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.163614988 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.163640022 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.163656950 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.163949013 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.163976908 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.164016008 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.164026976 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.164060116 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.164060116 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.164407015 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.164433956 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.164479017 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.164489985 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.164518118 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.164535999 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.164720058 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.164745092 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.164783955 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.164793968 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.164819956 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.164836884 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.165389061 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.165410995 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.165455103 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.165466070 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.165493965 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.165512085 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.165931940 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.165951967 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.165997028 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.166007042 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.166035891 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.166052103 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.195406914 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.195445061 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.195514917 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.195559978 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.195596933 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.195621014 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.195913076 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.195950031 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.195981026 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.195992947 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.196022987 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.196043015 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.197024107 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.197052956 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.197091103 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.197103977 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.197135925 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.197155952 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.272821903 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.272851944 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.273031950 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.273093939 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.273330927 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.273356915 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.273382902 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.273451090 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.273500919 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.273500919 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.273500919 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.273994923 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.274013042 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.274178028 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.274240017 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.274307966 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.274529934 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.274549007 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.274713039 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.274713039 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.274777889 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.274832010 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.275302887 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.275338888 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.275387049 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.275408983 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.275434017 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.275454044 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.275867939 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.275888920 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.275933027 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.275943995 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.275970936 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.275998116 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.276268959 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.276288986 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.276335955 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.276346922 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.276374102 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.276391029 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.276727915 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.276750088 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.276797056 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.276808023 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.276833057 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.276853085 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.277168989 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.277194023 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.277239084 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.277250051 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.277273893 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.277293921 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.277730942 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.277750015 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.277806044 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.277818918 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.277868986 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.278100014 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.278120041 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.278162956 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.278178930 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.278207064 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.278233051 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.278578997 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.278599024 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.278641939 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.278652906 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.278677940 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.278697014 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.279093981 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.279124022 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.279169083 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.279185057 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.279207945 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.279233932 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.279519081 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.279541969 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.279584885 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.279596090 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.279623985 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.279644966 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.280056953 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.280081987 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.280139923 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.280153990 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.280204058 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.280805111 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.280829906 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.280870914 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.280881882 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.280914068 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.280914068 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.281192064 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.281212091 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.281253099 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.281264067 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.281290054 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.281311989 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.281847000 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.281866074 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.281909943 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.281920910 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.281946898 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.281965971 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.282629013 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.282655954 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.282700062 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.282711983 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.282738924 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.282763958 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.283123016 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.283143997 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.283186913 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.283198118 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.283222914 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.283240080 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.283587933 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.283608913 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.283653021 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.283665895 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.283689022 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.283715963 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.283967972 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.283991098 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.284049034 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.284064054 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.284089088 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.284113884 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.284326077 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.284348011 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.284389019 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.284399033 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.284425974 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.284445047 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.284842968 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.284862995 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.284903049 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.284914017 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.284940958 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.284957886 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.285258055 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.285279989 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.285322905 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.285332918 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.285360098 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.285386086 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.285640955 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.285662889 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.285701990 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.285713911 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.285738945 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.285758018 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.314728022 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.314759016 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.314954996 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.314954996 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.315018892 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.315082073 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.315136909 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.315174103 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.315215111 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.315228939 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.315257072 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.315259933 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.315278053 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.315287113 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.315305948 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.315388918 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.315388918 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.315388918 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.391294956 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.391341925 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.391469955 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.391558886 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.391695023 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.391896009 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.391923904 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.391967058 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.391987085 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.392016888 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.392035961 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.392298937 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.392318964 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.392359972 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.392370939 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.392398119 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.392419100 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.392913103 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.392934084 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.392980099 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.392992020 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.393018007 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.393035889 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.393455029 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.393481016 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.393527031 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.393537998 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.393568039 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.393584967 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.394007921 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.394027948 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.394094944 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.394108057 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.394134998 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.394160986 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.394578934 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.394610882 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.394649982 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.394660950 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.394686937 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.394706964 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.395045996 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.395067930 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.395111084 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.395122051 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.395150900 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.395176888 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.395458937 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.395482063 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.395523071 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.395534039 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.395562887 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.395582914 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.395777941 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.396063089 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.396087885 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.396136999 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.396148920 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.396176100 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.396195889 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.396393061 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.396452904 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.396473885 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.396519899 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.396568060 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.396569014 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.396617889 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.396815062 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.396841049 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.396878004 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.396889925 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.396915913 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.396933079 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397108078 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397131920 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397166014 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397176981 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397203922 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397217989 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397223949 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397243023 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397269011 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397306919 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397324085 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397350073 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397356033 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397363901 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397404909 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397418022 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397439957 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397463083 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397480965 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397481918 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397505045 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397537947 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397538900 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397537947 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397557020 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397562027 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397574902 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397603035 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397635937 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397670984 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397691965 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397735119 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397752047 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397774935 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397793055 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397799015 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397809029 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397834063 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397857904 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397878885 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397893906 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.397922993 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.397943974 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.398053885 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.398072958 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.398137093 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.398149014 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.398215055 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.398490906 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.398514986 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.398555994 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.398566961 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.398593903 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.398619890 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.398847103 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.398874044 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.398911953 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.398924112 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.398951054 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.398972034 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.398999929 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.399034023 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.399075985 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.399086952 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.399115086 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.399141073 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.399216890 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.399243116 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.399286985 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.399333000 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.399360895 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.399384022 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.401312113 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.401331902 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.401372910 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.401385069 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.401411057 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.401431084 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.401498079 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.401519060 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.401568890 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.401585102 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.401611090 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.401631117 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.401694059 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.401715040 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.401788950 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.401801109 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.401850939 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.433516026 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.433549881 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.433696032 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.433696032 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.433703899 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.433748960 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.434142113 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.434168100 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.434210062 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.434216976 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.434245110 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.434258938 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.434545994 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.434570074 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.434611082 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.434617043 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.434636116 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.434659004 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.510687113 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.510713100 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.510926962 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.510942936 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.511002064 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.511322975 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.511346102 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.511394978 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.511405945 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.511434078 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.511451960 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.511898994 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.511918068 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.511960983 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.511971951 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.511998892 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.512018919 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.512494087 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.512512922 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.512579918 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.512590885 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.512643099 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.513029099 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.513048887 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.513107061 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.513123989 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.513176918 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.513576984 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.513597965 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.513638973 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.513649940 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.513676882 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.513695955 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.513978958 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.514000893 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.514045000 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.514055967 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.514081955 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.514101028 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.514522076 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.514544964 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.514588118 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.514602900 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.514630079 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.514650106 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.515072107 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.515091896 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.515135050 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.515146017 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.515173912 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.515192986 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.515490055 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.515510082 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.515552044 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.515563011 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.515588999 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.515640974 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.515912056 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.515934944 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.515980005 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.516012907 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.516041040 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.516062021 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.516330957 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.516351938 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.516410112 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.516421080 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.516448021 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.516483068 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.516840935 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.516864061 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.516916037 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.516932964 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.516957045 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.516976118 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517278910 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517306089 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517349005 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517359972 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517385960 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517404079 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517410040 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517421961 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517446041 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517462015 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517482996 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517492056 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517522097 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517540932 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517574072 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517601967 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517640114 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517649889 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517676115 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517688990 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517694950 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517705917 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517735004 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517759085 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517802954 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517802954 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517815113 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517833948 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517863035 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517868042 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517880917 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517893076 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517932892 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.517960072 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.517978907 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518013954 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518029928 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518053055 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518054962 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518075943 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518079996 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518093109 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518114090 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518152952 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518171072 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518196106 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518249989 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518249989 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518264055 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518282890 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518292904 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518309116 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518311977 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518326998 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518342018 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518385887 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518414021 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518430948 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518434048 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518475056 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518491030 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518513918 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518553019 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518591881 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518627882 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518646955 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518666983 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518687963 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518712997 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518760920 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518785954 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518800974 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518804073 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518827915 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518836975 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518847942 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.518896103 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518896103 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.518949032 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.519040108 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.520720959 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.520739079 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.520786047 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.520802021 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.520843029 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.520843029 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.520869970 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.520889044 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.520939112 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.520951033 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.520976067 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.520992994 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.552228928 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.552254915 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.552495956 CEST	49769	443	192.168.2.4	104.16.149.130
Oct 22, 2024 09:45:57.552526951 CEST	443	49769	104.16.149.130	192.168.2.4
Oct 22, 2024 09:45:57.552721977 CEST	49769	443	192.168.2.4	104.16.149.130

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 22, 2024 09:45:15.462481976 CEST	192.168.2.4	1.1.1.1	0x85e0	Standard query (0)	geo.lavasoft.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:16.467195034 CEST	192.168.2.4	1.1.1.1	0x85e0	Standard query (0)	geo.lavasoft.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:17.328160048 CEST	192.168.2.4	1.1.1.1	0xc93d	Standard query (0)	featureflags.lavasoft.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:18.600920916 CEST	192.168.2.4	1.1.1.1	0x895b	Standard query (0)	flwadw.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:41.649133921 CEST	192.168.2.4	1.1.1.1	0xfe86	Standard query (0)	wcdownloadercdn.lavasoft.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 22, 2024 09:45:16.473718882 CEST	1.1.1.1	192.168.2.4	0x85e0	No error (0)	geo.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:16.473718882 CEST	1.1.1.1	192.168.2.4	0x85e0	No error (0)	geo.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:16.474720955 CEST	1.1.1.1	192.168.2.4	0x85e0	No error (0)	geo.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:16.474720955 CEST	1.1.1.1	192.168.2.4	0x85e0	No error (0)	geo.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:17.336185932 CEST	1.1.1.1	192.168.2.4	0xc93d	No error (0)	featureflags.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:17.336185932 CEST	1.1.1.1	192.168.2.4	0xc93d	No error (0)	featureflags.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:18.609102011 CEST	1.1.1.1	192.168.2.4	0x895b	No error (0)	flwadw.com	104.18.27.149	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:18.609102011 CEST	1.1.1.1	192.168.2.4	0x895b	No error (0)	flwadw.com	104.18.26.149	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:41.658169031 CEST	1.1.1.1	192.168.2.4	0xfe86	No error (0)	wcdownloadercdn.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:45:41.658169031 CEST	1.1.1.1	192.168.2.4	0xfe86	No error (0)	wcdownloadercdn.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	104.16.149.130	80	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 09:45:16.484515905 CEST	66	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com Connection: Keep-Alive
Oct 22, 2024 09:45:17.197043896 CEST	310	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:17 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ddf16c29e99b-DFW Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Oct 22, 2024 09:45:38.576781034 CEST	42	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com
Oct 22, 2024 09:45:38.801189899 CEST	310	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:38 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de788d5be99b-DFW Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	104.16.148.130	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:18 UTC	143	OUT	POST /api/feature/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 194 Connection: Keep-Alive
2024-10-22 07:45:18 UTC	194	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 36 32 32 30 37 30 30 31 38 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 31 30 32 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 69 6e 73 74 61 6c 6c 65 72 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 66 65 61 74 75 72 65 77 70 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 7d Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20622070018","InstallDate":"20241022","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
2024-10-22 07:45:18 UTC	249	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:18 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ddf8ce79ddab-DFW
2024-10-22 07:45:18 UTC	884	IN	Data Raw: 33 36 64 0d 0a 5b 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 49 63 6f 6e 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 5c 22 2c 20 5c 22 41 70 70 4e 61 6d 65 5c 22 3a 20 5c 22 57 65 62 20 43 6f 6d 70 61 6e 69 6f 6e 5c 22 2c 20 5c 22 53 65 74 74 69 6e 67 73 5c 22 3a 20 5b 5c 22 57 43 41 75 74 6f 55 70 64 61 74 65 5c 22 2c 20 5c 22 45 6e 61 62 6c 65 47 72 61 6e 75 6c 61 72 69 74 79 5c 22 2c 20 5c 22 50 6f 73 74 52 75 6e 56 32 41 63 74 69 6f 6e 5c 22 2c 20 5c 22 50 6f 73 74 52 75 6e 54 69 6d 65 72 41 63 74 69 6f 6e 5c 22 2c 20 5c 22 45 6e 61 Data Ascii: 36d[{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"Ena
2024-10-22 07:45:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:19 UTC	166	OUT	POST /v1/event-stat?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 447 Connection: Keep-Alive
2024-10-22 07:45:19 UTC	447	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 54 72 69 67 67 65 72 22 3a 20 22 69 6e 73 74 61 6c 6c 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "Trigger": "install", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId"
2024-10-22 07:45:19 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:19 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ddffa9db6b4c-DFW
2024-10-22 07:45:19 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:20 UTC	145	OUT	POST /v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 398
2024-10-22 07:45:20 UTC	398	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 54 72 69 67 67 65 72 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","Trigger":"install","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402"
2024-10-22 07:45:20 UTC	235	IN	HTTP/1.1 400 Bad Request Date: Tue, 22 Oct 2024 07:45:20 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de05787f2cd0-DFW
2024-10-22 07:45:20 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 49 6e 76 61 6c 69 64 20 66 6f 72 6d 61 74 2f 64 61 74 61 22 7d 0d 0a Data Ascii: 21{"message":"Invalid format/data"}
2024-10-22 07:45:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:21 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 508
2024-10-22 07:45:21 UTC	508	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:45:21 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:21 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de0b1c246bf8-DFW
2024-10-22 07:45:21 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:21 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 646
2024-10-22 07:45:21 UTC	646	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:45:23 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:22 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de10f8934791-DFW
2024-10-22 07:45:23 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:24 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 515
2024-10-22 07:45:24 UTC	515	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:45:24 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:24 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de1f8c346c3d-DFW
2024-10-22 07:45:24 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49741	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:25 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 482
2024-10-22 07:45:25 UTC	482	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:45:25 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:25 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de286a896c3a-DFW
2024-10-22 07:45:25 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:27 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 515
2024-10-22 07:45:27 UTC	515	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:45:27 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:27 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de314cfe0b71-DFW
2024-10-22 07:45:27 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:28 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 488
2024-10-22 07:45:28 UTC	488	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:45:28 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:28 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de36cf694632-DFW
2024-10-22 07:45:28 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:29 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 527
2024-10-22 07:45:29 UTC	527	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:45:29 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de3e2eae8789-DFW
2024-10-22 07:45:29 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:30 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 466
2024-10-22 07:45:30 UTC	466	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:45:30 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:30 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de435b6b35a2-DFW
2024-10-22 07:45:30 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49749	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:30 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 527
2024-10-22 07:45:30 UTC	527	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:45:31 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:31 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de48dcf5143c-DFW
2024-10-22 07:45:31 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49750	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:31 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 458
2024-10-22 07:45:31 UTC	458	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:45:32 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:32 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de4e8fa44790-DFW
2024-10-22 07:45:32 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49752	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:32 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 520
2024-10-22 07:45:32 UTC	520	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:45:33 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:32 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de545b3f6c76-DFW
2024-10-22 07:45:33 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49754	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:33 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 460
2024-10-22 07:45:33 UTC	460	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:45:33 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:33 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de59ea926b9d-DFW
2024-10-22 07:45:33 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49757	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:34 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 520
2024-10-22 07:45:34 UTC	520	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:45:34 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de5fad052c8b-DFW
2024-10-22 07:45:34 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49759	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:35 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 475
2024-10-22 07:45:35 UTC	475	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:45:35 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:35 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de65dac3699c-DFW
2024-10-22 07:45:35 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49760	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:36 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 520
2024-10-22 07:45:36 UTC	520	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:45:36 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:36 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de6ba8206b7c-DFW
2024-10-22 07:45:36 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49762	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:38 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 491
2024-10-22 07:45:38 UTC	491	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:45:38 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:38 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de774d6d0bbe-DFW
2024-10-22 07:45:38 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49764	104.16.148.130	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:39 UTC	118	OUT	POST /api/Update/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 194
2024-10-22 07:45:39 UTC	194	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 36 32 32 30 37 30 30 31 38 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 31 30 32 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 69 6e 73 74 61 6c 6c 65 72 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 66 65 61 74 75 72 65 77 70 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 7d Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20622070018","InstallDate":"20241022","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
2024-10-22 07:45:39 UTC	249	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:39 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de7e9b96e901-DFW
2024-10-22 07:45:39 UTC	327	IN	Data Raw: 31 34 30 0d 0a 7b 22 63 6f 64 65 22 3a 22 55 50 44 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 20 5c 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 5c 22 2c 20 5c 22 49 6e 73 74 61 6c 6c 65 72 45 78 65 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 31 33 2e 30 2e 30 2e 31 30 38 30 2f 57 43 49 6e 73 74 61 6c 6c 65 72 5f 4e 6f 6e 41 64 6d 69 6e 2e 65 78 65 5c 22 2c 20 5c 22 49 6e 73 74 61 6c 6c 65 72 5a 69 70 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 2f 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2d 31 33 2e 39 30 Data Ascii: 140{"code":"UPD","configuration":"{\"Version\": \"13.900.0.1080\", \"InstallerExe\": \"https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe\", \"InstallerZip\": \"https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.90
2024-10-22 07:45:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49765	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:40 UTC	176	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 517 Connection: Keep-Alive
2024-10-22 07:45:40 UTC	517	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:45:40 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:40 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de8409fe2cd8-DFW
2024-10-22 07:45:40 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49766	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:41 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 485
2024-10-22 07:45:41 UTC	485	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:45:41 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:41 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67de89ae308d29-DFW
2024-10-22 07:45:41 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:45:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49767	104.16.149.130	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:42 UTC	127	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com Connection: Keep-Alive
2024-10-22 07:45:42 UTC	381	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:42 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "3718275022" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 1831 Expires: Tue, 22 Oct 2024 11:45:42 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8d67de907dbf3590-DFW
2024-10-22 07:45:42 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-10-22 07:45:42 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-10-22 07:45:42 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-10-22 07:45:42 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-10-22 07:45:42 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-10-22 07:45:42 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-10-22 07:45:42 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-10-22 07:45:42 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-10-22 07:45:42 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-10-22 07:45:42 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49768	104.16.149.130	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:51 UTC	103	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com
2024-10-22 07:45:51 UTC	381	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:51 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "3718275022" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 1840 Expires: Tue, 22 Oct 2024 11:45:51 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8d67decacc3b4695-DFW
2024-10-22 07:45:51 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-10-22 07:45:51 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-10-22 07:45:51 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-10-22 07:45:51 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-10-22 07:45:51 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-10-22 07:45:51 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-10-22 07:45:51 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-10-22 07:45:51 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-10-22 07:45:51 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-10-22 07:45:51 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49769	104.16.149.130	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:45:55 UTC	127	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com Connection: Keep-Alive
2024-10-22 07:45:56 UTC	381	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:45:56 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "3718275022" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 1845 Expires: Tue, 22 Oct 2024 11:45:56 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8d67dee519a0e905-DFW
2024-10-22 07:45:56 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-10-22 07:45:56 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-10-22 07:45:56 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-10-22 07:45:56 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-10-22 07:45:56 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-10-22 07:45:56 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-10-22 07:45:56 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-10-22 07:45:56 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-10-22 07:45:56 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-10-22 07:45:56 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49770	104.16.149.130	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:46:00 UTC	127	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com Connection: Keep-Alive
2024-10-22 07:46:00 UTC	381	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:46:00 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "3718275022" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 1849 Expires: Tue, 22 Oct 2024 11:46:00 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8d67deffcc901443-DFW
2024-10-22 07:46:00 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-10-22 07:46:00 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-10-22 07:46:00 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-10-22 07:46:00 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-10-22 07:46:00 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-10-22 07:46:00 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-10-22 07:46:00 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-10-22 07:46:00 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-10-22 07:46:00 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-10-22 07:46:00 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	52552	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:46:04 UTC	173	OUT	POST /v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 728 Connection: Keep-Alive
2024-10-22 07:46:04 UTC	728	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "faf43794-be76-41f2-97cd-2e67f16d433f", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:46:04 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:46:04 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67df17ced66c32-DFW
2024-10-22 07:46:04 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:46:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	52553	104.18.27.149	443	6972	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:46:04 UTC	152	OUT	POST /v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 674
2024-10-22 07:46:04 UTC	674	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 66 61 66 34 33 37 39 34 2d 62 65 37 36 2d 34 31 66 32 2d 39 37 63 64 2d 32 65 36 37 66 31 36 64 34 33 33 66 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"faf43794-be76-41f2-97cd-2e67f16d433f","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:46:05 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:46:05 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67df1d380c2cc9-DFW
2024-10-22 07:46:05 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:46:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:45:12
Start date:	22/10/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	545'352 bytes
MD5 hash:	FEF9A20FCD13F76E4656A66A95AE336C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	03:45:13
Start date:	22/10/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe
Wow64 process (32bit):	true
Commandline:	.\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20622070018 --version=13.900.0.1080
Imagebase:	0xda0000
File size:	438'936 bytes
MD5 hash:	A27F9713DB1688D03D2082BFA1827803
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe, Author: Joe Security
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	16

Executed Functions

Function 004148D4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 004148FA

Part of subcall function 004157C8: HeapCreate.KERNELBASE(00000000,00001000,00000000,00414932,00000001), ref: 004157D9
Part of subcall function 004157C8: HeapDestroy.KERNEL32 ref: 00415818

GetCommandLineA.KERNEL32 ref: 0041495A
GetStartupInfoA.KERNEL32(?), ref: 00414985
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004149A8

Part of subcall function 00414A01: ExitProcess.KERNEL32 ref: 00414A1E

Strings

`&, xrefs: 00414974
@%L, xrefs: 00414960

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID: @%L$`&
API String ID: 2057626494-58240621
Opcode ID: d0b0bc6d91067fd433c2cc4b1856fc531dfd5f25a3beb9f48f66dbad23e013fe
Instruction ID: fb65514f2d73941f5fb5fe300876562abb5c146ee9b99336205dd39c2cb12ef3
Opcode Fuzzy Hash: d0b0bc6d91067fd433c2cc4b1856fc531dfd5f25a3beb9f48f66dbad23e013fe
Instruction Fuzzy Hash: BD219EB19407159FDB14EFB6DC46AEE7BB8EF44704F10412FF910AB291DB3C89818A58

Function 00405434 Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405414: FindClose.KERNELBASE(?,000000FF,00405445,000000FF), ref: 0040541F

FindFirstFileW.KERNELBASE(?,?,000000FF), ref: 00405497

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

FindFirstFileA.KERNEL32(?,?,000000FF), ref: 00405467

Part of subcall function 0040551C: __EH_prolog.LIBCMT ref: 00405521

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$FileFirstH_prolog$Close
String ID:
API String ID: 3335342080-0
Opcode ID: 01ff4a9bc94c78cd279a0d863a54892268cf469c718bfc53d66ce16def007dff
Instruction ID: 44fa9ff84b7e7cb6f1e8d7f9ea47a8a098aa0700a3472251c04f15a334366322
Opcode Fuzzy Hash: 01ff4a9bc94c78cd279a0d863a54892268cf469c718bfc53d66ce16def007dff
Instruction Fuzzy Hash: 33014830401505ABCF20AF64DC456EE7779DF51329F20827AE855672D1D73C9A85CF98

Function 00401014 Relevance: 48.0, APIs: 8, Strings: 19, Instructions: 715
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401A7B: GetVersionExA.KERNEL32(?), ref: 00401A95

GetCommandLineW.KERNEL32(00000003,00000003,00000003,00000003,?,00000000), ref: 0040108B

Part of subcall function 004038D7: __EH_prolog.LIBCMT ref: 004038DC

Part of subcall function 0040460B: __EH_prolog.LIBCMT ref: 00404610
Part of subcall function 0040460B: GetModuleFileNameA.KERNEL32(00400000,?,00000105,00000000,00000000), ref: 00404649

Part of subcall function 0040237B: __EH_prolog.LIBCMT ref: 00402380

Part of subcall function 00402340: __EH_prolog.LIBCMT ref: 00402345

Part of subcall function 00403DE4: __EH_prolog.LIBCMT ref: 00403DE9

MessageBoxW.USER32(00000000,?,?,00000010), ref: 004015DE
ShellExecuteExA.SHELL32(0000003C,?,00000001,?,?,00000003,?,00000003,00420240,;!@InstallEnd@!,?,00000003,00000000,00000002,00420278,00000003), ref: 004016D5
MessageBoxW.USER32(00000000,?,?,00000024), ref: 004012FF

Part of subcall function 00410EC0: MessageBoxW.USER32(00000000,?,7-Zip,00000010), ref: 00410EC9

Part of subcall function 00402EFE: __EH_prolog.LIBCMT ref: 00402F03

CloseHandle.KERNEL32(?,?,00000000), ref: 004019A8
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 004019C7
CloseHandle.KERNEL32(?,?,00000000), ref: 004019CE

Strings

RunProgram, xrefs: 0040139A
ExecuteFile, xrefs: 004013DA
Title, xrefs: 0040120B
Can't load config info, xrefs: 00401185
, xrefs: 004016DB
%%T\, xrefs: 00401803
Config failed, xrefs: 004011F7
;!@Install@!UTF-8!, xrefs: 00401172
Can not create temp folder archive, xrefs: 004014DD
Can not load codecs, xrefs: 00401529
Directory, xrefs: 004012A2
%%T, xrefs: 00401832
setup.exe, xrefs: 004017B9
<, xrefs: 0040166A
Can not open file, xrefs: 004016ED
ExecuteParameters, xrefs: 0040141A
D, xrefs: 00401886
;!@InstallEnd@!, xrefs: 0040116D
Can not find setup.exe, xrefs: 004017DB

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$Message$CloseHandle$CommandExecuteFileLineModuleNameObjectShellSingleVersionWait
String ID: $%%T$%%T\$;!@Install@!UTF-8!$;!@InstallEnd@!$<$Can not create temp folder archive$Can not find setup.exe$Can not load codecs$Can not open file$Can't load config info$Config failed$D$Directory$ExecuteFile$ExecuteParameters$RunProgram$Title$setup.exe
API String ID: 785510900-2114487665
Opcode ID: 8fd5f8ab937932ae6757a318f5051f0329dcea0d0da6af97c6c1f875a1e9e091
Instruction ID: f92d1a5b025e5f1856d93d01be2b226abe75c3e6546c85d9ed47549f0c040395
Opcode Fuzzy Hash: 8fd5f8ab937932ae6757a318f5051f0329dcea0d0da6af97c6c1f875a1e9e091
Instruction Fuzzy Hash: 485228719002199ACF25EFA5DC82AEDBB75AF04308F1040BFE156721F2DA395B86CF58

Function 0040AB05 Relevance: 14.2, APIs: 9, Instructions: 682
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040AB0A

Part of subcall function 0040D5A3: __EH_prolog.LIBCMT ref: 0040D5A8

Part of subcall function 004130E0: InitializeCriticalSection.KERNEL32(?,?,?,00000000,00000000), ref: 0041310E

DeleteCriticalSection.KERNEL32(?), ref: 0040AD3E
DeleteCriticalSection.KERNEL32(?), ref: 0040AFCB
DeleteCriticalSection.KERNEL32(?), ref: 0040B036
DeleteCriticalSection.KERNEL32(?), ref: 0040B093
DeleteCriticalSection.KERNEL32(?), ref: 0040B1A2
DeleteCriticalSection.KERNEL32(?), ref: 0040B1FC
DeleteCriticalSection.KERNEL32(?,?,?,00000004,00000004), ref: 0040B271
DeleteCriticalSection.KERNEL32(?), ref: 0040B303

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$Delete$H_prolog$Initialize
String ID:
API String ID: 3452124646-0
Opcode ID: 53ff4eaa71f930fd4966fc49476664da3d82c19ee4ae63da8a12ea1bfaad2ad0
Instruction ID: 4c9a54a47b38b58bbaef36bcc828af5c6ca02983ed7c574d3216c54edcd042c8
Opcode Fuzzy Hash: 53ff4eaa71f930fd4966fc49476664da3d82c19ee4ae63da8a12ea1bfaad2ad0
Instruction Fuzzy Hash: FC627E7090024ADFDB14DFA5C944BDEBBB4FF14308F1080AEE805B7291DB789A49DB99

Function 004051B7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 004051C5
GetTickCount.KERNEL32 ref: 004051D0
GetCurrentProcessId.KERNEL32(?,00000000,?,?,00405334,?,00000000,?,00000003,00000003,00000000,00000000,00000003,?,00000000), ref: 004051DB
GetTickCount.KERNEL32 ref: 00405240
SetLastError.KERNEL32(000000B7,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00405273
GetLastError.KERNEL32(00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00405299

Part of subcall function 004049F4: CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A13

Strings

d, xrefs: 004052AE
.tmp, xrefs: 00405257

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountCurrentErrorLastTick$CreateDirectoryProcessThread
String ID: .tmp$d
API String ID: 3074393274-2797371523
Opcode ID: 2fda1539db0041318063c64b288010cc5c4c3aedaa5e381c7d8f696092406eab
Instruction ID: 4fab17955b769304b7d1cf71853489b42ead9ac2cf2e2055059d54e7646dac87
Opcode Fuzzy Hash: 2fda1539db0041318063c64b288010cc5c4c3aedaa5e381c7d8f696092406eab
Instruction Fuzzy Hash: CC31C1326506009BDB10ABA098897EF7760EFA5315F14807FE902BB2D2D77C9842CF99

Function 00404908 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000078,.@,00000000,00402AB0,00000000,?,?,?,?), ref: 00404918
CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,?,.@,00000000,00402AB0,00000000,?,?,?,?), ref: 00404934
SetFileTime.KERNELBASE(00000000,00000000,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000,?,.@,00000000,00402AB0,00000000), ref: 0040494B
CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,?,.@,00000000,00402AB0,00000000,?,?,?), ref: 00404957

Strings

.@, xrefs: 00404911

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID: .@
API String ID: 2291555494-2582305824
Opcode ID: 134b82ee1bee937397c61f831c6e8a998fcbb54d8f51f8998ece3d2421389dbd
Instruction ID: b13e78268552c33248838deebc4f257ca571263cc4fefdaa9dfe176c52576776
Opcode Fuzzy Hash: 134b82ee1bee937397c61f831c6e8a998fcbb54d8f51f8998ece3d2421389dbd
Instruction Fuzzy Hash: 66F0E2B12812107BE2201B74BC48F9B6E5CDBCA715F108135B661A21E0C3284D19D7B8

Function 004083AB Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004083B0

Strings

Unknown error, xrefs: 00408671, 00408676
X3B, xrefs: 004086A4

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID: Unknown error$X3B
API String ID: 3519838083-1496835351
Opcode ID: 47f253f86f2cbe6f5ea7b7729e7e95f0c02779c145a6591478a86d185b5344b5
Instruction ID: 10ffca09dccd2053a4a89f972bfe6bbc607f2b880b0d523777cfa28ffc571443
Opcode Fuzzy Hash: 47f253f86f2cbe6f5ea7b7729e7e95f0c02779c145a6591478a86d185b5344b5
Instruction Fuzzy Hash: 89D16070900219EFCF05DFA4C984ADEBB74BF48304F14846EE846BB2D1DB78AA45CB95

Function 00405620 Relevance: 4.6, APIs: 3, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00405625

Part of subcall function 00405434: FindFirstFileA.KERNEL32(?,?,000000FF), ref: 00405467

GetLastError.KERNEL32(?,?,00000000,?,00000001), ref: 00405653

Part of subcall function 00405414: FindClose.KERNELBASE(?,000000FF,00405445,000000FF), ref: 0040541F

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseErrorFileFirstH_prologLast
String ID:
API String ID: 364955512-0
Opcode ID: e39f0d4d85096f3cd882782c1d04852b930387ce9b142e76bb949cb0f7f9728b
Instruction ID: 04b13d9487752735ca5a27f2fc382c225ef0a6c39b2ce108fc8834fd1c85259b
Opcode Fuzzy Hash: e39f0d4d85096f3cd882782c1d04852b930387ce9b142e76bb949cb0f7f9728b
Instruction Fuzzy Hash: F0418E36900519AACF14FBA5D942AEFBB75EF14308F10403AE412772E1DB795E41DEA8

Function 0040280E Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00402813

Part of subcall function 00402D81: EnterCriticalSection.KERNEL32(?,?,?,00409336), ref: 00402D86
Part of subcall function 00402D81: LeaveCriticalSection.KERNEL32(?,?,?,?,00409336), ref: 00402D90

Strings

.@, xrefs: 00402A17, 00402C0B, 00402C67

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID: .@
API String ID: 367238759-2582305824
Opcode ID: 577924c8c0bac586da650f1e85d0a83bbc87ffed532ab8f3eca2ba2db10ea84e
Instruction ID: fb4838387da9abac6519c3a0e173b295c4de01f89ec6b6ed0d4ee3fc8d60aaac
Opcode Fuzzy Hash: 577924c8c0bac586da650f1e85d0a83bbc87ffed532ab8f3eca2ba2db10ea84e
Instruction Fuzzy Hash: F3F1DF70900248DFCF14EFA5C985ADEBBB4AF54308F10807EE446B72E1DB785A85DB19

Function 004030FC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00403101

Part of subcall function 00405620: __EH_prolog.LIBCMT ref: 00405625

Part of subcall function 00404A3E: __EH_prolog.LIBCMT ref: 00404A43

Part of subcall function 004092E6: __EH_prolog.LIBCMT ref: 004092EB

Strings

Default, xrefs: 00403213

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID: Default
API String ID: 3519838083-753088835
Opcode ID: 0fc91ddac6c1b16fe72a6cc7b41e2781a7216c9bd00a9ca8bd5645336c638fb0
Instruction ID: 203c82e13c85383a660d5cb73dbb10af46e9aa8c77eacbcc0267a4e11568a844
Opcode Fuzzy Hash: 0fc91ddac6c1b16fe72a6cc7b41e2781a7216c9bd00a9ca8bd5645336c638fb0
Instruction Fuzzy Hash: E4514E75900209EFDB14EFA5D8819EEBBB8FF18308F00456EE556772D1DB38AA06CB14

Function 00404A3E Relevance: 3.2, APIs: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00404A43
GetLastError.KERNEL32(?,?,?,00000000), ref: 00404ACB

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID:
API String ID: 1057991267-0
Opcode ID: cf2054507fd1ee53753d2eae408e5b803be4a538542d8802e2091fe77905cd97
Instruction ID: 397979b183d08822f23b565ee303c4952bc02ec102e27be1c48eee89bea9c2ad
Opcode Fuzzy Hash: cf2054507fd1ee53753d2eae408e5b803be4a538542d8802e2091fe77905cd97
Instruction Fuzzy Hash: 1E5105719441099ACF10EBA5C942AFEBB75AF91308F11017FE602731E1DB3DAE46CB99

Function 00408755 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040875A
GetLastError.KERNEL32(?,00000000,?,?,00000000,?,?,0040893F,?,?,00000000,004149B4,?,?,?,00000000), ref: 004087E8

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID:
API String ID: 1057991267-0
Opcode ID: 9241e159634e285d8ed2c067ddd4a586d7e54c47a3761db9d9a9d26607b46551
Instruction ID: 0128b321cd566d1ceb50e896689a501b942dab3b414a73cd3b5e456030195100
Opcode Fuzzy Hash: 9241e159634e285d8ed2c067ddd4a586d7e54c47a3761db9d9a9d26607b46551
Instruction Fuzzy Hash: EE317C719012499FCB10DF95CE849AEBBB0FF44314B24817FE496B7292CB388D40DB69

Function 0041468E Relevance: 3.0, APIs: 2, Instructions: 45
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416CCC: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00416DC2

CreateThread.KERNELBASE(00000000,00000003,004146F9,00000000,00000000,?), ref: 004146CF
GetLastError.KERNEL32(?,?,?,00413009,00000000,00000000,004032CA,?,00000000,00000000,?,00402FAB,?,00000000,?), ref: 004146D9

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocCreateErrorHeapLastThread
String ID:
API String ID: 3580101977-0
Opcode ID: 0374611688ca75c4551dea276e5d424cbadff3ac534dbe24837146ca9d20d13e
Instruction ID: 928dc59a5e1d7113ba94efa25a55b36d47ae035f635b84aed830f8a2a3c61c12
Opcode Fuzzy Hash: 0374611688ca75c4551dea276e5d424cbadff3ac534dbe24837146ca9d20d13e
Instruction Fuzzy Hash: D6F02D362006156BCB209F66EC019DB3BA5EF81375F10402EF958C2290DF3DC8914BAC

Function 00405892 Relevance: 3.0, APIs: 2, Instructions: 45
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405905: CloseHandle.KERNELBASE(00000000,000000FF,004058A0,?,?,00000000), ref: 00405910

CreateFileW.KERNELBASE(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004058EF

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

CreateFileA.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004058CB

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateFile$CloseH_prologHandle
String ID:
API String ID: 449569272-0
Opcode ID: 34b674e9a04a5ff3e8c8923f5916708bcc46c4f31befc859c171c75614de22e6
Instruction ID: 7cb04d8d1853a58e30318ad4c29bda14cf4b58fee7e46fc4002fe1391b6e6e2b
Opcode Fuzzy Hash: 34b674e9a04a5ff3e8c8923f5916708bcc46c4f31befc859c171c75614de22e6
Instruction Fuzzy Hash: 4F01287240020AFFCF11AFA4DC45C9B7F6AEF08364B10853AF991661A1D73699A1EF94

Function 00404965 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNELBASE(?,00000000,?,00000003,?,00000000), ref: 0040499C

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

SetFileAttributesA.KERNEL32(?,00000000,?,00000003,?,00000000), ref: 00404985

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AttributesFile$H_prolog
String ID:
API String ID: 3790360811-0
Opcode ID: 5366c93646a32060bc4a1fe11ea500c12b8b92d1211a98e2b8e7846322785de3
Instruction ID: f078d443d6654451da1bdd33dee3a4941b810ca2709c1c0422ffd448cadfd8b3
Opcode Fuzzy Hash: 5366c93646a32060bc4a1fe11ea500c12b8b92d1211a98e2b8e7846322785de3
Instruction Fuzzy Hash: 12E0E5B19002106BCB302B749C08AD73F6CCB82314B108177E816B72D0DA388E06C6D9

Function 004049F4 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A2C

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A13

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateDirectory$H_prolog
String ID:
API String ID: 2325068607-0
Opcode ID: a1e0d02f5bfc64bfc09281de4819c2c8931d1b3daee1640bd6a36795e0d5f738
Instruction ID: e8b418caba4fa0c83fd0f6cce2293bab18ef6c4fa53c548cc4c0ebfda5fe1645
Opcode Fuzzy Hash: a1e0d02f5bfc64bfc09281de4819c2c8931d1b3daee1640bd6a36795e0d5f738
Instruction Fuzzy Hash: 3CE0E570B002006BDB206B64AC05B977B68CB41709F104176E902F71D0DA78DE01DA9C

Function 004157C8 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00414932,00000001), ref: 004157D9

Part of subcall function 00415680: GetVersionExA.KERNEL32 ref: 0041569F

HeapDestroy.KERNEL32 ref: 00415818

Part of subcall function 00415825: HeapAlloc.KERNEL32(00000000,00000140,00415801,000003F8), ref: 00415832

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 0d18dfc85a1640e6673d81f03e6c6359104a03ea7de3319d0e450716895a192f
Instruction ID: ed3d0d0d9fb025b00032fbfed5580f0a7fafafb3549905f7ec75d8b7e0a93aa3
Opcode Fuzzy Hash: 0d18dfc85a1640e6673d81f03e6c6359104a03ea7de3319d0e450716895a192f
Instruction Fuzzy Hash: 6CF06530A54B01EEDF207B706C867EA2B90EB84795F60483BF401D81A0EB7884D1D659

Function 00405970 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 0040598B
GetLastError.KERNEL32(?,?,?,?), ref: 00405999

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 4eb004f5f0e538f15da8fb4a4b1192dc0e26d9ca4b62000b247bbe798b79ae76
Instruction ID: b27308c8a3af6e3091502473baf333c9532b4c6e1f366657fcb3ad1a7c3590d9
Opcode Fuzzy Hash: 4eb004f5f0e538f15da8fb4a4b1192dc0e26d9ca4b62000b247bbe798b79ae76
Instruction Fuzzy Hash: 93F0B7B4500208EFDF04CF94D9458AE7BB5EF49364B208169F815E7390D7359E00DFA9

Function 00404F2C Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,?,00000000), ref: 00404F62

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

SetCurrentDirectoryA.KERNEL32(00000000,00000000,?,00000000), ref: 00404F48

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CurrentDirectory$H_prolog
String ID:
API String ID: 3531555294-0
Opcode ID: 37bd0973ac103fd303293487a19168a5ccebfcf95a8c4f288a103cb7951a30b5
Instruction ID: 9edf083e53dd0555a3085cbe496080ff7240eda39e21aa363a26468641b3ea5b
Opcode Fuzzy Hash: 37bd0973ac103fd303293487a19168a5ccebfcf95a8c4f288a103cb7951a30b5
Instruction Fuzzy Hash: 75E02630B400093FDF112F78EC4A9AA3BB89B40309F10427AB403E20E1EF38CA48CA48

Function 0040B98F Relevance: 2.0, APIs: 1, Instructions: 515COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B994

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6c23f50496e65b3ca560bc6ad6661ef703fabc81de4c7ebfafbc0beace10094d
Instruction ID: 4fbed39282daa38b1d3be95d0829f5567439209fdd6a1d56e89862dfcbe45c3a
Opcode Fuzzy Hash: 6c23f50496e65b3ca560bc6ad6661ef703fabc81de4c7ebfafbc0beace10094d
Instruction Fuzzy Hash: 05324B70904249DFDB10DFA8C584BDEBBB0AF58304F1441AEE845B7382DB78AE45CB99

Function 0040EB99 Relevance: 2.0, APIs: 1, Instructions: 500COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040EB9E

Part of subcall function 0040E770: __EH_prolog.LIBCMT ref: 0040E775

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 93af7643a127ff2c8fcf7066a9c121e1979c0be22eb581a0e33d5eb75e035ebc
Instruction ID: 765616d13d330a71392781af4293cea344630bd2be9376268a28767dce44cac6
Opcode Fuzzy Hash: 93af7643a127ff2c8fcf7066a9c121e1979c0be22eb581a0e33d5eb75e035ebc
Instruction Fuzzy Hash: F6325C70900249DFCB24DFA5C880BEEBBB5BF55308F14847ED549B7282DB386A89CB55

Function 0040888F Relevance: 1.9, APIs: 1, Instructions: 374COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408894

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f8f61f009d3daf8c2db6a732b574bcd6eafb3dea196858b7c2c201f5376d76a6
Instruction ID: dff2ad87a4df39db6f8fa6ff6a697358cee08fb6a23258ae47e5232e80a59da3
Opcode Fuzzy Hash: f8f61f009d3daf8c2db6a732b574bcd6eafb3dea196858b7c2c201f5376d76a6
Instruction Fuzzy Hash: FFE16E70904249DFDF10DFA4C988AAEBBB4AF48314F2444AEE556F7391CB389E45CB25

Function 0040E7F4 Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E7F9

Part of subcall function 0040F836: __EH_prolog.LIBCMT ref: 0040F83B

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 498aaecf194758b2187a7f377388585577334c9b398a12de9558ebeea3154d22
Instruction ID: 639e188e3e769c4c76ba7ddc7be71c767d86a570cac8f7036ff280b2304c1e48
Opcode Fuzzy Hash: 498aaecf194758b2187a7f377388585577334c9b398a12de9558ebeea3154d22
Instruction Fuzzy Hash: 5DC13670900259DFDB14DFA5C985BDEBBB4BF14308F1480AEE945B7282CB786A48CF65

Function 0040F449 Relevance: 1.7, APIs: 1, Instructions: 207COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F44E

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7053a18d867c794380ddb73d5154a26bfb4cc56ca4d452b1cbce9de2fd1904e6
Instruction ID: 37dc011919f3b1358f9a833e213d0996983958fb9ee029613f358e4c9ba25a45
Opcode Fuzzy Hash: 7053a18d867c794380ddb73d5154a26bfb4cc56ca4d452b1cbce9de2fd1904e6
Instruction Fuzzy Hash: 3C815C70E00605ABCB24DFA5C881AEEFBB1BF48304F14453EE445B3791D739A949CB99

Function 00408D5E Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408D63

Part of subcall function 00408F0B: __EH_prolog.LIBCMT ref: 00408F10

Part of subcall function 00402635: __EH_prolog.LIBCMT ref: 0040263A

Part of subcall function 00403981: __EH_prolog.LIBCMT ref: 00403986

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fe4f4b855b35ad50f10ad9ecf2bf615057988214f71ae465a5f778489ccae84a
Instruction ID: 2e5fef73c4a961ecd91826de13bda49669b7ee5ae1afd1ab178ba291f64b6413
Opcode Fuzzy Hash: fe4f4b855b35ad50f10ad9ecf2bf615057988214f71ae465a5f778489ccae84a
Instruction Fuzzy Hash: E5516D7190060AEFCF11DFA5C984A9EBBB4BF08314F10462EE556B72D1CB789A45CFA4

Function 0040DB62 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040DB67

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6102bc3ab49ae424949eee4761875b821dd30f392df23a536a372274e60046df
Instruction ID: 67e57bbcfb5e62c28ba97e2c762051c7e2fb602a8ee489b014dcb5d1e96c76cd
Opcode Fuzzy Hash: 6102bc3ab49ae424949eee4761875b821dd30f392df23a536a372274e60046df
Instruction Fuzzy Hash: DA419EB1E042059BEB14DF99C985ABEB7B5FF48304F14453EE402B7381D7B8A945CBA8

Function 0040CD84 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CD89

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 305c79b04e93cb02db0d94eb430663c97d837b050eba01e1428f85ec3b32050d
Instruction ID: 716710645470f9cf712b82a1641bf3e3a23618a4fc30be00c3c641d866b01c52
Opcode Fuzzy Hash: 305c79b04e93cb02db0d94eb430663c97d837b050eba01e1428f85ec3b32050d
Instruction Fuzzy Hash: 3151C531804146DFCB15CB68C4D4AEE7771EF48348F14827BE8167B2D2D6399A06DBEA

Function 00401B11 Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401B16

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4a7b8dc75b00dab3078b6f2c0b685c16519ae0cc3006f02a661cb725d39e4b70
Instruction ID: dc66995ee082b2e59fd72de07b50a9d1ecefa8465c91578acc64d6d85ae5b981
Opcode Fuzzy Hash: 4a7b8dc75b00dab3078b6f2c0b685c16519ae0cc3006f02a661cb725d39e4b70
Instruction Fuzzy Hash: 7A51D071C042499FDF21DFA4C940BEEBBB4AF05394F14416AE851732E2E7789A41CB68

Function 00402EFE Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402F03

Part of subcall function 0040335F: __EH_prolog.LIBCMT ref: 00403364

Part of subcall function 004034CC: __EH_prolog.LIBCMT ref: 004034D1

Part of subcall function 00403086: __EH_prolog.LIBCMT ref: 0040308B
Part of subcall function 00403086: ShowWindow.USER32(004149B4,00000001,000001F4,00000000,?,?,00000000,00000003,00000000,00000000), ref: 004030E4

Part of subcall function 00412FB0: CloseHandle.KERNEL32(00000000,00000000,0040301E,?,?,00000000,00000003,?,00000000,?,?,00000003,00000000,00000000), ref: 00412FBA
Part of subcall function 00412FB0: GetLastError.KERNEL32(?,00000003,00000000,00000000), ref: 00412FC4

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$CloseErrorHandleLastShowWindow
String ID:
API String ID: 2740091781-0
Opcode ID: 2da83f7b0348b558eb037d8fcbbe5e82633db5724e115f0790e5db2222500163
Instruction ID: 576321bfec054c9ee934bf83a6d4a944d332aa9064831fab6676e01313dc7821
Opcode Fuzzy Hash: 2da83f7b0348b558eb037d8fcbbe5e82633db5724e115f0790e5db2222500163
Instruction Fuzzy Hash: FF419C71900248DBCB11EFA5C991AEDBBB4AF04304F1080BFE90AB72D2DA785B45CB59

Function 0040C557 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C55C

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 039900a8d840d8f65cf18cf377fd5bff5d9e595a8fad608146d0eb9be483e555
Instruction ID: 41554ca9dc53ee1e5d6d797d633c48513fe02739bc2a4d97afccdd4c6a3ff44e
Opcode Fuzzy Hash: 039900a8d840d8f65cf18cf377fd5bff5d9e595a8fad608146d0eb9be483e555
Instruction Fuzzy Hash: 89416C71A00645DFCB24CF68C48486ABBF1FF48314B244AAED096AB791C731ED46CF91

Function 0040CF82 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CF87

Part of subcall function 0040F6E0: __EH_prolog.LIBCMT ref: 0040F6E5

Part of subcall function 0040D0A6: __EH_prolog.LIBCMT ref: 0040D0AB

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 247e6e783af1532b670e604df5ee4666ee67329ca8b2db34e45a1f618534d241
Instruction ID: 59bb91874275df73172cd70bf395014d1b371f9bee4586dc4e729df687399cc5
Opcode Fuzzy Hash: 247e6e783af1532b670e604df5ee4666ee67329ca8b2db34e45a1f618534d241
Instruction Fuzzy Hash: 87319630D01248DFCB11DFA9C548BEDBBB5AF15308F14406EE8457B381C7789A49DB66

Function 004061BF Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004061C4

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0a32dfb97eb38f68acb4646e97dd4d13ceed46f781b2d933bb6fe13a2a73ca49
Instruction ID: a24cbab5944e5cd80d4d0b45cab95027a2511e7323fd1c0fe5e5f9bfcab47c11
Opcode Fuzzy Hash: 0a32dfb97eb38f68acb4646e97dd4d13ceed46f781b2d933bb6fe13a2a73ca49
Instruction Fuzzy Hash: 97218F71A05246DBCB24FFA5C44046FB7A1AB4130472285BFE053772C1C738AE61CB6A

Function 00413C73 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 00413D5A

Part of subcall function 004154DA: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415517
Part of subcall function 004154DA: EnterCriticalSection.KERNEL32(?,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415532

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: cdeed90e400f99c9328ec8b59033d7a90e074e0a5ab5361bfbc3574a04fde8a1
Instruction ID: 026ee179866774db734838c78619ddc809868a86b22b68076f663e2312d1f49b
Opcode Fuzzy Hash: cdeed90e400f99c9328ec8b59033d7a90e074e0a5ab5361bfbc3574a04fde8a1
Instruction Fuzzy Hash: D4219772A00605EBDB10DF69EC42BDA7764FB00765F20411BF421EB6D0D77CAAC28A9C

Function 00413D6F Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,00000000,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074), ref: 00413E43

Part of subcall function 004154DA: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415517
Part of subcall function 004154DA: EnterCriticalSection.KERNEL32(?,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415532

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapInitialize
String ID:
API String ID: 641406236-0
Opcode ID: 841176424f551508ca039d1f5d574a0052902f767b8dc575c65ddda1a9f22b4e
Instruction ID: 5a14261a50f2f4ae8fe925cd7ff68077a924e970bbdc1eb83d0c2eed9fb11c58
Opcode Fuzzy Hash: 841176424f551508ca039d1f5d574a0052902f767b8dc575c65ddda1a9f22b4e
Instruction Fuzzy Hash: 2421C272901705FADB10AF96DC02BDE7BB8EB04725F24012BF414B21C0D77C9AC08AA9

Function 004052CF Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004052D4

Part of subcall function 004050EE: __EH_prolog.LIBCMT ref: 004050F3
Part of subcall function 004050EE: GetTempPathA.KERNEL32(00000105,?,00000000,?,00000000), ref: 00405127

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$PathTemp
String ID:
API String ID: 3652545363-0
Opcode ID: 1ef5fa40e20091595c8a07c7add8e04f0ea87ba7b14c6b9ab7bd2a47fc7370d7
Instruction ID: 884fa5787797a708672a5e156f09df22a5f972d3b51e26f7068c24b8b673b68a
Opcode Fuzzy Hash: 1ef5fa40e20091595c8a07c7add8e04f0ea87ba7b14c6b9ab7bd2a47fc7370d7
Instruction Fuzzy Hash: 5211A3759401059ACF00EFA5C552AEFBBB8EF95348F14402FE841732D1C7B90A49DE54

Function 00409DFC Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409E01

Part of subcall function 004099F1: __EH_prolog.LIBCMT ref: 004099F6

Part of subcall function 00409A39: __EH_prolog.LIBCMT ref: 00409A3E

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e2be988a2ed4eac1d18d94ffb3dcbee280352d40f72ce7d9b7b55f505c73744e
Instruction ID: 728224cdcdeea9a50de84ff331f734dd83e0a6071a74e90d77f9a4778d081c57
Opcode Fuzzy Hash: e2be988a2ed4eac1d18d94ffb3dcbee280352d40f72ce7d9b7b55f505c73744e
Instruction Fuzzy Hash: 931182B0A01254DADB09EBAAC1153DDFBF59FA1318F54415F9552732C2CBF82B0487A6

Function 00409070 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409075

Part of subcall function 00402635: __EH_prolog.LIBCMT ref: 0040263A

Part of subcall function 00405620: __EH_prolog.LIBCMT ref: 00405625

Part of subcall function 00413B0D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413B3B

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$ExceptionRaise
String ID:
API String ID: 2062786585-0
Opcode ID: 17dae63e629c91cb1e915b62325b494edd8ae92648c1e9e6482c4593510b450f
Instruction ID: c87fc69b1ce411278b5c4cd36917e57d7785db396d8ca4da128de4c157d2198f
Opcode Fuzzy Hash: 17dae63e629c91cb1e915b62325b494edd8ae92648c1e9e6482c4593510b450f
Instruction Fuzzy Hash: 1601D2B5A402049ECB10EF26C451ADEBBB1FF84314F10852FE896A32E1CB796649CB54

Function 004027A7 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004027AC

Part of subcall function 004049F4: CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A13

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateDirectoryH_prolog
String ID:
API String ID: 3554458247-0
Opcode ID: 1d6ed87279fcce4dfaa36ce39d8da3d177537eb6a1ece7d61f11b0fb4062048b
Instruction ID: aa96bd448e9fa33173a2259148c0e22656dcd3e9b7c7d25cba760d9f6e75f00f
Opcode Fuzzy Hash: 1d6ed87279fcce4dfaa36ce39d8da3d177537eb6a1ece7d61f11b0fb4062048b
Instruction Fuzzy Hash: 55F03C729005069BCB05EB5AC8429EEBBB5EF94308F10403FE152775E2DA786986DB94

Function 00406297 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040629C

Part of subcall function 004061BF: __EH_prolog.LIBCMT ref: 004061C4

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6c2e6a82ad44a3596cf000a5615c5b739901b0aaac1cec813de11ba17f646bcd
Instruction ID: d002f29cd99a7d9c36b9a014c837f136803fcb54798139eb5382dd41199f51d8
Opcode Fuzzy Hash: 6c2e6a82ad44a3596cf000a5615c5b739901b0aaac1cec813de11ba17f646bcd
Instruction Fuzzy Hash: 2BF03A72A00218EFDB15DF94CC01BEEB779FB48315F10816AB422E72D0C7798A10CB14

Function 0040C96C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C971

Part of subcall function 0040C9E3: __EH_prolog.LIBCMT ref: 0040C9E8

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 97d13476a1578dbbb8b7321e23e8bd518515a52fd3c7649a69e8943f484a5e8b
Instruction ID: 180fbe891bab88941c19a906eef3a01802dada044b7360aafa1ebd8752043cfb
Opcode Fuzzy Hash: 97d13476a1578dbbb8b7321e23e8bd518515a52fd3c7649a69e8943f484a5e8b
Instruction Fuzzy Hash: 66F0FCB0911640DEC719EB74D1153DDFBB4AF55308F50419E9956736C2CFB81708C765

Function 0040F7B7 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F7BC

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 878411d95e43fbc0e8f99baadd22453587100e877feed7db7451d64bbab71619
Instruction ID: ac64c31c834abe54e412618b162bf05c7167bd146dfe5a37d1803cc4d2d3be92
Opcode Fuzzy Hash: 878411d95e43fbc0e8f99baadd22453587100e877feed7db7451d64bbab71619
Instruction Fuzzy Hash: 94E012B1A00155ABCB58EF69D80669DBAA5AB09318F10863FB026F36C1DB784A418B59

Function 00405BFB Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00405C13

Part of subcall function 00413B0D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413B3B

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocExceptionRaiseString
String ID:
API String ID: 1415472724-0
Opcode ID: 585828f0663470c28d012fa7c31560623ec32af21cf032640c5ea50ac41654d0
Instruction ID: bf266c775eafc0cd132ea201270a7534faa964ceb55315cc87c56e89072e7831
Opcode Fuzzy Hash: 585828f0663470c28d012fa7c31560623ec32af21cf032640c5ea50ac41654d0
Instruction Fuzzy Hash: B7E06D32200708A7CB20AF65D84198B7BE8FF00385B10C43FF949DA240E779E9808BD8

Function 00405800 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405805

Part of subcall function 00405620: __EH_prolog.LIBCMT ref: 00405625

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d031f65d966fd76414b5e485b8cf5b0e5999cd66b44c505832369a9b765ef076
Instruction ID: a0f610f1b5e032532ed1cec3649959bf66a41b4e8af70f58d5593db508bcf515
Opcode Fuzzy Hash: d031f65d966fd76414b5e485b8cf5b0e5999cd66b44c505832369a9b765ef076
Instruction Fuzzy Hash: 46E04FB3D410049ACB05EB65E9527EDB378EF61319F50407FE412735D18B381F09CA58

Function 00405B29 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00405B4C

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f685ec6030a7cae57bc9182c2f64f11e19c4f82e6ad9756b6e5eb0af141a467c
Instruction ID: fda623b9c22c7fd134ddab0a411968f0e63156441233f4ee367e8c40c556ab77
Opcode Fuzzy Hash: f685ec6030a7cae57bc9182c2f64f11e19c4f82e6ad9756b6e5eb0af141a467c
Instruction Fuzzy Hash: 17E0E575640208FBCB11CFA5C801B8E7BF9EB08354F20C169F914AA260D739EA11DF54

Function 0040C931 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C936

Part of subcall function 0040C96C: __EH_prolog.LIBCMT ref: 0040C971

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2f93a48584fc243b76bceec8380402125645ced17a7c1bf7a60211c0ce45116c
Instruction ID: 8adf79bcf0a25fb823e60414124b99f072840e3085735b9c49c9779a3d641231
Opcode Fuzzy Hash: 2f93a48584fc243b76bceec8380402125645ced17a7c1bf7a60211c0ce45116c
Instruction Fuzzy Hash: 6EE01A71811620EBC724EF58C4456DEB7B4EF08725F00875EA4E6B36D1C7B8AE40CB94

Function 004147B4 Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 004147E9

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 6c939c18724e7789034020813005a1b29b75e21fb5f5d6c1b381c2503cc8d902
Instruction ID: 835638d51d7e690d80ddf8f11569568d1c7a5f433119f1d0283a2071334468ba
Opcode Fuzzy Hash: 6c939c18724e7789034020813005a1b29b75e21fb5f5d6c1b381c2503cc8d902
Instruction Fuzzy Hash: CDE08C32900925AADB223BA1DC06AEE3620AF81394F00002BF8146A5A0DBA88CD186D9

Function 0040F6E0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F6E5

Part of subcall function 0040F449: __EH_prolog.LIBCMT ref: 0040F44E

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0c00a6b9b995e6d122d0d1e5645fdc19a4d57d2469026a55dc4bfd6035115874
Instruction ID: 32d4a89d334c2aba7f1f5d27adfa0c04a02a885b7174eb98eed18e47b0b867f7
Opcode Fuzzy Hash: 0c00a6b9b995e6d122d0d1e5645fdc19a4d57d2469026a55dc4bfd6035115874
Instruction Fuzzy Hash: 1DD012B2515104FBD7109F45D842BDEBBB8EB51369F10813BF00171540D37D5644966A

Function 00405A1D Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(000000FF,00000000,?,?,00000000,000000FF,?,00405A68,00000000,?,00000000,?,00405A8E,00000000,?,00000000), ref: 00405A33

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7899785fd51540d5028ce756fcdedcbfaef9db2fe3ec3db1f53401f618f66a8a
Instruction ID: 33e006b7c7266c94de2827aaddd493f3c8d551b448fa911b85e4ce9a1db514e9
Opcode Fuzzy Hash: 7899785fd51540d5028ce756fcdedcbfaef9db2fe3ec3db1f53401f618f66a8a
Instruction Fuzzy Hash: A4E0EC75200208FBCB01CF91CC05FCE7BB9FB49754F208058E90596160C375AA14EB54

Function 004147BF Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 004147E9

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 24773d02a99502e401f88b35345ffc50176b794b148236fecf9e645f2ac90187
Instruction ID: b4e95b568d212fcbc8e7df7edbfd3446e029e3f46d4ca6baaecf21535c38ed65
Opcode Fuzzy Hash: 24773d02a99502e401f88b35345ffc50176b794b148236fecf9e645f2ac90187
Instruction Fuzzy Hash: 2AD0A732600E25AAD6223771DC467EF2244AF81795B04012BF818895A0DFA8CDC145DD

Function 00405414 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,000000FF,00405445,000000FF), ref: 0040541F

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: f0ce2bef5821c107b9489e8e4dd061de71a9af92eaf728c2451e2811c290832d
Instruction ID: ad963fc5273d8b9d86916b47fb17bcd605870b12c06d71a74b716dd917e87850
Opcode Fuzzy Hash: f0ce2bef5821c107b9489e8e4dd061de71a9af92eaf728c2451e2811c290832d
Instruction Fuzzy Hash: D4D0123151453157CA641E7C7848AD333D99A1637537157AAF4B4D32E0D3749CC34A98

Function 00405AFC Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,00405B26,00000000,00000000,?,00402E13,?), ref: 00405B0A

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 2b6a10e293fa4a8bd52839064a41e39e160aca85d3804aec240939be71bd967c
Instruction ID: 4beff7ba357006865f39a04876becaa9faf69e640e246345c6c1d8862761ec95
Opcode Fuzzy Hash: 2b6a10e293fa4a8bd52839064a41e39e160aca85d3804aec240939be71bd967c
Instruction Fuzzy Hash: 29C04C36159106FF8F120F70CC04D1ABFA2EF99311F10C958B165C5070C7328024EB52

Function 00406F81 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 00406FB2

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: f2ff9836336f67d9ff12deaf62cc92e2eac5b33916cf9d308384194b51d8e0a8
Instruction ID: f67714d9ecc1d8948c13ee62ab2841b601ff43f092b08abc37504173b9cf6405
Opcode Fuzzy Hash: f2ff9836336f67d9ff12deaf62cc92e2eac5b33916cf9d308384194b51d8e0a8
Instruction Fuzzy Hash: B7F0BE32A001459FCF119FA0D80898ABF65EF55314B0184ABF9169B251C338C820DF60

Function 00412FF0 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 0041468E: CreateThread.KERNELBASE(00000000,00000003,004146F9,00000000,00000000,?), ref: 004146CF
Part of subcall function 0041468E: GetLastError.KERNEL32(?,?,?,00413009,00000000,00000000,004032CA,?,00000000,00000000,?,00402FAB,?,00000000,?), ref: 004146D9

GetLastError.KERNEL32(?,?,00000003,00000000,00000000), ref: 00413018

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast$CreateThread
String ID:
API String ID: 665435222-0
Opcode ID: fdfffcc17890bcc66e85f81167f5a4f4e376ab203a2f001e3d39f9f51099ce04
Instruction ID: 8241f09584fde1b7b47d6c8a5a56a0c389c2bf5d01a37efb599b640c9bda9e89
Opcode Fuzzy Hash: fdfffcc17890bcc66e85f81167f5a4f4e376ab203a2f001e3d39f9f51099ce04
Instruction Fuzzy Hash: 4EE086B22042126AE310DF509C05FE76ADCDB94B05F00443EB944C6184EB64CA40C3A9

Function 00405905 Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,000000FF,004058A0,?,?,00000000), ref: 00405910

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9cbe10086181c6cf337a739c26a2519d1510d6718cc7d35307e3d92904545fb4
Instruction ID: c924a9121967eb2c43d42ee71539138ee39fbcc7c8c6d5ba34c486a20a6e0004
Opcode Fuzzy Hash: 9cbe10086181c6cf337a739c26a2519d1510d6718cc7d35307e3d92904545fb4
Instruction Fuzzy Hash: 93D0127151456197CE742E7C78445C337D8DA463303311B6BF4B0D32E0D3748D835A98

Function 00410F40 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00020000,00001000,00000004,004103C8), ref: 00410F51

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 91e70fcb83806e64083a323eb2e3944731c0f93bc5a264736d7e7e867113384b
Instruction ID: 07720a170ef6d50c918e2da5ca2fe5f7ddfb2e687cae5d42b3df39ad5892c3a5
Opcode Fuzzy Hash: 91e70fcb83806e64083a323eb2e3944731c0f93bc5a264736d7e7e867113384b
Instruction Fuzzy Hash: DDB012B039138075FF7843208C1FFE71200A340B87F0080A8BB05D81C4E7D064C0501C

Function 00410F60 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,0040664A,?,00406624), ref: 00410F6C

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1327e01bd96d07ee7a5a75ed87afd8ac78764046635013dfe708143c48cadece
Instruction ID: a132bef15ba7b425f1065e5a097c2bb543b957559febc4b94616fea76008790a
Opcode Fuzzy Hash: 1327e01bd96d07ee7a5a75ed87afd8ac78764046635013dfe708143c48cadece
Instruction Fuzzy Hash: 3BB0123424120031ED7807200C1AB5711005701701F10C1183102642C087D4B440450C

Non-executed Functions

Function 004180F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0041772A,?,Microsoft Visual C++ Runtime Library,00012010,?,0041BD34,?,0041BD84,?,?,?,Runtime Error!Program: ), ref: 00418102
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041811A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041812B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00418138

Strings

GetActiveWindow, xrefs: 00418125
MessageBoxA, xrefs: 00418114
GetLastActivePopup, xrefs: 0041812D
user32.dll, xrefs: 004180FD

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 595171f737e70550edc5abd38f068ead7bf618b78638dd3ba3c6e0fb0d2712e4
Instruction ID: 415fa372477fd235fe75ca2ef0ffa9dc0df8c28a9075a0eab2fce08d3bc4b09a
Opcode Fuzzy Hash: 595171f737e70550edc5abd38f068ead7bf618b78638dd3ba3c6e0fb0d2712e4
Instruction Fuzzy Hash: F5012572700241BF87219FB5AD849DBBAE9EB49751354443FB504C2220DB7CC9C39B69

Function 0040E38E Relevance: 1.7, APIs: 1, Instructions: 246COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E393

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ef3f0dd97c369c2370b5d413364e2112772f158c67037ae1847bc74799d93c78
Instruction ID: 6f1b27b05ce828494dcdc0ca2a3df983f9883c238a6bb878f092976797e95433
Opcode Fuzzy Hash: ef3f0dd97c369c2370b5d413364e2112772f158c67037ae1847bc74799d93c78
Instruction Fuzzy Hash: 68A1EB70E002099BCB18DF96C8919AEB7B2FF94318F14883FE915A7391D738AD52CB55

Function 0041561A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000155D4), ref: 0041561F

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c73d5215fbd9f9fa44ce3c8db65af6300706d886bcb472667e49ab47f89b2735
Instruction ID: 5929198a1c1d143ebb6d47ac1dc9c369120d6613942f0ebcbf50c4dd8c3cbf29
Opcode Fuzzy Hash: c73d5215fbd9f9fa44ce3c8db65af6300706d886bcb472667e49ab47f89b2735
Instruction Fuzzy Hash: 57A001B5A41605DA8A209F60A8095C5BE62A689B42B608166A811E5268DFB812419A69

Function 0041562C Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00415631

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 80fdf592cfe35f6ca0a49e156fc06359dfcc477da488757324292bdf2a3d88f1
Instruction ID: 3aa75b883a8314cf8793ebdd48d7cbf343a2d53b1036c531b3b3a2656884bc9f
Opcode Fuzzy Hash: 80fdf592cfe35f6ca0a49e156fc06359dfcc477da488757324292bdf2a3d88f1
Instruction Fuzzy Hash:

Function 00412480 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction ID: f7c307c9948f0502eef9bcc932476d7ce99f20ff48e31f419bd1d6f291c9dace
Opcode Fuzzy Hash: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction Fuzzy Hash: BD023A72A042114BC71DCE18C6902B9BBE2FBD5350F110A3FE496D7A84D7B8D8E5CB99

Function 00416076 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 6f6e9ae2f3605818a2c8e7767e34e4a9399a597c595f09bc79f2493b2d2310b3
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: 3EB17C7590120ADFDB15CF04C5D0AE9BBA1FF58318F25C1AEC85A4B382C735EA86CB94

Function 004039C8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1b8b3e4e9aa519cc0883e8f2e9399227ae21cf5f78173f93e12a8e0ced7762
Instruction ID: 7f21fa5966f3e8744179bfb474c2758024c7c669c00a9d4920a80f5d7b425c19
Opcode Fuzzy Hash: 8b1b8b3e4e9aa519cc0883e8f2e9399227ae21cf5f78173f93e12a8e0ced7762
Instruction Fuzzy Hash: D621427E370D0607A71C8B6AAD336B921D1E38430A7C8A03DE64BC53C1EE6DD595C60D

Function 00418CC1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction ID: 99a347de7b16eca0cbeab8721e5afb4e5ad46217b84f2e64c48f172e38bf97ef
Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction Fuzzy Hash: 2B21C83290062547C702DE6DF4845A7F391FBD4369F134727ED8467291C629A854D6E0

Function 00418D9B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction ID: 71e75c779d64757812c6fa0593de5e91038406040dd0a6985e9d44633d38c26d
Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction Fuzzy Hash: BC2137725105258BC701DF2DF4886B7B3E1FFD4319F638A3BD8818B1C1CA29D881D694

Function 004185ED Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0041BE00,00000001,00000000,00000000,74DEE860,004256E4,?,?,?,0041848E,?,?,?,00000000), ref: 0041862F
LCMapStringA.KERNEL32(00000000,00000100,0041BDFC,00000001,00000000,00000000,?,?,0041848E,?,?,?,00000000,00000001), ref: 0041864B
LCMapStringA.KERNEL32(?,?,?,0041848E,?,?,74DEE860,004256E4,?,?,?,0041848E,?,?,?,00000000), ref: 00418694
MultiByteToWideChar.KERNEL32(?,VB,?,0041848E,00000000,00000000,74DEE860,004256E4,?,?,?,0041848E,?,?,?,00000000), ref: 004186CC
MultiByteToWideChar.KERNEL32(00000000,00000001,?,0041848E,?,00000000,?,?,0041848E,?), ref: 00418724
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0041848E,?), ref: 0041873A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,0041848E,?), ref: 0041876D
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,0041848E,?), ref: 004187D5

Strings

VB, xrefs: 004186BD, 004186C8

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: VB
API String ID: 352835431-2416070386
Opcode ID: 003663a998c404720e509784b904756e9dc21287fecc91c3ae78f0538cf30181
Instruction ID: 75fdc42d4ca3b2d5695a32d80f34dcfea13c9c9e1b2be43f5f9a41df7731755a
Opcode Fuzzy Hash: 003663a998c404720e509784b904756e9dc21287fecc91c3ae78f0538cf30181
Instruction Fuzzy Hash: A6515F31900609EFCF218F65CC45EEF7FB5FB48754F20412AF925A12A0D7398991DBA9

Function 004172DF Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 004172FA
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 0041730E
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 0041733A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0041496A), ref: 00417372
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0041496A), ref: 00417394
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,0041496A), ref: 004173AD
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 004173C0
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004173FE

Strings

jIA, xrefs: 004173A8, 0041739A

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: jIA
API String ID: 1823725401-2590053038
Opcode ID: dcd9eacb03994a91aa73d6441958e3731b9086dbddb026e1bfa459d91ea586b1
Instruction ID: 8edd1d2af646b02ed721f394ba4169bf36ee68eca66066dd640126c456dfff16
Opcode Fuzzy Hash: dcd9eacb03994a91aa73d6441958e3731b9086dbddb026e1bfa459d91ea586b1
Instruction Fuzzy Hash: 7631D47250C219AFD7317F689C888FB7ABCE649354715053BFD66C3201E6288CC1E2AD

Function 00417606 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00417673
GetStdHandle.KERNEL32(000000F4,0041BD34,00000000,00000000,00000000,?), ref: 00417749
WriteFile.KERNEL32(00000000), ref: 00417750

Strings

..., xrefs: 004176C5
<program name unknown>, xrefs: 00417683
Microsoft Visual C++ Runtime Library, xrefs: 0041771F
x*B, xrefs: 00417614
Runtime Error!Program: , xrefs: 004176D9

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $x*B
API String ID: 3784150691-2083536112
Opcode ID: 9f3ee68eedca8c04870b7c4ba6519361572a149120d3a6d5458ca0bba870cf42
Instruction ID: d3223577c50248063a34d8f4d7298abe086d5d3d0ee639c6b3bd3f24b9ad2996
Opcode Fuzzy Hash: 9f3ee68eedca8c04870b7c4ba6519361572a149120d3a6d5458ca0bba870cf42
Instruction Fuzzy Hash: 5931D2726002186FDF20DA60DD46FDA377DEF89304F5005ABF544D6181EB78AAC48B5D

Function 0041883C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0041BE00,00000001,?,74DEE860,004256E4,?,?,0041848E,?,?,?,00000000,00000001), ref: 0041887B
GetStringTypeA.KERNEL32(00000000,00000001,0041BDFC,00000001,?,?,0041848E,?,?,?,00000000,00000001), ref: 00418895
GetStringTypeA.KERNEL32(?,?,?,?,0041848E,74DEE860,004256E4,?,?,0041848E,?,?,?,00000000,00000001), ref: 004188C9
MultiByteToWideChar.KERNEL32(?,VB,?,?,00000000,00000000,74DEE860,004256E4,?,?,0041848E,?,?,?,00000000,00000001), ref: 00418901
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,0041848E,?), ref: 00418957
GetStringTypeW.KERNEL32(?,?,00000000,0041848E,?,?,?,?,?,?,0041848E,?), ref: 00418969

Strings

VB, xrefs: 004188F2, 004188FD

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: VB
API String ID: 3852931651-2416070386
Opcode ID: f366ae1a1c4feb3856e7e49d67d86268e533ee02966d98845c911f14f75699a6
Instruction ID: 0deb4df31157d4fbbd2276260d368b45192e758527c12e7bc8b96f729eb23429
Opcode Fuzzy Hash: f366ae1a1c4feb3856e7e49d67d86268e533ee02966d98845c911f14f75699a6
Instruction Fuzzy Hash: 85418FB2A00209BFCF209F94DC86EEF7F79EB08754F10452AF915D2250C7389991DB99

Function 00417411 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0041746F
GetFileType.KERNEL32(?,?,00000000), ref: 0041751A
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 0041757D
GetFileType.KERNEL32(00000000,?,00000000), ref: 0041758B
SetHandleCount.KERNEL32 ref: 004175C2

Strings

$YB, xrefs: 004174A9

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID: $YB
API String ID: 1710529072-867103119
Opcode ID: 0f20f78b1d243ceb825b791af9b59c2038ed572102f9f62c4ccf998fd163e942
Instruction ID: 9157860cf2e7af3a35f89051d0ae9de0bf945cd889ae2d4a6076f2c4651d7c80
Opcode Fuzzy Hash: 0f20f78b1d243ceb825b791af9b59c2038ed572102f9f62c4ccf998fd163e942
Instruction Fuzzy Hash: B75135716086019FC720CF28D8897B63BB1EB05338F64466EC566CB6E0DB38C986C75D

Function 00415680 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0041569F
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 004156D4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00415734

Strings

__MSVCRT_HEAP_SELECT, xrefs: 004156CF
__GLOBAL_HEAP_SELECTED, xrefs: 0041570E

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 352f7edc9f3896d13c070371f2d33d0b51665e116eb32c5a0d287e401f1eefe3
Instruction ID: 6eb182bd46f731c3af8b1d07a07b8df2d0194a1b299ff80343aa6f034c3c884c
Opcode Fuzzy Hash: 352f7edc9f3896d13c070371f2d33d0b51665e116eb32c5a0d287e401f1eefe3
Instruction Fuzzy Hash: 56312671945648EDEB3186706C87BDF3B788B46704F6400DBD199D52C2E6398ECA8B2D

Function 00403A90 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

CharUpperW.USER32(00000000,00000000,?,00000000,00000000,?,00403B58), ref: 00403AAB
GetLastError.KERNEL32(?,00000000,00000000,?,00403B58), ref: 00403AB7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000,?,00000000,00000000,?,00403B58), ref: 00403AD2
CharUpperA.USER32(?,?,00000000,00000000,?,00403B58), ref: 00403AEB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,00000000,00000000,?,00403B58), ref: 00403AFE

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 7c2300f256f82e2aee6372cd28c35fbf20af8ddddc15953858da8d33bcd8cfd2
Instruction ID: dd72d820dddc2be4d64e736f5eaa813d5c8cd4bb6d440344005d5656a272e87c
Opcode Fuzzy Hash: 7c2300f256f82e2aee6372cd28c35fbf20af8ddddc15953858da8d33bcd8cfd2
Instruction Fuzzy Hash: D60144B64002187ADB10ABE49C89DEBBE7CEB04259F014472F952E2281E2796E4487A8

Function 004152F3 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,00416CBF,0041798E,00000000,?,?,00000000,00000001), ref: 004152F5
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00415303
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0041534F

Part of subcall function 00416CCC: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00416DC2

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00415327
GetCurrentThreadId.KERNEL32 ref: 00415338

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 9020ed6c5573c52789434ca8060b3935b73b18465b1892a80f2ba475462c6b54
Instruction ID: c348f308811c55cc6791f5f2c72cac7d5a6c02788d8c3db17f30136ca92006f7
Opcode Fuzzy Hash: 9020ed6c5573c52789434ca8060b3935b73b18465b1892a80f2ba475462c6b54
Instruction Fuzzy Hash: B4F09632600615ABC6312B70AC096DB3A51EB857E1B15413AF951972A0DB78888197DD

Function 0041843D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(004256E4), ref: 00418463
InterlockedDecrement.KERNEL32(004256E4), ref: 00418478

Strings

VB, xrefs: 0041845C

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: VB
API String ID: 2172605799-2416070386
Opcode ID: 3f0e7dfc381ab69d5717ddb5ba06b4fa70db5411652d110c580bb33579a080f3
Instruction ID: b2465ecea32c92352f716010131fb348419f683e9d2febfe3e70f5b1b578e6df
Opcode Fuzzy Hash: 3f0e7dfc381ab69d5717ddb5ba06b4fa70db5411652d110c580bb33579a080f3
Instruction Fuzzy Hash: 35F0C232201612EBD720AF56ECC19CF6755EB81326F50843FF00989190DF7899C2995E

Function 0041435F Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56ffb8a6685455f091880630799685eddd8ac587d3428563be9e88dd716d36c
Instruction ID: 1ac5c9ddcf095474d6e2a383ff06e8771fc838f6ee07df02b13506851481717d
Opcode Fuzzy Hash: d56ffb8a6685455f091880630799685eddd8ac587d3428563be9e88dd716d36c
Instruction Fuzzy Hash: C891F671D01618ABCF21AB69CC41ADE7BB9EB857A4F240127F814B6290D73D8DC18A6C

Function 0041636C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,00420838,00420838,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000), ref: 0041638D
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000), ref: 004163B1
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000), ref: 004163CB
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000,?), ref: 0041648C
HeapFree.KERNEL32(00000000,00000000,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000,?,00000000), ref: 004164A3

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 61edb7c5b2a57b73fa0373c8b0061bfd64d3e4def081ef99dbe098b98f3bc666
Instruction ID: 1d273cd761051d77879f543994291e2c1f364a84a1ace75b4c6a1ba38ea4645d
Opcode Fuzzy Hash: 61edb7c5b2a57b73fa0373c8b0061bfd64d3e4def081ef99dbe098b98f3bc666
Instruction Fuzzy Hash: 1D310370640711EFD3309F24DC85BA6B7E4EB84764F12823AE56997791E778E881CB8C

Function 00409504 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409509

Part of subcall function 0040935A: EnterCriticalSection.KERNEL32(?,?,?,00409680), ref: 0040935F
Part of subcall function 0040935A: LeaveCriticalSection.KERNEL32(?,?,?,00409680), ref: 00409369

EnterCriticalSection.KERNEL32(?), ref: 00409536
LeaveCriticalSection.KERNEL32(?), ref: 00409552
__aulldiv.LIBCMT ref: 004095A1

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$H_prolog__aulldiv
String ID:
API String ID: 3848147900-0
Opcode ID: a31f7f313dfc0da48c948196a335c5e8fea939b4dae7cffcd2385e59b1d35c73
Instruction ID: 81a485ad15cb22f282f6c018201ee4179c2b1d1cd2674c5f201a60282c37c453
Opcode Fuzzy Hash: a31f7f313dfc0da48c948196a335c5e8fea939b4dae7cffcd2385e59b1d35c73
Instruction Fuzzy Hash: C6315076A00215AFCB11EF65C8819EFBBB5FF88704F00442AE51673692D779AD41CB64

Function 004047A8 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004047AD
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,00000000), ref: 004047D1
FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,00000000), ref: 00404814
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000,?,00000000), ref: 0040482F

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FormatMessage$FreeH_prologLocal
String ID:
API String ID: 3392428314-0
Opcode ID: d8114c00c851820dfd69355ab4a5a7d10c3f97c7ff5c1a94d174072509a20bce
Instruction ID: b23ee79e455563f0a2b187c1bc8aea4849c6785c5b1f5abfa42b55bee9ed31b8
Opcode Fuzzy Hash: d8114c00c851820dfd69355ab4a5a7d10c3f97c7ff5c1a94d174072509a20bce
Instruction Fuzzy Hash: 451170B5A00159AFDF01BFA59C419FFBB7DEF44349F00847AE112721E2DB391A01DA68

Function 00409374 Relevance: 6.0, APIs: 4, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00413030: SetEvent.KERNEL32(00000000,0040756D), ref: 00413033

GetDlgItem.USER32(?,000003E8), ref: 00409397
LoadIconA.USER32(00000000), ref: 004093B1
SendMessageA.USER32(?,00000080,00000001,00000000), ref: 004093C2
SetTimer.USER32(?,00000003,00000064,00000000), ref: 004093D1

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: EventIconItemLoadMessageSendTimer
String ID:
API String ID: 2758541657-0
Opcode ID: 426d8240eb7a06a459b3f470407d996c0274358d2b71b1374ad8138c79f04d47
Instruction ID: 34d2fc59b34559bed7d893ef409eb69d6d7528a9cba69d030baf66432b50efa3
Opcode Fuzzy Hash: 426d8240eb7a06a459b3f470407d996c0274358d2b71b1374ad8138c79f04d47
Instruction Fuzzy Hash: 4D015A30100B00AFD3319F21DD5AB66BBA1FB04721F008A2DF5A7959F0CB75B942CB48

Function 0040D5A3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D5A8

Strings

, xrefs: 0040D75F
, xrefs: 0040D787

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: 74feb26567ea79c8fd9d5f3f589634721b0a9a4a518abdc39c0b6b7ccedab932
Instruction ID: 116f94ee193b6a60a58d4aec76a07daa8eefdeb27c95ac76265691768f75313a
Opcode Fuzzy Hash: 74feb26567ea79c8fd9d5f3f589634721b0a9a4a518abdc39c0b6b7ccedab932
Instruction Fuzzy Hash: CB712431D0020A9FCB24DF99D981AAEB7B1FF48314F20467ED416B7691D734AA8ACF54

Function 00417E5D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00417E71

Strings

, xrefs: 00417E96
, xrefs: 00417EBA

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: be8999de8ad5c30073bbd0379d60ad0f54c653f5d04d814f41e486670cb2e0db
Instruction ID: 669041dcfce0968cbe3c51124f50cac4b21f3f9a56807733dc4743f672ff05a2
Opcode Fuzzy Hash: be8999de8ad5c30073bbd0379d60ad0f54c653f5d04d814f41e486670cb2e0db
Instruction Fuzzy Hash: 65417C312482585AEB219714CC49FFB7FF9DB02714F5404E6D149C7153C2794AC6C7BA

Function 00417092 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Setup.exe,00000104,?,00000000,?,?,?,?,00414974), ref: 004170B5

Strings

C:\Users\user\Desktop\Setup.exe, xrefs: 004170A9, 004170B3, 004170D8, 0041710E
@%L, xrefs: 004170BB

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileModuleName
String ID: @%L$C:\Users\user\Desktop\Setup.exe
API String ID: 514040917-1516559220
Opcode ID: 84d053b036df48e784d9c40d8f72a4f01e20f52c816047791c4f4213c32035a1
Instruction ID: bf09e70cde018ed4875ba2e87c80884ade2fb8340569e7ccc03294431e74d33e
Opcode Fuzzy Hash: 84d053b036df48e784d9c40d8f72a4f01e20f52c816047791c4f4213c32035a1
Instruction Fuzzy Hash: 591151B6A00219BFC721EF94DCC1CDBBBBCEB08758B5100ABF50597201EA745F4587A8

Function 00415ECA Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,00415C92,00000000,00000000,00000000,00413CC1,00000000,00000000,?,00000000,00000000,00000000), ref: 00415EF2
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00415C92,00000000,00000000,00000000,00413CC1,00000000,00000000,?,00000000,00000000,00000000), ref: 00415F26
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00415F40
HeapFree.KERNEL32(00000000,?), ref: 00415F57

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 712f9e2f9eec85a92a3a672498402ffd9fd7e765c5a6c8233a1a124cbc29739c
Instruction ID: 8f6381cf99308f7e34b2c2e49534b1224184cafd179dea44f4322364d011a6a4
Opcode Fuzzy Hash: 712f9e2f9eec85a92a3a672498402ffd9fd7e765c5a6c8233a1a124cbc29739c
Instruction Fuzzy Hash: A6114C31300A01EFC7308F59EC86DA6BBB5FB85760791462AF156D69B0D3719887CF58

Function 004154B1 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154BE
InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154C6
InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154CE
InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154D6

Memory Dump Source

Source File: 00000000.00000002.4124492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4124476619.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124512599.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124528623.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124544516.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124558377.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4124574904.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: ec7037d00a0fc94f488d53f3a91d2e26ae03bdd42e29aafad6c46e686e3ec5a2
Instruction ID: a8e831e61b8b61633fe4a4176da74b0e9d16ee726bcd83620c475df078586321
Opcode Fuzzy Hash: ec7037d00a0fc94f488d53f3a91d2e26ae03bdd42e29aafad6c46e686e3ec5a2
Instruction Fuzzy Hash: 0AC00231A11138ABCF312B55FC048463FA6EB852A03518072A1045203186612C12EFD8

Analysis Process: WebCompanion-Installer.exePID: 6972, Parent PID: 6948COMMON

Executed Functions

Function 070D9E68 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VCi, xrefs: 070DA11F

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \VCi
API String ID: 0-664074302
Opcode ID: 2cf267b4f92485679d3b534c5cf78c22c33f4f1210663cd9bc1466d41e0b774f
Instruction ID: 36ef416f9123c9d92cdd9c7927f25d637e70e5d6dd841eb6c59cf293f5437a8a
Opcode Fuzzy Hash: 2cf267b4f92485679d3b534c5cf78c22c33f4f1210663cd9bc1466d41e0b774f
Instruction Fuzzy Hash: CAB119F0E0031A8FDB54CFA9C98579EBBF2AF88314F148629D815EB254EB749D45CB81

Function 017BF0D0 Relevance: .8, Instructions: 756COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29281e949ee386b582561016aa30c96dbcc736b20be32f1d188d0f69ef31993f
Instruction ID: 3b6dbb0369a9739513f239a6a34c701226ed2a572ec56b2ca5dbb92625aa5c91
Opcode Fuzzy Hash: 29281e949ee386b582561016aa30c96dbcc736b20be32f1d188d0f69ef31993f
Instruction Fuzzy Hash: 6062FD74B402158FCB15DF64D998BADBBB2BF88704F1085A9E90AA7395DF309D81CF50

Function 06AA05A8 Relevance: .6, Instructions: 615COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78da6178761f8ee01b7f27534c5f7f229c3c028951d8319b3d0a677b1dc0987
Instruction ID: da37154aa5184d0e510abbbe3998fd0bccf7b74cc8694726e02875283cb402c9
Opcode Fuzzy Hash: f78da6178761f8ee01b7f27534c5f7f229c3c028951d8319b3d0a677b1dc0987
Instruction Fuzzy Hash: B8422770A002148FDBA4DF68D8587ADBBB2FF88304F14856DD41AAB391DB799C45CB91

Function 017B0DE0 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee5bb9d69f851f7ebd76c47461bab9425736c36572cecde1901949401c058ba
Instruction ID: 12188d341a42208565726de42249a3c47ca9acfcec1915aafea96a0c4a7ee9e6
Opcode Fuzzy Hash: fee5bb9d69f851f7ebd76c47461bab9425736c36572cecde1901949401c058ba
Instruction Fuzzy Hash: C3423634B012158FCB54EB78E998BADBBB6FB88301F1085A9D4069B358DF349D45CF91

Function 070DB1C0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f160057f43ab43b7ac5f83e03f1b7b78c7dda312accde385b8133ee6c72c44da
Instruction ID: cfdf682c8d5b979359bda0b98bd844cc9caa570538ee68b9997ba76ab08ab055
Opcode Fuzzy Hash: f160057f43ab43b7ac5f83e03f1b7b78c7dda312accde385b8133ee6c72c44da
Instruction Fuzzy Hash: 0CB16AB1700305DFDB18DB6AD9546BEB6EBEFD8240F19C529E406A73A8DE35CC818760

Function 070DA738 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7737dcf4caa8f8068c16b526cef79a77bd348a86352a90aa832df6569ebd05f
Instruction ID: 768d26f452eb7a52b6f8495e38f5a3a2c81c2c4d6c920814b2d343c109dbcf46
Opcode Fuzzy Hash: d7737dcf4caa8f8068c16b526cef79a77bd348a86352a90aa832df6569ebd05f
Instruction Fuzzy Hash: F3B119F0E0030A8FDB54CFA9C9857ADBBF2AF48714F14C629D815AB294EB749C45CB81

Function 070D0040 Relevance: 4.2, Strings: 3, Instructions: 485COMMON

Download Yara Rule

Strings

, xrefs: 070D015E
Hoq, xrefs: 070D0A33
, xrefs: 070D013F

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $$Hoq
API String ID: 0-2557245781
Opcode ID: c689b363798482a44af1ec6cb8a101d57d71e6c9382ab68a3564d8a27776799d
Instruction ID: b5a3ea938a26dac474e78c65d4db8ab451ddbc06d4f9faf6e89231f422ee52f2
Opcode Fuzzy Hash: c689b363798482a44af1ec6cb8a101d57d71e6c9382ab68a3564d8a27776799d
Instruction Fuzzy Hash: F6328EB4D01305CFDB54CF94C688AA9BBF2AB05309F56C199D01A6F2A2D376DD89CF90

Function 017BB098 Relevance: 4.1, Strings: 3, Instructions: 331COMMON

Download Yara Rule

Strings

PHkq, xrefs: 017BB18C
PHkq, xrefs: 017BB11A
Hoq, xrefs: 017BB404

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: Hoq$PHkq$PHkq
API String ID: 0-3038693806
Opcode ID: 7bffe01859081bccec21517070043604d6e5ad31dc74032a599c3e6c1658bd30
Instruction ID: d32534eda56e8f58e299c4edb6beb6de3798610318b02b1a9d1cb3dc133a9bd7
Opcode Fuzzy Hash: 7bffe01859081bccec21517070043604d6e5ad31dc74032a599c3e6c1658bd30
Instruction Fuzzy Hash: 46C14C347002068FCB15EB79D594AAEBBB2FF89310F2485A9D905DB356DB34DC42CBA1

Function 070D2570 Relevance: 2.9, Strings: 2, Instructions: 435COMMON

Download Yara Rule

Strings

(oq, xrefs: 070D29D0
(oq, xrefs: 070D2888

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (oq$(oq
API String ID: 0-3207256227
Opcode ID: 0d83f536d6ff95b6959e72dcd509f2452981a533d5396133df54e942fd913ed8
Instruction ID: 6ecd0add237107a8cc3f87e4b73499ab89f6db7fdb52bbfe45b9701384d28d74
Opcode Fuzzy Hash: 0d83f536d6ff95b6959e72dcd509f2452981a533d5396133df54e942fd913ed8
Instruction Fuzzy Hash: 0DF19B757003059FCB15DF68D854AAEBBB2FF89210F14856AE806DB3A1CB35ED45CBA0

Function 070D0006 Relevance: 2.9, Strings: 2, Instructions: 413COMMON

Download Yara Rule

Strings

, xrefs: 070D015E
, xrefs: 070D013F

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-645672565
Opcode ID: 9253f2808cb2b5f9f5f3f799a122e5727034957c0efd8407fcb2b0fb42b79cb9
Instruction ID: 94513df3a1855bdf0540d03d8d0d55b118aca47706755a8b204e2a4a0b246cf8
Opcode Fuzzy Hash: 9253f2808cb2b5f9f5f3f799a122e5727034957c0efd8407fcb2b0fb42b79cb9
Instruction Fuzzy Hash: 0B225CB4D01705CFD754CF84C68CAA9BBF2AB05309F56C299D01A6F2A2D376D989CF90

Function 070D6FF0 Relevance: 2.8, Strings: 2, Instructions: 277COMMON

Download Yara Rule

Strings

4ckq, xrefs: 070D72E8
x, xrefs: 070D732F

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4ckq$x
API String ID: 0-3868820296
Opcode ID: 1477d2b60e16a62c9bdaa217281fcce841a5cd9caaa4666501de92ff3da59ae5
Instruction ID: 3c69600b7970e4553d9d216a84f9fc3a8f086af97f6e1e3349ecff705472cf85
Opcode Fuzzy Hash: 1477d2b60e16a62c9bdaa217281fcce841a5cd9caaa4666501de92ff3da59ae5
Instruction Fuzzy Hash: E58157B03083928FDB25876DD8806BEBBE5EF42304F185A67F545CB782E728DC818791

Function 017B8FD8 Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

C{0q^, xrefs: 017B9264
3{0q^, xrefs: 017B92AB

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 3{0q^$C{0q^
API String ID: 0-1434587665
Opcode ID: 9c8cddfa062983b168ae2a5d4e78f977778c089e1c22a88101c327889bab3019
Instruction ID: 882b1d39bedf7ddfc90314166418eff54c2fe63d4c98725c89cae44df9e38eb5
Opcode Fuzzy Hash: 9c8cddfa062983b168ae2a5d4e78f977778c089e1c22a88101c327889bab3019
Instruction Fuzzy Hash: 9491C175B002049FCB069FB8E558AADBBF2FF49314B0480A9E606DB366DF359C11DB91

Function 070D2AE0 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

,oq, xrefs: 070D2AF8
4'kq, xrefs: 070D2C34

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: ,oq$4'kq
API String ID: 0-2437386691
Opcode ID: 57a9ccd8107808d8e2e9290638cd3b43f5a182815807de0630978b31568489ce
Instruction ID: 11ab4871e68552d95293bdf7ab747ff1d86f4b43dfa633e643ef4f4130f4a63a
Opcode Fuzzy Hash: 57a9ccd8107808d8e2e9290638cd3b43f5a182815807de0630978b31568489ce
Instruction Fuzzy Hash: C151A0B1B002168FCB15DF6DC4505AEBBF6FFC9250B10816AE505DB3A9DE31DD4287A1

Function 017BA180 Relevance: 2.7, Strings: 2, Instructions: 174COMMON

Download Yara Rule

Strings

(oq, xrefs: 017BA28D
Hoq, xrefs: 017BA1F4

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (oq$Hoq
API String ID: 0-3084834809
Opcode ID: 543c533c9e6667c7489fef1705fcc91c4ac9cde1bc13066f15f4ba050f62d0ff
Instruction ID: 8e755305fd7973622e38a7a14ba4f0ec83c9756a91957bc80880dfa4d0b55ce4
Opcode Fuzzy Hash: 543c533c9e6667c7489fef1705fcc91c4ac9cde1bc13066f15f4ba050f62d0ff
Instruction Fuzzy Hash: C351E2317042048FDB25AB79E458BAEBBB6EFD9350F14406AE902DB386DF319C42C790

Function 070DB770 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

(oq, xrefs: 070DB80A
(oq, xrefs: 070DB836

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (oq$(oq
API String ID: 0-3207256227
Opcode ID: 3f008068320234be72b18443be111c7ce47024fd8a87c0bca26bc197e5db27e0
Instruction ID: 86f32a4a205b64a01135bd8efc2d1a4f02e67acfe95f9c41bffaa3b6e2933681
Opcode Fuzzy Hash: 3f008068320234be72b18443be111c7ce47024fd8a87c0bca26bc197e5db27e0
Instruction Fuzzy Hash: 7E312DB17043159FD355AB6CD4146AE7FE6EBC9A10F05866ED002AB381CE31AD04C7A2

Function 070D4144 Relevance: 2.5, Strings: 2, Instructions: 21COMMON

Download Yara Rule

Strings

$kq, xrefs: 070D4154
$kq, xrefs: 070D4148

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 89b29c79e5c697112d9b9c5660d9853ffc4bd31fa7a658eebe04b0bbcd2c136c
Instruction ID: 4f4ea5734d50bd0aed42ee4cbf14597aa99a70c8ccfc1de3788d28a93ce0936f
Opcode Fuzzy Hash: 89b29c79e5c697112d9b9c5660d9853ffc4bd31fa7a658eebe04b0bbcd2c136c
Instruction Fuzzy Hash: 9FE08C7AB2135A8F8638DA19E80006BBBE6EBA5A10731426BE91187310C6359C058780

Function 017B4A58 Relevance: 2.0, Instructions: 2005COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76cf6b4f1dd722cdafa50ce56a1c285debc6b7c4e9d4c34ca1c82017ab8048cf
Instruction ID: 717ea0f084c34ca627633dfa7dbedc8c31e958a0432c8cdb1b5e4e734a20cb41
Opcode Fuzzy Hash: 76cf6b4f1dd722cdafa50ce56a1c285debc6b7c4e9d4c34ca1c82017ab8048cf
Instruction Fuzzy Hash: 1523303DA02244DFCB76AFA1E61C65DB732FB8934672085AADB0216764C7BB8C55DF00

Function 017B4A68 Relevance: 2.0, Instructions: 1978COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5869ce14c302142aa3be33028039a53be278ad9c67222a214fabe228371f6e
Instruction ID: 4345be84196f5636f3c3b777360f49dca6cc42db0503f37fdb366f80652547a3
Opcode Fuzzy Hash: 7c5869ce14c302142aa3be33028039a53be278ad9c67222a214fabe228371f6e
Instruction Fuzzy Hash: 7A23203DA02244DFCB76AFA1E61C65DB732FB8934672085AADB0216764C7BB8C55DF00

Function 070D12C8 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

(oq, xrefs: 070D171C

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: af4d6109bf0e5047f73f13a6e36bae19c9ace5fc7a2ff627993763952e5e43bb
Instruction ID: f5e0358a71b40200465e042c66d4c236bfd6aec612ad0ab2f2137438a13de036
Opcode Fuzzy Hash: af4d6109bf0e5047f73f13a6e36bae19c9ace5fc7a2ff627993763952e5e43bb
Instruction Fuzzy Hash: 7BF15BB4A0035A8FDB15CFA8C488B9DBBF2EF45300F168255D845AB3A5DB74ED85CB50

Function 017B178E Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

fpq, xrefs: 017B17B6

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: fpq
API String ID: 0-3306291180
Opcode ID: 895b3520ae18b4fbb226939faacdbb5033f18de82227943def0913357dac6110
Instruction ID: f321e17ae11b3f2d69fb914a56bcde06624a195e18430264a34e00a11bcf7f64
Opcode Fuzzy Hash: 895b3520ae18b4fbb226939faacdbb5033f18de82227943def0913357dac6110
Instruction Fuzzy Hash: ADB1E270B012929FCB159B78D5647AEFBF2AF85300F1884AAC445DB3AADB34DC85C791

Function 070D9E5C Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

\VCi, xrefs: 070DA11F

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \VCi
API String ID: 0-664074302
Opcode ID: d5bed28c62ba9050b1ea5e503f11a2f671be54052507d5da6da46d8ed2c1636a
Instruction ID: c426dd002a89ae53d0a2658b68c858e9817976e61fead6abf3aab7d92464410e
Opcode Fuzzy Hash: d5bed28c62ba9050b1ea5e503f11a2f671be54052507d5da6da46d8ed2c1636a
Instruction Fuzzy Hash: BAB116B0E0031A8FDB50CFA9C9857DEBBF1AF48314F148229E815AB294EB749D45CB81

Function 017B9F30 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

(oq, xrefs: 017BA0B8

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 1825da606794ed297edc70117038887aa098f9dddfe3c82a6e1a041c89ea6a55
Instruction ID: 22696a40e91eabc61d1cbaa999d2d96958d04d3027930217b4d11f328483df7c
Opcode Fuzzy Hash: 1825da606794ed297edc70117038887aa098f9dddfe3c82a6e1a041c89ea6a55
Instruction Fuzzy Hash: 54516970B002059FDB15DF69D494BAEFBF6AF89310F1980AAE905AB352DB74EC41CB50

Function 017BCD58 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

4'kq, xrefs: 017BCEB7

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 77b7a7ec7ba09638f388fa98f510fb66c6a845cd8aaaddad36b3160ebad5314a
Instruction ID: b1a8e9b0ef5d176ba09f45c6bfa909d327a99aafb731d5ae8ae26d8fd82df034
Opcode Fuzzy Hash: 77b7a7ec7ba09638f388fa98f510fb66c6a845cd8aaaddad36b3160ebad5314a
Instruction Fuzzy Hash: 8A41EF357042008FD32AA639A49876ABBA6EBC6624F14C4BDE905CB395EF35DC428391

Function 017B87A0 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

(oq, xrefs: 017B87FE

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 8979bb5129fe4d037c2a4adc37e30d7b6765137cb0ecbe5df1d126dbeb45be5d
Instruction ID: 78968c6989a198d366fd5afd1717e7488ff77d6f85dc9c3355d378e9cafbf3de
Opcode Fuzzy Hash: 8979bb5129fe4d037c2a4adc37e30d7b6765137cb0ecbe5df1d126dbeb45be5d
Instruction Fuzzy Hash: 1C4123353043408FC716AB7DA89865ABFEAABD625031584BAD905CB356EE34DC05C792

Function 070DD830 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4ckq, xrefs: 070DD88B

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4ckq
API String ID: 0-3046585941
Opcode ID: 5a949c5b5eaa21ab7d07042b0231ce225d0680aca59418d1b2f26c25ea8c5f62
Instruction ID: 78473f6f23cc337acef165d3e10da50612cfdea63b493a73bc61180133c3cf71
Opcode Fuzzy Hash: 5a949c5b5eaa21ab7d07042b0231ce225d0680aca59418d1b2f26c25ea8c5f62
Instruction Fuzzy Hash: 4B41C0B0700301AFDB15CF29E915B7ABBFAAB88700F14412AE901CB3C5CA7ADD01CB61

Function 070D1F00 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

(oq, xrefs: 070D1FBD

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 6562db55d4baa1e7d8a4fccbc08fc073d2382c72e0b35db09c519c75eaa25cf8
Instruction ID: 1257aa19a76d14218df3e22a378b80c4869564461608fed80e4b8287d69518c2
Opcode Fuzzy Hash: 6562db55d4baa1e7d8a4fccbc08fc073d2382c72e0b35db09c519c75eaa25cf8
Instruction Fuzzy Hash: 2441B2757002199FCB15DF64D818AAEBFB2FF89304F14816AE506E7365CB359D11CBA0

Function 017B96F8 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

4'kq, xrefs: 017B97D4

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: ddc87ce0d90774a5caf3378212e6032b1773fdaeda700c93868945582ee271bf
Instruction ID: 04db9a6cb50f5c6696e8d5557e2da09b7822464cc2afa88cdfa3393a97ce9866
Opcode Fuzzy Hash: ddc87ce0d90774a5caf3378212e6032b1773fdaeda700c93868945582ee271bf
Instruction Fuzzy Hash: 5D41EE71B042508FCB16DF78D884AAEBBF5EF89314B1580A9E615DB366DB30DC01CBA1

Function 070D179A Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(oq, xrefs: 070D18B2

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 6710455da46135676130468a4cb0deac6ff559f465c26b672a0be402e33b0f12
Instruction ID: cd61383b441d5a0b043d11f1f7d2ed95e1331e6182387d52e8c309710bda4dd7
Opcode Fuzzy Hash: 6710455da46135676130468a4cb0deac6ff559f465c26b672a0be402e33b0f12
Instruction Fuzzy Hash: 4F41B274B0430A9FCB54DF69C884AAEBFF6EF89310F218169E445A7351DB30AD01CBA1

Function 017B3CD0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

(oq, xrefs: 017B3DE8

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 9ca64f0e7569f5392b2d05de17ade95aafd29fdb0dc860fc56644ff5d3e1ce92
Instruction ID: 4d2661a34a83c3a1a2046aba2db168cee50e146ef0c4688b3383a1ad8fd0fe20
Opcode Fuzzy Hash: 9ca64f0e7569f5392b2d05de17ade95aafd29fdb0dc860fc56644ff5d3e1ce92
Instruction Fuzzy Hash: 0331AE30B042048FD708AF79E9587AEBAB6FBD8700F148469E406E7395DF748C868B51

Function 070DD820 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

4ckq, xrefs: 070DD88B

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4ckq
API String ID: 0-3046585941
Opcode ID: 61aa59e7e351e06adb0bc57730323e53119b70149709e545ecf70ab748953ec7
Instruction ID: 5aeda4a34a9153a38db5cdd5597c2a0da1315b5c39a970108eaeea237ca5166c
Opcode Fuzzy Hash: 61aa59e7e351e06adb0bc57730323e53119b70149709e545ecf70ab748953ec7
Instruction Fuzzy Hash: E231E2B07013029FDB55CF69E805BBEBBFAEB88310F08416AE505D7284DA39DD01CBA1

Function 017B4381 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4'kq, xrefs: 017B43C2

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 1384dd82695a60f881626ecacd293f62027e7d4deeb7fd56d596712b97e03e98
Instruction ID: 7c47eaca2e11c46149d8ecf6bba9712f86b47b194e3fdb38d0db56ba8a9b4f72
Opcode Fuzzy Hash: 1384dd82695a60f881626ecacd293f62027e7d4deeb7fd56d596712b97e03e98
Instruction Fuzzy Hash: 14319D312006428FC315EB39E65855EBBE2FFD4214324C92DD05787768DF71AC8ACB82

Function 070DBA80 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

PHkq, xrefs: 070DBB16

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: c9c8cd503c353fd3605b206c20a97bcdf6a25fdca6772cc75f3eaefb0754c198
Instruction ID: 0cdf9fc1358fec929a79276801237cba916650d4dcac030fb29da363cbebcce8
Opcode Fuzzy Hash: c9c8cd503c353fd3605b206c20a97bcdf6a25fdca6772cc75f3eaefb0754c198
Instruction Fuzzy Hash: F521B3B1700209DFCB14DB69D858AAEB7FAEF88310F118129E402D7364DF758D00CB90

Function 070DB999 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

(oq, xrefs: 070DB9DE

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: c4ac87414bb9b417ce94c440e053330690b084c3fd5a098bab06c1a542970037
Instruction ID: 635b66d1ba560504f309be79fbb4632b1cb98774fd743a55bf0c3ea86caa7279
Opcode Fuzzy Hash: c4ac87414bb9b417ce94c440e053330690b084c3fd5a098bab06c1a542970037
Instruction Fuzzy Hash: EF1138313087905FC306A73CE81489EBFE6EFC671035A85AFE405CB7A2DE249C458791

Function 070D72D0 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

4ckq, xrefs: 070D72E8

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4ckq
API String ID: 0-3046585941
Opcode ID: 8a067d8d7cc3a09b7db1001aa921350b945093b69110aec25563b7bccfcefc4e
Instruction ID: 7c5ff31c7a01c9387c3cae59f18c944e13761d183bbc4d230b418515540bd0c7
Opcode Fuzzy Hash: 8a067d8d7cc3a09b7db1001aa921350b945093b69110aec25563b7bccfcefc4e
Instruction Fuzzy Hash: D911BF71700315AFCB64DF79A909BBF7AE9EB88700F044029F505C7280DE789E00CBA1

Function 017B8D30 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

4'kq, xrefs: 017B8D39

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: e68fd76630a5f03b73b71d289ef705a45b829bbe05af201dfb3a6f55925c2ada
Instruction ID: d2f67550f85c2b43a8ad0077cae076e782e08bbc37f4c26bc948233ebea69d59
Opcode Fuzzy Hash: e68fd76630a5f03b73b71d289ef705a45b829bbe05af201dfb3a6f55925c2ada
Instruction Fuzzy Hash: AB1126353002508FC722AB78F14C15ABBA5EFA5300714867AC906CB749EF70E846CB82

Function 070D2AD1 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

,oq, xrefs: 070D2AF8

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: ,oq
API String ID: 0-651702701
Opcode ID: f40b6378fe1d04c64c0dc9f69b93b616ae81da6ed797aeecc2f79eef9648e7ac
Instruction ID: cc872158f397fc9bbc5b73757fb2f16f80a17c20e5c4ab6014b78c326a8823c7
Opcode Fuzzy Hash: f40b6378fe1d04c64c0dc9f69b93b616ae81da6ed797aeecc2f79eef9648e7ac
Instruction Fuzzy Hash: 1E01D1707042465FCB02DB6D88509ABBFF6AFC9250714416BE944CB355CA30DC11C3A1

Function 017B8D20 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

4'kq, xrefs: 017B8D39

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 8005c72b004757919c442bdd2e8b0a6b89632ff1afbda3477bc76a68ff3c162f
Instruction ID: 3d2a4fdc7e23c28bca19883738738f2fa40a72eac286e1da1e64f8eb5aa966ec
Opcode Fuzzy Hash: 8005c72b004757919c442bdd2e8b0a6b89632ff1afbda3477bc76a68ff3c162f
Instruction Fuzzy Hash: 3DF022303046504FC322A728E10829AFBA1EFD5200B24C66ED4818B35ACF719C4A8782

Function 017B7240 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

k9Y!0, xrefs: 017B725F

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: k9Y!0
API String ID: 0-1825060378
Opcode ID: df7411d9a7e8e92d52a9cd8101bac5331965c63b6db4a88515651d5d7a0151eb
Instruction ID: e7c10588cf9db0fc5aee4e37597191656166482c75e3ca57eb0e16e650085268
Opcode Fuzzy Hash: df7411d9a7e8e92d52a9cd8101bac5331965c63b6db4a88515651d5d7a0151eb
Instruction Fuzzy Hash: 87E07D3220C3942FCB079B7C88902EA7FF9C9C6130B0000EBF088CB143EA605D4843E6

Function 017B7250 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

k9Y!0, xrefs: 017B725F

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: k9Y!0
API String ID: 0-1825060378
Opcode ID: b02562d066b66a5de593f2949cfa2a37a4706a794d89bede9f527259b5123048
Instruction ID: 5e3561155790245c2252a7d6bfa0751fe26706197e7dd8f2617dfbfd644803b4
Opcode Fuzzy Hash: b02562d066b66a5de593f2949cfa2a37a4706a794d89bede9f527259b5123048
Instruction Fuzzy Hash: 5ED012726442286B4B05EAAD54105DF7FDDDA84570F01447AD509D7341EE715E8042D9

Function 070D5B58 Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e065effef8567b538555d07bb710aaf32352b80d2b91c33c47a894335e58fa7
Instruction ID: c335e4233beb3838a11ca5a1e2632ece09050af76954e7bd4a7e5ab66521b91f
Opcode Fuzzy Hash: 3e065effef8567b538555d07bb710aaf32352b80d2b91c33c47a894335e58fa7
Instruction Fuzzy Hash: 7E326BB4B003499FCB15DF64D858AAE7BB2FF89300F148569E9029B3A5CB31DD51CBA1

Function 06AA0598 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 031eeef7176c27f9ba323875480a729e8a0d2672802436a6412a90d48a7a3ca7
Instruction ID: 06c5516853db67f906442141117c3f18485e3bc9402fead3c4a3e3ce43b60f01
Opcode Fuzzy Hash: 031eeef7176c27f9ba323875480a729e8a0d2672802436a6412a90d48a7a3ca7
Instruction Fuzzy Hash: 9402F574E002188FDBA4DF68D9987BDBBB2FF88308F14812ED416A7391DB799845CB51

Function 017BE7F8 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea20e86cf1ca3338ea6cda987f3c226b950a28b7b356ed209ccde767786f81e5
Instruction ID: d5b177f5c880dfccc516003b7853811e239162b76663ae072e01aeee22c8a019
Opcode Fuzzy Hash: ea20e86cf1ca3338ea6cda987f3c226b950a28b7b356ed209ccde767786f81e5
Instruction Fuzzy Hash: 92E178747402118FD714DF78D898AAABBB6FF89300B1584A9E906CB3A6DF34EC45CB51

Function 070D1245 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45fccea38480333d629db05d18b5ee026c8da0f8b1590f9a0642df6a4ec0db3e
Instruction ID: d241c48ed8f3a0525c9b83a6481754089436619fd32c159b3bd47eff1a00600e
Opcode Fuzzy Hash: 45fccea38480333d629db05d18b5ee026c8da0f8b1590f9a0642df6a4ec0db3e
Instruction Fuzzy Hash: 1FF17BB4E0035A8FDB15CFA8C588BADBBF2EF45300F168255D805AB265DB74ED85CB50

Function 017BD9E0 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c186ed486b72e8c66a0a9cf9b4fd5b41382483da453296ff4f8f9362962ffa
Instruction ID: 0eb18436ff72257ea5ba0e000e6f5ce11e66fc50f402e3b65547a5450578a8ad
Opcode Fuzzy Hash: 07c186ed486b72e8c66a0a9cf9b4fd5b41382483da453296ff4f8f9362962ffa
Instruction Fuzzy Hash: E5E12E34A00205DFCB25DFA9E598A9EFBB2FF88314F148568E4169B365DB70EC45CB90

Function 070D12C1 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864176b997861cd7e728eb4457e5d9aed0bdd9dd816afcf8f13e2f2274d8d5da
Instruction ID: 70a917939d4f86abd40b7ead6b90923f0c8296e85c4ccc6353539d8c0ee9f417
Opcode Fuzzy Hash: 864176b997861cd7e728eb4457e5d9aed0bdd9dd816afcf8f13e2f2274d8d5da
Instruction Fuzzy Hash: 7CE149B4E0035A8FDB55CFA8C588B9DBBF2BF49300F168254E805AB265DB74ED85CB50

Function 06AA1590 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 019174de8459f73c8dd9200046b2a3c6b02dace1fc42dea0b6c63c0ca16899cb
Instruction ID: cb7be2ed54d27e49eacd08a1ed35152afb2bef74a3ab612dfacf9ed5461db11a
Opcode Fuzzy Hash: 019174de8459f73c8dd9200046b2a3c6b02dace1fc42dea0b6c63c0ca16899cb
Instruction Fuzzy Hash: DB51C071A053905FD702DF2CE8646EABFB5EF86304F0085ABC4858F2A2DB758D498BD1

Function 017BF6F9 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752a46072905653de3e5297657a0bbc53fcce016898ff67b7f9fd5ba5cead7f2
Instruction ID: 85546b7a00796cee1115f30100884254f5186688bfc6d15dd6e9be141512f53a
Opcode Fuzzy Hash: 752a46072905653de3e5297657a0bbc53fcce016898ff67b7f9fd5ba5cead7f2
Instruction Fuzzy Hash: 47D11B34A40219DFCB15DF78D898BADBBB2BB88301F2084A9E50AA7355DF319D85DF50

Function 070DA72C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab650a4b13dce899bc4f869b88bcf6d5998a0d9827c59c49fad311c280f329d
Instruction ID: e37f1c0be0066d6e62e03e2f5f617acc1973936d90febef7ac923581ce33b12c
Opcode Fuzzy Hash: fab650a4b13dce899bc4f869b88bcf6d5998a0d9827c59c49fad311c280f329d
Instruction Fuzzy Hash: 2FB12BF0E0031ADFDB50CFA9C98579DBBF1AF48714F148629D815A7294EB749C45CB81

Function 070D18F0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424ba6539209f59902650daa9ff0e29049dca6b70aae6a2f7c4a1bedba64d6bf
Instruction ID: e6476fa2d51b44d221f643163ad0960511effc2568dbb76a3be211a266ba7a2a
Opcode Fuzzy Hash: 424ba6539209f59902650daa9ff0e29049dca6b70aae6a2f7c4a1bedba64d6bf
Instruction Fuzzy Hash: 268169B171031EEFCB548F58C84486EBBF7FF89260B514669E9269B364DA31DC41CB90

Function 070D1BC9 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39550ac50d3ea928afe45ec8daa8b113d338774b0b5bf7162aff94f847ad6cad
Instruction ID: 3a9868a3ed1eeb3103619b6152b473e1cda5ea9f6186a279ce176df4654d9c2b
Opcode Fuzzy Hash: 39550ac50d3ea928afe45ec8daa8b113d338774b0b5bf7162aff94f847ad6cad
Instruction Fuzzy Hash: 43A1A275A00219EFCB15DFA4D998A9EBBB2FF88310F158159F912A7365CB31EC12CB50

Function 017B98A0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c865f2a7edb8ee92caa54e38dca3f812d4c0e6c1add6ac843057acf208ff33e3
Instruction ID: ad3fa58181c1584b5fa806d25e72cc75ff49091ebdd1c80ffbd43c574234c09f
Opcode Fuzzy Hash: c865f2a7edb8ee92caa54e38dca3f812d4c0e6c1add6ac843057acf208ff33e3
Instruction Fuzzy Hash: 6E61E1357012018FDB656B7DA55C3AEBAEAEBD5285B1884B8EA06C7385EF38CC41C750

Function 070DE2B8 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d31da902451f756a1d2c3103d634b5be1fbca07c5d53201f6683eba2483801
Instruction ID: 339d324688a9868d510662e89f76b6910c4bc2406e9669e83e8f2368e1f3d38e
Opcode Fuzzy Hash: 51d31da902451f756a1d2c3103d634b5be1fbca07c5d53201f6683eba2483801
Instruction Fuzzy Hash: 99715CB4B003059FDB14DF79D6586AEB7F6EF88200F148529D40ADB2A4DB74ED41CB90

Function 070DDEFE Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c0f939e15836ec9d5fafc5628113177fc130d8c381d7ab012d8fe29e212e41
Instruction ID: 312dc9de030cd3d9c804e4956d5b08ea34b0a3a9243a3ce0d68743a392bf1d44
Opcode Fuzzy Hash: f8c0f939e15836ec9d5fafc5628113177fc130d8c381d7ab012d8fe29e212e41
Instruction Fuzzy Hash: 8D718E74B05342CFCB05DF78D68449A7BF2EF8520071449AAD405DB32ADB35ED86CBA0

Function 070DE2A8 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c7435ad432f1b64222a200791d8b64ad0134e85a07efe589463fed65a9c33c
Instruction ID: 06fab6f650eb665c986293675aff5d8341e1b8b042605f9107bd91d69bc03856
Opcode Fuzzy Hash: d5c7435ad432f1b64222a200791d8b64ad0134e85a07efe589463fed65a9c33c
Instruction Fuzzy Hash: F0719DB4B003059FCB54DF79D5486BEBBF6EF88200F148229D40A9B264DB34ED41CB90

Function 070DFC28 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66018fb1cfa0c0ab5768a096dbfcff9822303ff69f0ab0f8c8c30bc03bcb11d0
Instruction ID: fac70256aeaf15ea8d23ca90aae3fcd4a81ea98cfc0db6ecd4ccf08f16b2031e
Opcode Fuzzy Hash: 66018fb1cfa0c0ab5768a096dbfcff9822303ff69f0ab0f8c8c30bc03bcb11d0
Instruction Fuzzy Hash: 8C8129B4B002069FCB44CF68E554AADB7F2FF88314F258558E816AB361DB35ED41CB90

Function 017BD9D0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3c2d99d7177a13ffe4fce7de3618a513ddc8d96d53d01f87e4d073ad3c042b
Instruction ID: 95cc15283ad7c59c7bee80652779970fba90d1a34ebcadd9ad1131706fe89282
Opcode Fuzzy Hash: 7e3c2d99d7177a13ffe4fce7de3618a513ddc8d96d53d01f87e4d073ad3c042b
Instruction Fuzzy Hash: E581E774A00205DFCB14DF68E598AADBBB2FF88314B158569E816AB365DB30EC45CF90

Function 070DFC12 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a0fb62801a9e0f7578bf9b75ed958491f59ef2fb331fbb5a0cf75fea8f489b
Instruction ID: 08fa7ed2b85f65d32920976d37bf2d5ed1842dfb3d67a45cfc2423bd231ea05d
Opcode Fuzzy Hash: 59a0fb62801a9e0f7578bf9b75ed958491f59ef2fb331fbb5a0cf75fea8f489b
Instruction Fuzzy Hash: A5615CB1B003068FCB45CF68E154AADBBF2AF89314F158559E812AB361D734ED41CB90

Function 070D21E0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3e01fe40e261656ceaa7037fefdea6b285120bedecdb718555096ab7afd3c9
Instruction ID: 213ccd71e166a3566d00fec304d4a965ce097c8d4f6abb1e45d4c4cb9ae80ab2
Opcode Fuzzy Hash: 8a3e01fe40e261656ceaa7037fefdea6b285120bedecdb718555096ab7afd3c9
Instruction Fuzzy Hash: 6651D1B1A04301DFCB69DF68D49897EBBF6FF8A310B1542AAE5068B761D770AC41CB41

Function 070D5B49 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e2cf29128854135462f6479f8f9f3c40858af5a03cc4367ed076fb4823508d
Instruction ID: ccb259b774eca8ab1db3f718119fb17ddb63b711434fdbb8b679cb55a062c793
Opcode Fuzzy Hash: 19e2cf29128854135462f6479f8f9f3c40858af5a03cc4367ed076fb4823508d
Instruction Fuzzy Hash: D8518FB070030A9FDB54DF69E854AAE7BF6EF49211F044169E912DB361DB30DC61CBA1

Function 017BD320 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c8dd54cfedcc0d6286a2171139daf560ba4990c881295927aa4be2190b1670
Instruction ID: c45c28508a9ab3c786140153e2f6bb6f0f8e7da36b697880381405bfe4210c92
Opcode Fuzzy Hash: 61c8dd54cfedcc0d6286a2171139daf560ba4990c881295927aa4be2190b1670
Instruction Fuzzy Hash: EF510E34A51219EFCF24DFA4E994AEDBBB3FF88315F208068E901A7365DB359841CB50

Function 017BDDA7 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f2db7901a783168188d0b5e1ddde523d55fe4703effab043910030fbba351d
Instruction ID: 36e68abe7a62be9243a4fa7d7e478460414b5c2c4b02185681c402d90573d5c8
Opcode Fuzzy Hash: d9f2db7901a783168188d0b5e1ddde523d55fe4703effab043910030fbba351d
Instruction Fuzzy Hash: DE51B534A00209DFDB24DFA4E594AADBBB2FF88314F158558E906AB365DB31EC42CF50

Function 017B32A8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee486b10f245e94539b6ba8f5dfd52cd662cf5200d2efb0e503861f208f2451
Instruction ID: 79f11991f11a490a23cc8a91192cae31e20242d7f9e3465016b46020113fbee4
Opcode Fuzzy Hash: cee486b10f245e94539b6ba8f5dfd52cd662cf5200d2efb0e503861f208f2451
Instruction Fuzzy Hash: FE4192707002159FD718EF79E6947AEBAE3FF94600F14842CE5029B3A4DF359C858791

Function 070DBCA8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a830c50bcc331a8396b00c8c812497274cab4f151d430964012d0b4db29057
Instruction ID: 6e8cc39edb6cbe9e7e19dfaeee04e4505fcd8a6735254dbf484893e53db183e9
Opcode Fuzzy Hash: c6a830c50bcc331a8396b00c8c812497274cab4f151d430964012d0b4db29057
Instruction Fuzzy Hash: BE516C707002458FCB45DF69C8589AEBBF2EF89710B1586AAE006DB3B6DB30DD05CB90

Function 070D53E8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eda71c5bfab7a8deb97b7c710fdb81d85de9d04fff6d2bcac1fef5054414086
Instruction ID: 781185bebc91868554382bf7831729fa4b3ddca4d1d0fe9a239edc2d285565aa
Opcode Fuzzy Hash: 8eda71c5bfab7a8deb97b7c710fdb81d85de9d04fff6d2bcac1fef5054414086
Instruction Fuzzy Hash: 5B418E2156E7E15FD703AB3CA9B04D57FB09D8322871A05E7C1D0CF0A7D55888ADC3AA

Function 06AA1F58 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8560bc03217c2951e013cb5475ddd5229244841d7d5c0a181a8ab16b583ed39c
Instruction ID: b9e7b5c86a5285e4955c5944166eade234ac19f76519076350de4df04b150b80
Opcode Fuzzy Hash: 8560bc03217c2951e013cb5475ddd5229244841d7d5c0a181a8ab16b583ed39c
Instruction Fuzzy Hash: 3141D6303043408FC758DB3DD49496ABBE6EF8931472485AEE056CB3A6DB35EC46CB90

Function 017B7060 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f31803ae95655fb22b9e6732042064b305d95f38cf9279e53384ab3618780c
Instruction ID: ddefdd31a9c3d7433fa9d9e50280917c852733d9cf79ff3cb3167fdf11f6e521
Opcode Fuzzy Hash: 60f31803ae95655fb22b9e6732042064b305d95f38cf9279e53384ab3618780c
Instruction Fuzzy Hash: 2941B030B042599FDB05EB78E8587AEBBB2AFC1700F0480A5E501DB3D5DF788D0587A1

Function 06AA1740 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb1c641faeed54d20f3d7246f4563ff6406f6c34e32041c9c3dad21c50c5366
Instruction ID: ce4a1c999a2cb1680a2f68484fb13869761cb8e57223e967ce83d1bc7831a3c1
Opcode Fuzzy Hash: dfb1c641faeed54d20f3d7246f4563ff6406f6c34e32041c9c3dad21c50c5366
Instruction Fuzzy Hash: B141B470B002049FCB01DF28E4447AEBBB6FB88345F10892ED4069F366DBB59E498BD1

Function 070DFE25 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d160919be60ee469f1ffc0b8c185290147786247a2cc18e5eb2798d07a3831
Instruction ID: c5d3efb49a2f6cd5afa3ff049ff86c28afc5f130c5bff1bc3265f1d8410a526a
Opcode Fuzzy Hash: 46d160919be60ee469f1ffc0b8c185290147786247a2cc18e5eb2798d07a3831
Instruction Fuzzy Hash: 7E311975B0031A9FCB09DB68E9505AEB7B7FFC8710B108628D816A7368DF35AD458BC0

Function 070D7F75 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1f23f6f57c9182b00f5d180f75e1aef040afc590fe9f65f464aea726911090
Instruction ID: f40d1e55ec50c3bf5f5eddc8cbb1861563194087e3fe5ec66a95fa5ca37349c6
Opcode Fuzzy Hash: cd1f23f6f57c9182b00f5d180f75e1aef040afc590fe9f65f464aea726911090
Instruction Fuzzy Hash: D941EFB0D00349DFCB14DFA9C880ADEBFF5BF48310F24852AE819AB254DB75A945CB90

Function 070D2561 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a158937f9bfb6f9163b94984747d2e459d0f829c08ed45f005870487503007
Instruction ID: 6ba1517e128b2dcdf01ce667bfe9a63603baf02c2db3976c498dd65c86390458
Opcode Fuzzy Hash: 65a158937f9bfb6f9163b94984747d2e459d0f829c08ed45f005870487503007
Instruction Fuzzy Hash: E6315A70304306AFDB25CF25D894AAA7BE6FF89354B049569F846CB365CB30EC55CB90

Function 017B77D8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7913453797de731c19d99d118489e374720f267051b0eb2541fed3dbff4f132d
Instruction ID: 8619fbe976215f8c122774f437a037ca81cdbe000f7f89ec6ffd405c1a261c82
Opcode Fuzzy Hash: 7913453797de731c19d99d118489e374720f267051b0eb2541fed3dbff4f132d
Instruction Fuzzy Hash: 3B41BC31E007479ACB11AFB9E900689B7B1FF95320F25C72AE059B7241EB31B9D5CB90

Function 070DE188 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc3027c17e7a0a84165d53238991883559dfbd069b27bfc5100c95360485410
Instruction ID: 8a1383248797f8a73ce1225264ad34d22ca38813b774d2f5a144370c8a8b339b
Opcode Fuzzy Hash: 8bc3027c17e7a0a84165d53238991883559dfbd069b27bfc5100c95360485410
Instruction Fuzzy Hash: B831B174B023829FCB15ABB8E54406E7BE6EFC6200B14086ED5019B366EF34EC05CF90

Function 06AA0298 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7698dca4e0478af94a1313fbe2253f0b6ac8ddf78d97bfe844904263a452de7
Instruction ID: 456f02ac6b6225e3dd8e702ce07dd01bc218ed2b1e8f43a677b8da725670f07b
Opcode Fuzzy Hash: b7698dca4e0478af94a1313fbe2253f0b6ac8ddf78d97bfe844904263a452de7
Instruction Fuzzy Hash: 9C31B436F0021A8BDB54EEADD8405AFF7B1EFC5328F118A27E921A7281C7719905DBD0

Function 070D7F80 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1998d8a434959bbf922ca934281656083b1f88fbea8b131af352bd275096cc2d
Instruction ID: 067193bd8d04d426552024a72dee9551dfd44eccc6e406159c7be9a8873af6a7
Opcode Fuzzy Hash: 1998d8a434959bbf922ca934281656083b1f88fbea8b131af352bd275096cc2d
Instruction Fuzzy Hash: 1E41DFB0D00349DFDB14DFA9C984ADEBFF5BF48310F108529E819AB264DB75A945CB90

Function 070DE580 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832aebea1a1fae4514561e91a314eb8844663b3cb77b00b0059188b0cdcf0ad6
Instruction ID: 0360063774743c2136be8bdd9d96a65d7bddd21835fd617b05f8abdcff76776f
Opcode Fuzzy Hash: 832aebea1a1fae4514561e91a314eb8844663b3cb77b00b0059188b0cdcf0ad6
Instruction Fuzzy Hash: D121A171B062529FDF252B78A60406E7FEBAFC526132C48AFC405DB319EE39DC468790

Function 017BB8B8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56da3258fa5705d4dbfba4147d1e1df5479b22515069f85d992a19e81fcb24c1
Instruction ID: 4ef77de3ae89dadd38c72187e9953c19567e0b2e19c6a30c503bff113f426828
Opcode Fuzzy Hash: 56da3258fa5705d4dbfba4147d1e1df5479b22515069f85d992a19e81fcb24c1
Instruction Fuzzy Hash: 0E316F70340205DFDB05EF28D5C8BA9BBB5FF85714B1485A9E80A8B366DB70EC46CB90

Function 070DDDE7 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a670a193350f3179bf3235f91c2fc9b89413d953d242dcb1e81e372a482544f
Instruction ID: 53096708a96aabc504e9ab93200c7673843259b62984f395b22564c67c142118
Opcode Fuzzy Hash: 7a670a193350f3179bf3235f91c2fc9b89413d953d242dcb1e81e372a482544f
Instruction Fuzzy Hash: 3631E771B0020A9FCB04EF68E5449AEBBB6FF89300B14C269D4459B359DB34ED46CBD1

Function 017B77E8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f6f2d1ed90e919235d298a29410cc89922f9a88100b492a83f2e2062d79141
Instruction ID: 55104322f17dd53ed680f06c54c96f8ca862863eb89218172a98ba600944f193
Opcode Fuzzy Hash: 06f6f2d1ed90e919235d298a29410cc89922f9a88100b492a83f2e2062d79141
Instruction Fuzzy Hash: 3E315A31E007079ACB10AFA9E9442D9B3B1FF99320F25C729D55977640EB70B9D0CB94

Function 017B4929 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be5f6fb5a05e6440f3ad0ffb752b20a25e1be4df8211fafbf11008eaccaa3b7
Instruction ID: 8991ff35dd9429d2483c794777c0f49cf27ff350d50763046ba4c4d1408ce63f
Opcode Fuzzy Hash: 1be5f6fb5a05e6440f3ad0ffb752b20a25e1be4df8211fafbf11008eaccaa3b7
Instruction Fuzzy Hash: A3319331F107468BDB11AF79E4542EEF7B1FF95300B10C62AD456A7281EB34A985CB91

Function 017BBA41 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdfa5d1283db6d185e5dbef6131540e41939a2a0045f59c2bcbd0fb1023e8b0e
Instruction ID: 377cd99388a8643d3f1b4fc36d3d81170eeeb33422a68d60b3fb426a34947a2d
Opcode Fuzzy Hash: fdfa5d1283db6d185e5dbef6131540e41939a2a0045f59c2bcbd0fb1023e8b0e
Instruction Fuzzy Hash: 4921C131B002069BDB15DA39C8D0BBEF7E6AFC5250B64843EEC05D7298EB31DD029751

Function 013DF184 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4124628062.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13dd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5736c378ecf2671cbc77409dcddfab1734d417c2cd5edee9ae9c033764c8ebc
Instruction ID: 53d7678569d5ebb4c35373791562d340be01c23f754e7a3dd66ba17065351112
Opcode Fuzzy Hash: c5736c378ecf2671cbc77409dcddfab1734d417c2cd5edee9ae9c033764c8ebc
Instruction Fuzzy Hash: FD31E977500244EFDF069F54D9C0F16BF79FB88314F2481A9ED0A4A26AC336D456CB61

Function 017B3CC0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152c87849ae431433ae6a566d48bff121d802769beee374e1d9c7e6e081e2656
Instruction ID: 5577fb954c11051339c97ff7e458d2a6d0410f02e4fbfb19d68c5a9525b542da
Opcode Fuzzy Hash: 152c87849ae431433ae6a566d48bff121d802769beee374e1d9c7e6e081e2656
Instruction Fuzzy Hash: 25217E307002048FD714AF69D998BEEFBB6FBC8711F148468E40697395DF719C868B91

Function 017B7B81 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0294b78db663e1011699367786bdb2468929d8d12cdf567329832516dcb0e043
Instruction ID: f17a060d3444488c7ab35f31f2d7d220130ccf5ac8dbde7b5876f40d2f4f2e1e
Opcode Fuzzy Hash: 0294b78db663e1011699367786bdb2468929d8d12cdf567329832516dcb0e043
Instruction Fuzzy Hash: 8B2194347052908FC71E7B34B69C3BABFA59BA2602B0480ADD543C62CDDF399955CB51

Function 070DE572 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead87ff6c52c7b358150cdab6172a5cb604ddf1581a8a4e91c4b19aeb473ac2b
Instruction ID: 2c6957730a98d8de3dc79e85d8c5bac206d367281e098eb514d5888ab0932660
Opcode Fuzzy Hash: ead87ff6c52c7b358150cdab6172a5cb604ddf1581a8a4e91c4b19aeb473ac2b
Instruction Fuzzy Hash: 8B219271B063929FCF191B78921006E7FE69FC625032C48AFC4459B32AEE39CC468780

Function 070DDDF8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7656003a86febd55db0e815b7b8739b28e9a51f341f95565782945b36745bdfc
Instruction ID: 5f76ba1c767745bf81cd34baed9f22c454e8f85b1a80441aec7096e0238a91d3
Opcode Fuzzy Hash: 7656003a86febd55db0e815b7b8739b28e9a51f341f95565782945b36745bdfc
Instruction Fuzzy Hash: 7731C371B0020A9FC704EF58E58086EB7B6FF88310B10C229D40597359DB34ED46CBD1

Function 017B4938 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9489eec13218cc079216c2f1071e9640ecaf703be71245b5ecebf893c2c284
Instruction ID: 3af96541a43571d7b8b48190f3b6b409a0a51977cbbdfc412129800d23ba9c49
Opcode Fuzzy Hash: 1e9489eec13218cc079216c2f1071e9640ecaf703be71245b5ecebf893c2c284
Instruction Fuzzy Hash: 4931A231E1060A8BCB11AFBDE4142AEF3B5FF94300B10C629D45AA3345EF34A985CB91

Function 070D4EE9 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e3f203377e6ccfeeb4a2983f3b9d6929f94cafc6132688c87ccf6e8d55d7868
Instruction ID: 7709c0034928ddaafe44f2e975b58072511eec6aa3cd0719f1dba3004c377ccd
Opcode Fuzzy Hash: 6e3f203377e6ccfeeb4a2983f3b9d6929f94cafc6132688c87ccf6e8d55d7868
Instruction Fuzzy Hash: 7131F478A40204DFDB54DF68C598AA9BBF5EF8D710F255098E802AB371CB31AC41CF60

Function 017BE880 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d3c7de047cbc2ea9301ee235036ab5879b0089b231069512aec6f6ecfcef29f
Instruction ID: 20a9a4be3b1a346f1428f0344e9d7007bda191b9b440b1d597b18b27062b2431
Opcode Fuzzy Hash: 3d3c7de047cbc2ea9301ee235036ab5879b0089b231069512aec6f6ecfcef29f
Instruction Fuzzy Hash: 593171356002469FDB15DF68C888AEEBFB2FF95310F198069E9058B362DB31D941DBA1

Function 017B1272 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d1174bd7f8814506ff764275451ee97e3c270ca57f6c368a7797a7bb39cdbe7
Instruction ID: 6d7a7004f564be3232d3eeefd6c1c570bd37245a95f965df6b1e54da9a024a6a
Opcode Fuzzy Hash: 4d1174bd7f8814506ff764275451ee97e3c270ca57f6c368a7797a7bb39cdbe7
Instruction Fuzzy Hash: 72312534B01205CFCB19EF78E998A9CBBB2FF84305B5085A9E5069B269EB349D44CB51

Function 017BBA50 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac63f98a87e4ca938cc47a8b780470e495acb5999d90817b9d20896edbcb6d6e
Instruction ID: 513f76fdc2c8ab0f17caf7e8d6620a8b051c80ccc1237537b7c61a6bc5aa7b58
Opcode Fuzzy Hash: ac63f98a87e4ca938cc47a8b780470e495acb5999d90817b9d20896edbcb6d6e
Instruction Fuzzy Hash: FE214F317002079BDB24DA79C990AAEB7E6AFD4650B54843ED805D7358EB31DD029791

Function 013CD7EC Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4124592320.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13cd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac87d0e08fce5ca20c43936c484ff04b59f694ea95a6a432e61ad06e42176c4
Instruction ID: 4e35d52bcd03857a74d0c74a1682cdc4ef997c388dc57b3d9feca9bbbb2c1590
Opcode Fuzzy Hash: 6ac87d0e08fce5ca20c43936c484ff04b59f694ea95a6a432e61ad06e42176c4
Instruction Fuzzy Hash: CF21E272500344EFCB059F58D9C0B17BFA5FB88718F24867DE90D4A256C33AD816CBA1

Function 06AA2500 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4c9cf32a56a6db0eb3ed061310ea3d89e332a14f31ef0213249fbac76c6dfc
Instruction ID: 1544eafddb7ed645bb0a343a495f8995ad3f9dece250286df0fbd9a22873330c
Opcode Fuzzy Hash: bd4c9cf32a56a6db0eb3ed061310ea3d89e332a14f31ef0213249fbac76c6dfc
Instruction Fuzzy Hash: 1531CB31240A069FCB51EF28EA80A86FBF5FF44314B009B28D0458BB39DB71F9598BD1

Function 070D4EF8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d70cd7b291e64145fb5e535d1f1d1bb2f7a2e00a5a07f6d49b9a3c615b43fdb5
Instruction ID: 9efe81d238a7ef66537f473915f9fef8eb0c8e96473dfcff2667f4a48d14bc0e
Opcode Fuzzy Hash: d70cd7b291e64145fb5e535d1f1d1bb2f7a2e00a5a07f6d49b9a3c615b43fdb5
Instruction Fuzzy Hash: 3D31B274A50204CFD754DF69C598AAA7BF5EF88711F255198E802AB7B1CA71EC40CB60

Function 017BBB21 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06530a638fb28aa5a1f485146b70b5af0660969dff6f4ad79cc75c0e2d8ad46e
Instruction ID: 1a9081e7ba928845903ed3327a0bd9e9373ff81196d9c0f6f3e3315b6bffd3ae
Opcode Fuzzy Hash: 06530a638fb28aa5a1f485146b70b5af0660969dff6f4ad79cc75c0e2d8ad46e
Instruction Fuzzy Hash: 2921D171A043599FC712DFB99891ABFBFF5EB89210B10417AE908D735AE7309842C791

Function 070D21D0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5f5b323bf7952108804bae1f1735a4009b590635ce574acb8d0411af7d2701e
Instruction ID: 1e4d77b1a4302c4dcd4aa02a6b9340df609337f9d4c5e7c785d4ea2b681bee5c
Opcode Fuzzy Hash: b5f5b323bf7952108804bae1f1735a4009b590635ce574acb8d0411af7d2701e
Instruction Fuzzy Hash: B5216FB1604342AFCB7ACA58D4E88797BF5FF4721031A429EF5474BA61E720AC80CB41

Function 013DD610 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4124628062.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13dd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ec708be71686f8d1a853b558946a90a0c666ac046dc54497f9059b146a9575
Instruction ID: bc0306cd5ed328880bea11494fe996740046104646606943cda516ef8c3ce2cb
Opcode Fuzzy Hash: d3ec708be71686f8d1a853b558946a90a0c666ac046dc54497f9059b146a9575
Instruction Fuzzy Hash: EF210776504204DFDB05DF58E9C0B26BF65FB84328F64C56DE80E4B396C33AD446CAA1

Function 070DD9FA Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d20d7ed61563e47f3e16601f18b4e2536fe08ed516e0ff67a070ec6c462ae984
Instruction ID: d2b2274d898493aebec8952c60b260ef064e9753c9f993c7ae17b660a7c225b8
Opcode Fuzzy Hash: d20d7ed61563e47f3e16601f18b4e2536fe08ed516e0ff67a070ec6c462ae984
Instruction Fuzzy Hash: AF21F770244B469FCB11DF29DA8098AFBF1FF453147009B29D0998BB29E770F9998BD0

Function 06AA1048 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca46a6b29c0ea219a59c45cf13d43d77c742e55659028395d6cc4d5a7c4f834
Instruction ID: fc08184243a33474fc9df31da461d54c743c565c261edb239f7a747ac0aaf209
Opcode Fuzzy Hash: 9ca46a6b29c0ea219a59c45cf13d43d77c742e55659028395d6cc4d5a7c4f834
Instruction Fuzzy Hash: 1311E2327046A14FC345AB7DD81482E3BD7EFCA61036A41BED016CB791DE29DC02C7A6

Function 06AA2610 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1f95476d02d8d1d51b0b0bab9836f6430ccddd94a436b6e192fe0d82ed513c
Instruction ID: 02870141381fc9deec536dc976866103bf99d33c6fb47a689c3d1f796a0aa661
Opcode Fuzzy Hash: bc1f95476d02d8d1d51b0b0bab9836f6430ccddd94a436b6e192fe0d82ed513c
Instruction Fuzzy Hash: 8411A0B6341304BFEB106A16EC40BABFB9EDFD07A0F148127FA449B3D0C6A1DD5186A5

Function 06AA2510 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1e101077126529f130f091a38fa9aa67e157c433e3e0ee31e96121678a4de1
Instruction ID: ba97931731e80ad20d7ef253fbc72f7e15f3ad4dd939f78cd48c412f580aa214
Opcode Fuzzy Hash: 2e1e101077126529f130f091a38fa9aa67e157c433e3e0ee31e96121678a4de1
Instruction Fuzzy Hash: 70318731240A069FCB51EB28EA80A4AFBB5FF45714B409B28D0458BB39DB71F9598BD1

Function 070D1EF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 480190078ba817cdc51db908cfacac380fd5d65cfae1267d78c090c03cdfb286
Instruction ID: 7d9d751c233d296ee329be169f5efc954156e7ea7c1b1860c3e3a520669dff5c
Opcode Fuzzy Hash: 480190078ba817cdc51db908cfacac380fd5d65cfae1267d78c090c03cdfb286
Instruction Fuzzy Hash: 9421CD74700309AFCB05DF64D858AAEBBB2FF89314F15816AEA059B365CB35DC51CBA0

Function 06AA28B9 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9375d9cf9f8d141184cb95992afb8918b907d3df8651a2216818b889f4b3cc5c
Instruction ID: 2e6a8a83241ac999f4d0a2ad65e31fc84c7c5d348cbdfef0d9577a71af09bd71
Opcode Fuzzy Hash: 9375d9cf9f8d141184cb95992afb8918b907d3df8651a2216818b889f4b3cc5c
Instruction Fuzzy Hash: A7219AB17007119FC716AB38D40496EBBE6EFC9215714896EC08A8B360DF35EC86CBC2

Function 070D4FCF Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec774048fa7a4b33e2c43ea5dc17262d5a817ee146b42572914a591b72c2e297
Instruction ID: 11dbefa0c9e683a9795f086c82272ae548e729d84059d04ecab943ac79ed5dfe
Opcode Fuzzy Hash: ec774048fa7a4b33e2c43ea5dc17262d5a817ee146b42572914a591b72c2e297
Instruction Fuzzy Hash: 4D116D75710201CFCB54DB2CD58486DBBE6EFD962072941AAE50ADB371DF32EC048B40

Function 013DF17F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4124628062.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13dd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cfb7dd041e002c130cd1539feb2bbdfd134433b7a32c8f6d204d752fbd68790
Instruction ID: d1773ba647a65ce023bfbb259f8c1aa16ed93f8d1af0ea875bcf035b491be400
Opcode Fuzzy Hash: 7cfb7dd041e002c130cd1539feb2bbdfd134433b7a32c8f6d204d752fbd68790
Instruction Fuzzy Hash: E3217F7A404240DFCF068F54D9C4B56BF76FB88324F248299EE094A26AC336D466DB91

Function 070D3348 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e3e43246f7c7d6899268fd4a4fccf654d7a3102cc59dd4c495bb4370b6a5ce
Instruction ID: db5831e76878fdeb3e7085ea9b4dc206515dad798f67dccf2b7762873f66f21c
Opcode Fuzzy Hash: 52e3e43246f7c7d6899268fd4a4fccf654d7a3102cc59dd4c495bb4370b6a5ce
Instruction Fuzzy Hash: 53118B76300215DFCB059F59E884C9A7BBAFF8D721B104196FA058B362CB32CC12CBA0

Function 070D7511 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5ed0d37e2ac4ab37d493f63e068d54b4a9084e77697172f3a9eab74e7b75be
Instruction ID: 5ce226f78ee28c096ceb447dd3f24515bf1631b77c047c3760816472f6af8de7
Opcode Fuzzy Hash: 8e5ed0d37e2ac4ab37d493f63e068d54b4a9084e77697172f3a9eab74e7b75be
Instruction Fuzzy Hash: D51104F03003108FDB15CF38E9102AE7BE2DB85244B14A2AAC405CB395EA79CE02CBD2

Function 070D7560 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910092b7aa24c8cb50d391c5fb8c452c78c3a18513e557fccf87bdce38a591d8
Instruction ID: 1c89c73f83e31199c16fc48a78502f8cad240e3d466718c7211cbfd517d6e70d
Opcode Fuzzy Hash: 910092b7aa24c8cb50d391c5fb8c452c78c3a18513e557fccf87bdce38a591d8
Instruction Fuzzy Hash: A01190B0B003149FCB54DF7CE454A9EBBE2EB88250B209269D40ACB364EB75DD428BD1

Function 06AA28C8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d24bec2125f77f413f6c0ace563c15c0bf0919b7612c78d9318c03b76e806d2
Instruction ID: 3042657595ed51696791fc10f86d1ba6ca32609e6ca45fdf4a820aafe1d8caae
Opcode Fuzzy Hash: 0d24bec2125f77f413f6c0ace563c15c0bf0919b7612c78d9318c03b76e806d2
Instruction Fuzzy Hash: A5118BB17007119FC716AB38D00496EBBE6EFC9215714896EC08A8B360DF35EC86CBC6

Function 070DE672 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86dec4ce5ac9c7d211037ca63c803545589458cb26df84a74379a2ee731411f
Instruction ID: 9248746c6800ba772c28e8a31c37be406b527ac38240954231072e01e494ed12
Opcode Fuzzy Hash: c86dec4ce5ac9c7d211037ca63c803545589458cb26df84a74379a2ee731411f
Instruction Fuzzy Hash: 6B21B1B4A00345DFCB68DF68E558BEEBBF1EF88300F208569D841AB284DB795C41CB60

Function 06AA02A8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2377ecc578abd9cb7aee320e734b6ee63819c0e3f5e65fac19de4d67356f6ddb
Instruction ID: 26e0648889f087f33d8cd9e1d3d8599f9b8b11c28b3293625a422d6f8065da38
Opcode Fuzzy Hash: 2377ecc578abd9cb7aee320e734b6ee63819c0e3f5e65fac19de4d67356f6ddb
Instruction Fuzzy Hash: F0119E363087518FC3159B3ED85881D7BA6FFC961432944EDE45ACB762CE21EC06CB55

Function 013CD7E7 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4124592320.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13cd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: 1fd7448776d177ca99b2640edcbef6a1371a2f25151791ed82611413b9a996e8
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: 8B219D76504284DFDF06CF54D9C4B16BF72FB88718F24C6A9E9490A256C33AD826CBA1

Function 070D7550 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9d3d6646f87bf561655403276e893a312a71c803479dcb3e8bd4fd8b271438
Instruction ID: 8d35ad5e80501360b53f41ebc587ff16107e756802a058122113581a749b4918
Opcode Fuzzy Hash: 4c9d3d6646f87bf561655403276e893a312a71c803479dcb3e8bd4fd8b271438
Instruction Fuzzy Hash: 5F11A3B0B043509FCB15DB38A4146EEBFE2EB85254B2496AAC4058B355DA79CD02CBD2

Function 070DCDB2 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06c285044eac8a0caefe6443be6b8c21c35b1ddfb804b8f28ec7ef94d4a2ecd
Instruction ID: 5d6682b77fd74c7a3813505c33d5aac0b011d4272be5c91b3456a1d01ce6777b
Opcode Fuzzy Hash: a06c285044eac8a0caefe6443be6b8c21c35b1ddfb804b8f28ec7ef94d4a2ecd
Instruction Fuzzy Hash: 60118FB0B002459FDB18DF69C058AAEBFF6AF8D714F24415AE406E7360CB719C41CBA5

Function 070D7428 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6cbc8dfee64df39f7564c4e0f12c82be4390f79957a989d449e298ebf79f98
Instruction ID: dd8b560e8535733d6a538c92df85cc864e6e863b89b7cfbd1e061ac2b36ed942
Opcode Fuzzy Hash: ac6cbc8dfee64df39f7564c4e0f12c82be4390f79957a989d449e298ebf79f98
Instruction Fuzzy Hash: 4421CE31241A479FCB11DB28EA80986FBB5FF813157009B25D0458BA2AD770F99E8BD0

Function 017BB9C0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e87acc6810bfcca9ea70f2b26288a1cc914b5a596349ffbd48817ce7ba848cc
Instruction ID: bdc4a2f5b81f732ead7d444a3ad66ffe37640638332dfa3306fd9da08111042e
Opcode Fuzzy Hash: 9e87acc6810bfcca9ea70f2b26288a1cc914b5a596349ffbd48817ce7ba848cc
Instruction Fuzzy Hash: 8F0192367042059FC706CA6ED884AA6FFAAFFC5260314C166ED04D7726EB70ED019790

Function 070DB760 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2463697ebb9c474d748a003c5c28efa113067f7eccfd23b1013f4378d21e86
Instruction ID: c2bc5c3c37ae56c28e3cd08328fc75748732854c2501c86942b111e8b6777532
Opcode Fuzzy Hash: 8d2463697ebb9c474d748a003c5c28efa113067f7eccfd23b1013f4378d21e86
Instruction Fuzzy Hash: C411C2F16043059BC7249A5CC444BDF7FF1AF89720F19052DD106A7280CB719C04CB95

Function 013DD60B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4124628062.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13dd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 63280f66f526c059bc3433ed7ba01e925343786c2be746d8087785d918490499
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: FD11BB76504280DFDB02CF58E5C4B15BFA1FB84328F24C6AAD84D4B296C33AD40ACBA1

Function 070DCDC0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8a30d0ba7b71918bc08af18313485bdd6582201d99663af2879f214e6e6fc8
Instruction ID: 889ee0c9f15c4372fa21933e4edfac0c6a848774a3c97d07bb954306a01f32e2
Opcode Fuzzy Hash: cc8a30d0ba7b71918bc08af18313485bdd6582201d99663af2879f214e6e6fc8
Instruction Fuzzy Hash: 7A115AB0B002059FDB18DF69C058AAEBBF6EF8C614F10412AE406E7360CB719C41CFA5

Function 017B8773 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f203d666990aeb117911b7fee1131efe8e9f53af6ac1fb8d10a8d9c225f6f0f
Instruction ID: 8517034bff5ff2e14fe2de455af92117bf8dfd9c1b5f67f3c72b5b9d51514d9e
Opcode Fuzzy Hash: 0f203d666990aeb117911b7fee1131efe8e9f53af6ac1fb8d10a8d9c225f6f0f
Instruction Fuzzy Hash: 3501D2313083814FD72287BDD995B65BFA99F86214F1884AED1868B263DA24E809D762

Function 06AA2040 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0102e8a8bfd67b4f4bec77ed194c211693e7fd9f3a90301ce62e1fb751c02d9
Instruction ID: 6cbe99cf0fa8165dcba769ed019ff31cb044e7e6f211d4ba8e1c3c03978c9761
Opcode Fuzzy Hash: f0102e8a8bfd67b4f4bec77ed194c211693e7fd9f3a90301ce62e1fb751c02d9
Instruction Fuzzy Hash: 5F118035300200DFC718DB28E498E6A73F9EF89355B14416DE4068B765DB76ED86CB90

Function 017B97F3 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f276d38df71378e31dc2bb21b68c3f1202327303a9faa369a7aacd16d6565a8
Instruction ID: 90a37a0c921fdaed34fd3a370a6022e8f5a5a8d4194369545a556042df4439cb
Opcode Fuzzy Hash: 8f276d38df71378e31dc2bb21b68c3f1202327303a9faa369a7aacd16d6565a8
Instruction Fuzzy Hash: 8E115A75A44218CBDB14CBA9C988ADDFBF5AF4D314F0880A9E615B7365CB34AD40CBA0

Function 017BB9D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ec261aadf5e4889749ddb1b2b2f3ac4ba146c621b8f43648bf91ace41076b1
Instruction ID: 245d464ac47c8529656856dcaa35a16016db48e59ed2a789b3bcfb03eef9ca2f
Opcode Fuzzy Hash: 42ec261aadf5e4889749ddb1b2b2f3ac4ba146c621b8f43648bf91ace41076b1
Instruction Fuzzy Hash: 0C0162357002159F9748DA6ED880AAAFBAAFFC9260714C166E909C7325DB70ED028790

Function 017BDE45 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c527196e71bf17fca0900f71a7a7e53667c7e5a630c9405b25a4bf139a240c5
Instruction ID: f0a5fabbb1804e4e9f05ffc126239000ed382b0c9aa080b20759f7540928d5d6
Opcode Fuzzy Hash: 2c527196e71bf17fca0900f71a7a7e53667c7e5a630c9405b25a4bf139a240c5
Instruction Fuzzy Hash: 64014C323003012FC311AA2DD88575ABFA7FBD5224F44813DD15A87252DF20AC04C7A1

Function 013CDC11 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4124592320.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13cd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3abd897c495e129b18decf8285b99ac9f7bee291d8075ddfadab0bbba8110828
Instruction ID: 1022ae9fec862014e1fcbc6e485f5d5f15d03c8d12aad13bfb0e60cb1d8da167
Opcode Fuzzy Hash: 3abd897c495e129b18decf8285b99ac9f7bee291d8075ddfadab0bbba8110828
Instruction Fuzzy Hash: 780184715083449AEB119A59C9C4767BF9CEF45B28F18C43EFD094A196C2B99C40D7F1

Function 017B9800 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3d7214c4823bdf3b66f8daa24a72639a7f0e542597a963cb6ded919c8bf732
Instruction ID: 860498a8ee2c7e417c4ecfd091ceec656fa1928d9c14814a35e2c5b9a407949b
Opcode Fuzzy Hash: cc3d7214c4823bdf3b66f8daa24a72639a7f0e542597a963cb6ded919c8bf732
Instruction Fuzzy Hash: 23016D75A44118CFDB04CBA9C988ADDFBF5AF4C310F188099E615B7361CB34AC40CBA0

Function 017B0DD0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e150e46bf40485fd6e454e531ad9159a771494392cff32d30ce93cd78aabe7
Instruction ID: b60e75743a7f79f2d21edecfa2650611c8defd0bfcb5cd186df47515e674fa38
Opcode Fuzzy Hash: 17e150e46bf40485fd6e454e531ad9159a771494392cff32d30ce93cd78aabe7
Instruction Fuzzy Hash: 8401F936B002205FDB515B79B8487DD77BAFF85315F1000AEE50AE3791DF3099198B92

Function 017B8F58 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f33804b7b83fd4e431f4184fefc21fad8c254a80b9a758088c4a0d7193b7cc3
Instruction ID: ecbd13fca10a599aeaddc4fdbe5433ddb335d8a58ee5343ccbb9f3190315aba3
Opcode Fuzzy Hash: 2f33804b7b83fd4e431f4184fefc21fad8c254a80b9a758088c4a0d7193b7cc3
Instruction Fuzzy Hash: 8501AD74304650DFC71AAB28E50C6697FBAEFD931171980AAF906C73A6CF359C42CB81

Function 070DE758 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4d284d41f50e0d663178c4ccf2154ab592804d00ff05051822d60e532bab09
Instruction ID: a347f098613bc1ed62cc62dd439a468d0f52c0e6fdcaa57f6744f0165201420b
Opcode Fuzzy Hash: 1a4d284d41f50e0d663178c4ccf2154ab592804d00ff05051822d60e532bab09
Instruction Fuzzy Hash: FBF0F635700B115BC716A23DB40825D7BDBFFC1664B04412ED41ADB741CFA9EC0647D9

Function 070DCE80 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619c8ba2fa4e77b5b58f17bcf3ac47e5f2ba26e8e3867e0cbd242c815877b2e9
Instruction ID: f373cc07a08b824de31980e9e1ab6a4eebca0c07cbfe4b4e170e8114370da4ec
Opcode Fuzzy Hash: 619c8ba2fa4e77b5b58f17bcf3ac47e5f2ba26e8e3867e0cbd242c815877b2e9
Instruction Fuzzy Hash: 1CF0FDB63105109FC308CB2AD988C5ABBE6FB8D62035181A9E50ACB731CA30EC11CB90

Function 017B7F18 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f827a22972a493df3ecdb2d3dda17f5b6c622ca48201a7bd34b82ae50437db
Instruction ID: 5fbe827bc1ef9cd6922c2f21f2af403558ac1f3993dcb66c4b5068fcbf2ee577
Opcode Fuzzy Hash: 13f827a22972a493df3ecdb2d3dda17f5b6c622ca48201a7bd34b82ae50437db
Instruction Fuzzy Hash: 3C018630A003188FCB51EF69E5085AEFFF0FF98321B00812AD449D7212DB71AA068BC4

Function 017BBB30 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e72d32d838de98d84fa8ae403fdbfb642830273a34357afa3ca027166eadcb
Instruction ID: 2081fc1abfdf51e96cada9e083a9eee1878e365543cc33ce7984c3f1c30f156c
Opcode Fuzzy Hash: 51e72d32d838de98d84fa8ae403fdbfb642830273a34357afa3ca027166eadcb
Instruction Fuzzy Hash: 63F027327406229BD3145AAD989097BF7EEEBC8360B504139E905C3358DF71CC4383D4

Function 013CDC10 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4124592320.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_13cd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd5b9c878a4157ea0fcd602b2ea98dd1e5970f2efd3a01078d24dd0244d00ee
Instruction ID: 47da5b3e9a04cb6c1cc60cfa584c984f3b12b5f1d3d5b5f5f41f2bd4ac021697
Opcode Fuzzy Hash: dcd5b9c878a4157ea0fcd602b2ea98dd1e5970f2efd3a01078d24dd0244d00ee
Instruction Fuzzy Hash: 0FF062B15043449EEB118A1ACDC4B66FFE8EB51738F18C45AFD084F296C2799C44CBB1

Function 017B9891 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ac534a86dc7081a475a46e4bc80ecbf50a0af4c4da8dde68ae9c983e679b03
Instruction ID: 8b53cbe540768223c45e993423b01c03cb30e830cc2987b8372df4894b802561
Opcode Fuzzy Hash: 70ac534a86dc7081a475a46e4bc80ecbf50a0af4c4da8dde68ae9c983e679b03
Instruction Fuzzy Hash: E5F0B4353083908FC7125B39B85856ABF66EEDA15531981BEE60AC7347CE759802C791

Function 017B7EB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ccc43fd6f8e781b54e7b010d74dd41a078e9baadf1e038714dbe190a7a6ec0
Instruction ID: c3f4d9e485367e81e818edad1e05f0e29761f86e316da072b2604c4b46358b55
Opcode Fuzzy Hash: b9ccc43fd6f8e781b54e7b010d74dd41a078e9baadf1e038714dbe190a7a6ec0
Instruction Fuzzy Hash: FBF02E763582945FC3025769785C867BFA9EBC6125315C0BEE409C7246CD6A5C158373

Function 070DB93F Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d9305cf3bcb49053ca2d60d7f60db773a3896181be5ae1a815b5ae67a304ef
Instruction ID: bf6193aec373732ed7ece33dbe093507fab3a7e32c45644398616490a0303a61
Opcode Fuzzy Hash: 13d9305cf3bcb49053ca2d60d7f60db773a3896181be5ae1a815b5ae67a304ef
Instruction Fuzzy Hash: 63F0EC727043515FC305277DAC904DA7FAAEFDD260319426BD105C7346DD655C0583D5

Function 070DCED7 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06878d750e6666017b8cdd920b05d7874c6d9cd604bc25638ba8ce43f0f81e18
Instruction ID: 7b466cebc444d016414e0f5cc80d1e118b56a09885bf3c6ec07900d066cde2ca
Opcode Fuzzy Hash: 06878d750e6666017b8cdd920b05d7874c6d9cd604bc25638ba8ce43f0f81e18
Instruction Fuzzy Hash: A2F0E2753053009FC3098B19E410C9BBBF69FCA62031542A6F840CB332DA20EC01CBA1

Function 070DCEE8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64df3ed307fef14a5694fc49b2031b9233bab85e2026b26808bd609aa189c82d
Instruction ID: 527510c35a1e3c7862638345c02238c044817a7519d02f9ade208ac9afbe294f
Opcode Fuzzy Hash: 64df3ed307fef14a5694fc49b2031b9233bab85e2026b26808bd609aa189c82d
Instruction Fuzzy Hash: 9BF08C76300610CF8708DB2EE454C9AB7EAEFD962131541BAF605CB331CA31EC01CB60

Function 06AA2808 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a99bb3d5f4e059ca9ef6dd1db3a1c196e2814afca63af9fd2c262ba7fa1b5f
Instruction ID: f071b3fb6db1ab5266f3110308f1208f961933b5af5423e774633eae0e0253b3
Opcode Fuzzy Hash: 94a99bb3d5f4e059ca9ef6dd1db3a1c196e2814afca63af9fd2c262ba7fa1b5f
Instruction Fuzzy Hash: 33F05E723041149FD650A7ADB00CAAA77E9D758322B04852AF60987240CB399D92CBEA

Function 06AA2258 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b30e7aceba5b7b2e70ab3d4c28c3df93f8850419840d44c78276ea78e50c2b7
Instruction ID: 9a1db1246ff3552503821488a1d33e22e477845e7ba67bb5bdce349d68a24473
Opcode Fuzzy Hash: 7b30e7aceba5b7b2e70ab3d4c28c3df93f8850419840d44c78276ea78e50c2b7
Instruction Fuzzy Hash: D8F04974E00214DFC754DFB8E54559ABBF5AF48200B1480AAD829E7301DB35DA528FD1

Function 070DBC38 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6036e0ed1bbf62eb53d499416ed1760de0f8689b58f691c099e9482a066e41
Instruction ID: 82267e3ba31b6a357992f25ddb16f128753c12927e16c89556c4cc36ba349df4
Opcode Fuzzy Hash: 9c6036e0ed1bbf62eb53d499416ed1760de0f8689b58f691c099e9482a066e41
Instruction Fuzzy Hash: B5E06DB33002145B47249A4EA8C4CAABBEDFBD92313554176F20CC7221CA619C4587A0

Function 070D42B8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c204beb57a1b904f5425a167344c42dd8dd059656302194f007a134f68180b82
Instruction ID: c11c1e58725263201c033e2b0a271521b51262958a00893d2079096beda4bd55
Opcode Fuzzy Hash: c204beb57a1b904f5425a167344c42dd8dd059656302194f007a134f68180b82
Instruction Fuzzy Hash: 29F027353003508FC300964DE444AA677E9EBC8731F45416AEE4D83751CB70EC41C780

Function 06AA0F5F Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdad637b7805be9fc6fffc4e4ef481554e0ae494d203dcf5f0888371aca67ed
Instruction ID: 2e4aba4229e650b385f6ac7d748484221c21044fe7ab8bb339e738ffc70cf38f
Opcode Fuzzy Hash: 9fdad637b7805be9fc6fffc4e4ef481554e0ae494d203dcf5f0888371aca67ed
Instruction Fuzzy Hash: DEF08C3A340B014FD3108A2ED898D46B7BAEFC921131641A9F856D7731CB21DC06CA20

Function 070D4318 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1804bca1256347242bfe56286e2682999d07d96ace82a66715795c8907dc2f
Instruction ID: 200516b58ea5730118d2804b841af7345d35718aadbb5440e2f8945e0c199d4e
Opcode Fuzzy Hash: af1804bca1256347242bfe56286e2682999d07d96ace82a66715795c8907dc2f
Instruction Fuzzy Hash: DAF0A7B11006246FD220571ADC40DB7FBEEFBC4311B548529FA4582640CA75AC51C7A0

Function 017BD4F5 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06ffa9d0ebe0e256c09b3c1173cb72204e1f6869bfa4889e1beae6daaf72159
Instruction ID: c1be72bbfed419836c5c5de093eaa77b36c8cd1bf598ec2b618ac1aa7b332122
Opcode Fuzzy Hash: a06ffa9d0ebe0e256c09b3c1173cb72204e1f6869bfa4889e1beae6daaf72159
Instruction Fuzzy Hash: 9301F674A51259ABDF20CBD4D995FEDBB72BF48308F204045F801B62A1CB34A940DB60

Function 017B1EAD Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0aa8cb30eb1532d54346e199301832bb7603bce114c288cac1ec3ed97e52c7
Instruction ID: 392fa0f211a871308dc5a1d93cc16dde0f485447ad7c564e463659e50bf8367c
Opcode Fuzzy Hash: ef0aa8cb30eb1532d54346e199301832bb7603bce114c288cac1ec3ed97e52c7
Instruction Fuzzy Hash: 48F0EC25609384DFDB028BA4C9543DD7F766F8A200F1400E6D141A7291CB35491CC373

Function 06AA2999 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e220c6101f4c8547ee439e336e88c564ec6f679f8d983e55247988194b4bd2a
Instruction ID: 54bcdd563cf1f5a0f767fe022c7348e34af6141cc9e992db759617a5be2fd8ab
Opcode Fuzzy Hash: 6e220c6101f4c8547ee439e336e88c564ec6f679f8d983e55247988194b4bd2a
Instruction Fuzzy Hash: B0E02B323003521AD715922C7005FFF3BA6DBC1224F28007FD1595B682C6A62C0683E0

Function 017B34B4 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c77a47152d28e7b2afca6be392582bab2646899489465061759454fe0d50be
Instruction ID: 375cf0d3031f20edcf4f5237ac96bbeae4c44a54947a9687c504fc3a9c951975
Opcode Fuzzy Hash: 20c77a47152d28e7b2afca6be392582bab2646899489465061759454fe0d50be
Instruction Fuzzy Hash: 5DE02276D08140CFC3124B68A8942F8FF30FF7229134181C6D1819B021E329949AC310

Function 017B1ECD Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb2f55a47ee0e01ea554f7cd2f6855b7f540259ed232026e968e2bae459137a
Instruction ID: 16647ea69d6f7e3206388337e2bcdf176c7413cbefc842fe3863f07f435e7df4
Opcode Fuzzy Hash: 0fb2f55a47ee0e01ea554f7cd2f6855b7f540259ed232026e968e2bae459137a
Instruction Fuzzy Hash: E2F0E557A0E3C28FD713836898653CCBF71AFB3090B4802EAC085C7297E648451AC323

Function 06AA2268 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72673fafe6cec4f247e969d2bb5ecefecb44211cec471f278e9ed8e367ad711f
Instruction ID: cff5a3bfcab9b4fa2eb5e42f28b39b77a57668d973a4600ad0eb3820a193f0ca
Opcode Fuzzy Hash: 72673fafe6cec4f247e969d2bb5ecefecb44211cec471f278e9ed8e367ad711f
Instruction Fuzzy Hash: 2EF0D474E00219DFCB84EFB8D5499AEBBF5EB48200B1485AAD819D7301EB359A12CF90

Function 070DB950 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3fa6877b10c9562bcd316a8098ff096d47cb3ba5d966a04592e279c3ff6df12
Instruction ID: a77811196a41f58597d613f5712f76eb9c88d9f45f2eabf8f26a2ee375e88aa8
Opcode Fuzzy Hash: d3fa6877b10c9562bcd316a8098ff096d47cb3ba5d966a04592e279c3ff6df12
Instruction Fuzzy Hash: F4E04F627003111B8614266EAC904AB769FAFC8560715823EE60A87745CC655C058295

Function 017BA361 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3774374a61fd083d1a6abc9f96b399e3942a50f2d3adf84c5904a509cff7e18
Instruction ID: 247f2eb3e6162b148c082e5c2fd8a9086cc7e3b8441a9c43057dd9bde54455fb
Opcode Fuzzy Hash: e3774374a61fd083d1a6abc9f96b399e3942a50f2d3adf84c5904a509cff7e18
Instruction Fuzzy Hash: B7F09D38A401088FCB45CF99D9809CCB7F1FF88314B2181A5E505AB325D772AE45CFA0

Function 017B7EC8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421466d5b50fc03f92afc744a78990cc1fa37b8cd64727bff88a3acf6854d9a2
Instruction ID: 0e66fd7fa69b1d41c573860a65d2dbbd0b13bc5957f8923302a4a6823e5a8bcc
Opcode Fuzzy Hash: 421466d5b50fc03f92afc744a78990cc1fa37b8cd64727bff88a3acf6854d9a2
Instruction Fuzzy Hash: 40E026393001686BC300BAAEB84C95BBAAEFBD9621700C03EF50983308CEB18C5483A0

Function 070D54C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946d95d3a3df372197900a0db9d16cde996eaf2eecd60d225b616abed404cb7a
Instruction ID: 182e532c1412552b4b0814b59070cac2f30bd2eebeddebbfc2256792f88371ce
Opcode Fuzzy Hash: 946d95d3a3df372197900a0db9d16cde996eaf2eecd60d225b616abed404cb7a
Instruction Fuzzy Hash: 0DD09262714124270618619E789886EAADEEACEAA5398447AEA0ED7340DD629C0643A6

Function 070DB8E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c4c827b28fe88aa26cd3f55a93fb36e8abe88361e54b83ad6445f581f823c0f
Instruction ID: c9cdd3fc5baa2c4ea065f5a16172c9ba6ea87f8e843d99571de7f74e86a795fe
Opcode Fuzzy Hash: 0c4c827b28fe88aa26cd3f55a93fb36e8abe88361e54b83ad6445f581f823c0f
Instruction Fuzzy Hash: CFD02BB11087D10ECB039328E8201BEBF31DC5325270115BBC2E5CA526D561998D92D0

Function 017B1F1C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193e2729fec0d6e0a620cba51b5f1fbd1bc436be022ca4cdb7c3a2912a4526b9
Instruction ID: 2f25b063b9f0a3a956adf0546b44c2b5f851bf9a15a7fad8e0bd17eb47d22611
Opcode Fuzzy Hash: 193e2729fec0d6e0a620cba51b5f1fbd1bc436be022ca4cdb7c3a2912a4526b9
Instruction Fuzzy Hash: 3EE09234A05309EFEB41DBA4C6443DEBBB6BF89310F600068D60566294DB364A29C7A2

Function 017B1EBD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa1f78809ddc7c16db446783762f52c95d3154b989af354a4b21f69648f6012
Instruction ID: 6e432e34ab1eb785d745512acf8b9e41034840ca19442c74879c46bd156383d4
Opcode Fuzzy Hash: 4fa1f78809ddc7c16db446783762f52c95d3154b989af354a4b21f69648f6012
Instruction Fuzzy Hash: 87E06D21A0A3C49EE7028BA898243DC7F759F96114F1500E6D14497192C73509198362

Function 070D5076 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8bf42abcc6ca6117ef987be6873cd1626a61c29c8e2bf66ff0e09f0b5ec8909
Instruction ID: ba2ac280faab578e3c265252d8a80557386d964207ab4e334309377c2d5c9ef2
Opcode Fuzzy Hash: f8bf42abcc6ca6117ef987be6873cd1626a61c29c8e2bf66ff0e09f0b5ec8909
Instruction Fuzzy Hash: 6DD05E33B00014AFDB18DBB9BC048BFB3EADBD8650301C17AB505C7044D9749C2182E0

Function 070DB8F0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4905f71fa8c63d77d793a14c4deb686accc777bd9add7da3e1488e0032d33598
Instruction ID: d56936af731b685449002a78622b648bf4ed9c385acb2b659a0a34616695c351
Opcode Fuzzy Hash: 4905f71fa8c63d77d793a14c4deb686accc777bd9add7da3e1488e0032d33598
Instruction Fuzzy Hash: 8AE0C2312003558BC7259629E80486EF7AAFEC53A1711463EE51A87624DA71ED85CB90

Function 06AA24C0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706bcb3f9eaca5b396da9738603f8636ee9a5fd47434d4b7135936aab8b688f1
Instruction ID: a37883fd3897ddc34d586716d6b009a2ecbe6ece0e2ce957cd675b998665f2b0
Opcode Fuzzy Hash: 706bcb3f9eaca5b396da9738603f8636ee9a5fd47434d4b7135936aab8b688f1
Instruction Fuzzy Hash: 79E08C367092509FC31AABA8F849896BFEDEF0A6113150196F585D3212CA79E801CFE6

Function 017BBB98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536cba2c3de2650f2005160f1f06b6e7ddc1779f04c41d8815ac016efde971e8
Instruction ID: 73e0510f60e2eb51f06e4bc1bc956ecc5f5602c11f429711f0ea526c5366e479
Opcode Fuzzy Hash: 536cba2c3de2650f2005160f1f06b6e7ddc1779f04c41d8815ac016efde971e8
Instruction Fuzzy Hash: 22E092B4D0420D9F8B94DFA9D8456BEFFF4AB48200F10816AE918E3341E7345A51CFD5

Function 06AA0F30 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c3a84f2e962d6e76c8009830ed2abf0cfd129cd047f80132a11c72de889a6f
Instruction ID: 919166c1f4dcc388ede9850e876a9d7c7f97619346664bed39d128e3bd31f06a
Opcode Fuzzy Hash: 01c3a84f2e962d6e76c8009830ed2abf0cfd129cd047f80132a11c72de889a6f
Instruction Fuzzy Hash: 53E08C32204114AFC705DE49C840D827BAEFF49320B1580AAF5058B632CB32E820CB90

Function 017B3460 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2caf92b7dacdaab8526a6682246ecfc8f4640b3d9f9ec67fb0cd3d04e516ea61
Instruction ID: 61bdb50e8a8821d86039975b35d65489195f4218b7535275cb8d9a4f2fe2a2f2
Opcode Fuzzy Hash: 2caf92b7dacdaab8526a6682246ecfc8f4640b3d9f9ec67fb0cd3d04e516ea61
Instruction Fuzzy Hash: 63E0BF36D00508CFCB04EFA8E4848DCF770FF89325B008156D51577224EB306999CF50

Function 06AA2221 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3701e888137901a7af21641a4255aa95512527d4a416498f120600fd2395f280
Instruction ID: 3684456e9d8feb6b6a9543bba70b39a6a24282a4b530cc216e130bc59a9ea5fa
Opcode Fuzzy Hash: 3701e888137901a7af21641a4255aa95512527d4a416498f120600fd2395f280
Instruction Fuzzy Hash: A2D0A7B32142212BE704326974243AE7ACEEB47690F10006AD545C7BC0DE458C4403E7

Function 06AA2870 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64f8648d6a84ce1ba2af94f982eaa8a435d2058dcd58583e5898b00b6dfc92
Instruction ID: d96793c963c5f4f1b0ad020119f2e070e517b6daa5b418ff47f970c88cdd816f
Opcode Fuzzy Hash: 4e64f8648d6a84ce1ba2af94f982eaa8a435d2058dcd58583e5898b00b6dfc92
Instruction Fuzzy Hash: CEE026B1B092804FC346E738F8501943F61EB8220030AC5CDC0418B252CA288D0BCB4A

Function 017B7E73 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485d1313da2a41c46e81a19f1281c9e6d163bdf617a35e69ca7667ea40b3317d
Instruction ID: 8f39a9d2544c346fcf28a0eea03be6c020d58cf772a35607b41d601425facfbb
Opcode Fuzzy Hash: 485d1313da2a41c46e81a19f1281c9e6d163bdf617a35e69ca7667ea40b3317d
Instruction Fuzzy Hash: 21E086317085C14AEB5ADF7EE44C35E7AA1EB85211F05855AD011C33D6CB38DD848610

Function 06AA24D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e074e8811a894f0764391a88ba681c63e21dbd2355dbc325651545fa784c224d
Instruction ID: 5a35cd2ae003d9c1a266662e98130517d3129a6f752c6ea1d3981045862e7a8f
Opcode Fuzzy Hash: e074e8811a894f0764391a88ba681c63e21dbd2355dbc325651545fa784c224d
Instruction Fuzzy Hash: 37D092327042249FC709ABACF94D89AB7ECFB4D6263110165FA09C3311CA79ED018BE5

Function 070DCD80 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f5451dd9e39c430b80edb0eadd92a4100bdfc5a5acfa0d0437781fb777df9c
Instruction ID: 0e1bc1ec2ab0eede676536790166cc314e5f99bd3bd6a7f8975f39470bfc6dbe
Opcode Fuzzy Hash: c7f5451dd9e39c430b80edb0eadd92a4100bdfc5a5acfa0d0437781fb777df9c
Instruction Fuzzy Hash: 4CD0A7B110D1A15FD74A672464102D73736EFD9104F41C197E8058B682CAB94D4583E6

Function 070DB920 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9badff43f0f73dfbf2d7b79c66fece3835eba03dce5563d24e130b85f050f6
Instruction ID: a503deedf9bcb6ad0bf787fb31310760cc85fff1a3cc95b2f2f369464dc61f8b
Opcode Fuzzy Hash: ab9badff43f0f73dfbf2d7b79c66fece3835eba03dce5563d24e130b85f050f6
Instruction Fuzzy Hash: 1AD05EB110C3809FC3028734E4059007FF4AF4721070180D6D1448BA33C325B814C766

Function 06AA2230 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a22b7062d7757b24d6fb6f4f13d4ae1415abb141f8e7e5b2afea4dc30de37a
Instruction ID: 163ba8c7642ac9f44469002ef03ce588b078b92ce3c7ad7315874793ada78ab6
Opcode Fuzzy Hash: d1a22b7062d7757b24d6fb6f4f13d4ae1415abb141f8e7e5b2afea4dc30de37a
Instruction Fuzzy Hash: CFC080723101355FC704339C702419D75CDF785554B100059D50AD37C0DD955C0003DB

Function 06AA0F40 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c3c6f3e65a7aa89e028821f37458a22875d24a41b23d1ce394abc0c963c753
Instruction ID: f1a8f9c4d2bcfdfc561cff15ce83f1e9e20c66dfc182e0e3eee015f094571bae
Opcode Fuzzy Hash: f1c3c6f3e65a7aa89e028821f37458a22875d24a41b23d1ce394abc0c963c753
Instruction Fuzzy Hash: 2BD0C936210118AF8B44DE89D840C95BBA9FF4D6607158096FA188B332C672EC11DB90

Function 017B8DF8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b8a7d8ce868ce56166d2366f8bbd3c5ae40f2064b498fab760ecd372fdbed9b
Instruction ID: 0ea021e6bc7401882ce79dd0438520c9e4a1787922b09f90613f9891b435a8a2
Opcode Fuzzy Hash: 9b8a7d8ce868ce56166d2366f8bbd3c5ae40f2064b498fab760ecd372fdbed9b
Instruction Fuzzy Hash: 8BD0129411E2C54FC70327741464B446F316F9214CBAF84D6D1848A193C63788478331

Function 017B1F68 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f025b4325643e96e9eea5c65c3bd2cec9f80bc4382eb96f822b7f1af16ca62
Instruction ID: 2aebfa7259cdb55dfd81ec3bacda67f99183476b3ad05a478618fd1adc994ab7
Opcode Fuzzy Hash: d5f025b4325643e96e9eea5c65c3bd2cec9f80bc4382eb96f822b7f1af16ca62
Instruction Fuzzy Hash: 3FD0A720600248DADF80EBE894053DC7B61EBD5200F5001B5D105920458F604164C673

Function 017B1F55 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df13d181a38f7ba57457860e3f171de6d7568f2a56c858f751236472f4b81abb
Instruction ID: 3d18a8bd549f220f7b226fb5d132a7ca4c22b7c4069a7d3cef01b2603c191b2b
Opcode Fuzzy Hash: df13d181a38f7ba57457860e3f171de6d7568f2a56c858f751236472f4b81abb
Instruction Fuzzy Hash: 37D0A734A00248DEEB40DBD4D4563DCBBB1FBC4200F5011A5D10663080CF301664C672

Function 06AA2020 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12740b36c032492079ea048cb6c5158990ec7314eccdb5f8ae0f97ed197dce20
Instruction ID: 5f4be294082b0970ad10182c7b6162ecafbae182a8b997c4bc97754ef34c08e3
Opcode Fuzzy Hash: 12740b36c032492079ea048cb6c5158990ec7314eccdb5f8ae0f97ed197dce20
Instruction Fuzzy Hash: CCD0C9391942489FC200DB69E858A65BBA8FF06608B1940E9E4084B622DA22F921CA55

Function 070DD3FA Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c316ad526b3bb14a88be0f3fad0846c31a8b74a560c0d30e9abb635b963707
Instruction ID: c10d169ee139a917bd4944b0e8b839850960b018067a306f7557ae37df3b4800
Opcode Fuzzy Hash: 81c316ad526b3bb14a88be0f3fad0846c31a8b74a560c0d30e9abb635b963707
Instruction Fuzzy Hash: 1FD012203193C15FEF125728BCA9BA43F319B02B04F1440C2E280DF1E2D2926899EBA1

Function 017B1F78 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38268a2827d079b1ec1b1791e964d3c6c02d60ac44afa2f4b54776d737b43bbe
Instruction ID: 697361a188191a251687625594d33ce9ed5f04b130802e09081e420d431c74ec
Opcode Fuzzy Hash: 38268a2827d079b1ec1b1791e964d3c6c02d60ac44afa2f4b54776d737b43bbe
Instruction Fuzzy Hash: C0C012257406599ADFC0BBFD99043CC7E52EFD5700F5001B8D6048615A8EE485758AB3

Function 06AA1980 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14fde248235cfa8bb22c4a53080c746b4f7906b080b56017e2ab7896b0201864
Instruction ID: 1d14aa836a1045ebcedb72622fb6addd4e9950f19ac68931c26ce43f38874b4c
Opcode Fuzzy Hash: 14fde248235cfa8bb22c4a53080c746b4f7906b080b56017e2ab7896b0201864
Instruction Fuzzy Hash: CCC0C03204820C4FF300B740FA0B3983F1CD7C5300F500035D44646032DE2CA420C341

Function 06AA1958 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a50b9eae37e472d0f95c2c961bc2b897b4fce32a7c68cf06d338a3306157fe
Instruction ID: 514a9d015eac2c4067b64b47ee744c7db6ffb883c47a70ae4a4777128d9e0435
Opcode Fuzzy Hash: 37a50b9eae37e472d0f95c2c961bc2b897b4fce32a7c68cf06d338a3306157fe
Instruction Fuzzy Hash: 31C08CAA2082404FFB05DA04F6A03663B46D7EA304F200849C4C34BAF0C938C8218702

Function 070DBB58 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462f806103f530d795e63e7cd30240698a3559f3884ee21002b46cc62c982ebf
Instruction ID: 3cb9aa45b6c509197255b6c7b940aba294c1ddc2404dfa32fe0d7a48da9792c4
Opcode Fuzzy Hash: 462f806103f530d795e63e7cd30240698a3559f3884ee21002b46cc62c982ebf
Instruction Fuzzy Hash: BDB012B7E14208C9DB009AC4F8423EDFB30F791339F504127C32062001C372017887D1

Function 06AA2030 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea37b6cea62d40df410734184e5c43626299f01a35dbb0a8c3f936d9d13bb41f
Instruction ID: 4f1a3ac6db0f59e3f0d4f9a92a27a48c10cc8b74c58d88c87f1da974c996a5cc
Opcode Fuzzy Hash: ea37b6cea62d40df410734184e5c43626299f01a35dbb0a8c3f936d9d13bb41f
Instruction Fuzzy Hash: B0C09238260208CFC300DB59D588C10BBECFF49A0835580D8E50D8B732CB22FC01CA80

Function 070DB930 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c5e80e5d161c6cd17717d7e90366d7df6c86bdedef1d8d57fbaaa881c347e6
Instruction ID: 1485e72821faeb6dd9078d765896f2924cff3babc4a0a417e0ffd36dedc08b16
Opcode Fuzzy Hash: 99c5e80e5d161c6cd17717d7e90366d7df6c86bdedef1d8d57fbaaa881c347e6
Instruction Fuzzy Hash: 69B092721502088F8300DB68E548C0277A8AB18A1031140A1E2048B232C621F8108A65

Function 06AA1990 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4135424419.0000000006AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6aa0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae38fcbe45d5bb382c8b6198840d5f67f642b5405d18c25c962acd754c4836c8
Instruction ID: e67922c16c280e5e62ba4508a04c564f777209b9a0323cc4e71aca4031cde0c4
Opcode Fuzzy Hash: ae38fcbe45d5bb382c8b6198840d5f67f642b5405d18c25c962acd754c4836c8
Instruction Fuzzy Hash: 3FB0123104020E4FC5007758F90D5A8BF6DE5C03047804234A00C0A52AAA6C6C9486C4

Function 017B7229 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4125182833.00000000017B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_17b0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe51904c677c36a3bb0733c02ff83f451d5b0a74ccba3ed013f7bac66a721f4e
Instruction ID: 8e794a489fe6c8714c0c63f0be0247a024abd4effebc7dd7f0924bbba3145440
Opcode Fuzzy Hash: fe51904c677c36a3bb0733c02ff83f451d5b0a74ccba3ed013f7bac66a721f4e
Instruction Fuzzy Hash: 2EA02434D001104FCF045730714C13431D377DD7133004450D005C110CCF34C400D700

Non-executed Functions

Function 070D54F9 Relevance: 6.6, Strings: 5, Instructions: 391COMMON

Download Yara Rule

Strings

Plkq, xrefs: 070D555D
Plkq, xrefs: 070D584E
Plkq, xrefs: 070D57BA
Plkq, xrefs: 070D58C5
Plkq, xrefs: 070D5701

Memory Dump Source

Source File: 00000001.00000002.4136068944.00000000070D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_70d0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: Plkq$Plkq$Plkq$Plkq$Plkq
API String ID: 0-4231767899
Opcode ID: 064680ef6526a338492930fbb232f1a83ef538a6a56253a2aa65e1273d4d1aa5
Instruction ID: f5fe0bf996fb404a3681694f2f199f8f094810b97af1baa2571b504f4870d0aa
Opcode Fuzzy Hash: 064680ef6526a338492930fbb232f1a83ef538a6a56253a2aa65e1273d4d1aa5
Instruction Fuzzy Hash: 32E1AB707407058FCB15DB39C994A6ABBE2BF88300F1489A9D552CB3B5EB35EC46CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7zS42B6E125\ICSharpCode.SharpZipLib.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\Newtonsoft.Json.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe

C:\Users\user\AppData\Local\Temp\7zS42B6E125\WebCompanion-Installer.exe.config

C:\Users\user\AppData\Local\Temp\7zS42B6E125\de-DE\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\en-US\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\es-ES\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\fr-CA\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\it-IT\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\ja-JP\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\pt-BR\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\ru-RU\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\tr-TR\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zS42B6E125\zh-CHS\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\WcInstaller.log

C:\Users\user\AppData\Local\Temp\WebCompanion.zip

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txt

Static File Info

General

File Icon

Windows Analysis Report
Setup.exe

Function 004148D4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81
COMMON

Function 00405434 Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Function 00401014 Relevance: 48.0, APIs: 8, Strings: 19, Instructions: 715
windowsynchronizationCOMMON

Function 0040AB05 Relevance: 14.2, APIs: 9, Instructions: 682
COMMON

Function 004051B7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102
threadCOMMON

Function 00404908 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36
filetimeCOMMON

Function 004083AB Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Function 00405620 Relevance: 4.6, APIs: 3, Instructions: 130
COMMON

Function 0040280E Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 384
COMMON

Function 004030FC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Function 00404A3E Relevance: 3.2, APIs: 2, Instructions: 166
COMMON

Function 00408755 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Function 0041468E Relevance: 3.0, APIs: 2, Instructions: 45
threadCOMMON

Function 00405892 Relevance: 3.0, APIs: 2, Instructions: 45
fileCOMMON

Function 00404965 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON