Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe renamed because original name is a hash value
Original sample name:	Setup.ex
Analysis ID:	1539162
MD5:	fef9a20fcd13f76e4656a66a95ae336c
SHA1:	f21aca3de231ef5476913b40f3d52d31c5cb9eb8
SHA256:	28fcbf8a60bc702b59e1fb25ece117741822136b6aa755440eec15b229d3f84c
Infos:

Detection

Score:	45
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Setup.exe (PID: 2108 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: FEF9A20FCD13F76E4656A66A95AE336C)

WebCompanion-Installer.exe (PID: 5988 cmdline: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20622070018 --version=13.900.0.1080 MD5: A27F9713DB1688D03D2082BFA1827803)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.0.WebCompanion-Installer.exe.9a0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.Setup.exe.20d08b8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.Setup.exe.20d1eb8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.Setup.exe.20d34b8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-22T09:55:33.775006+0200	2803305	3	Unknown Traffic	192.168.2.5	49706	104.16.148.130	80	TCP
2024-10-22T09:55:47.588821+0200	2803305	3	Unknown Traffic	192.168.2.5	49828	104.16.149.130	443	TCP
2024-10-22T09:55:51.739529+0200	2803305	3	Unknown Traffic	192.168.2.5	49850	104.16.149.130	443	TCP
2024-10-22T09:55:55.584810+0200	2803305	3	Unknown Traffic	192.168.2.5	49872	104.16.149.130	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

ReversingLabs: Detection: 20%

Multi AV Scanner detection for submitted file

Source: Setup.exe

ReversingLabs: Detection: 50%

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Jump to behavior

Source: Setup.exe

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.5:49778 version: TLS 1.2

Source:	Binary string: Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: &Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, WebCompanion-Installer.exe, 00000001.00000002.3905745787.0000000006762000.00000002.00000001.01000000.00000007.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: eApplication/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031AB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031AF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031B3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031A7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: Application/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031AB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031AF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031B3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031A7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanion-Installer.pdb source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr
Source:	Binary string: bly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbT source: WebCompanion-Installer.exe, 00000001.00000002.3901258632.00000000010D8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405434 FindFirstFileA,FindFirstFileW,

0_2_00405434

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.0.WebCompanion-Installer.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.20d08b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.20d1eb8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.Setup.exe.20d34b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe, type: DROPPED

Source: global traffic	HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 447Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 398
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 508
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 646
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 515
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 482
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 515
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 488
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 527
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 466
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 527
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 458
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 460
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 475
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 520
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 491
Source: global traffic	HTTP traffic detected: POST /api/Update/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 517
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 485
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.com
Source: global traffic	HTTP traffic detected: POST /v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 728
Source: global traffic	HTTP traffic detected: POST /v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1Content-Type: application/jsonHost: flwadw.comContent-Length: 674
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com

Source: Joe Sandbox View	IP Address: 104.18.27.149 104.18.27.149
Source: Joe Sandbox View	IP Address: 104.16.149.130 104.16.149.130
Source: Joe Sandbox View	IP Address: 104.16.148.130 104.16.148.130

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49706 -> 104.16.148.130:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49828 -> 104.16.149.130:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49850 -> 104.16.149.130:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49872 -> 104.16.149.130:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.com
Source: global traffic	HTTP traffic detected: GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1Host: wcdownloadercdn.lavasoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: geo.lavasoft.com

Source: global traffic	DNS traffic detected: DNS query: geo.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: featureflags.lavasoft.com
Source: global traffic	DNS traffic detected: DNS query: flwadw.com
Source: global traffic	DNS traffic detected: DNS query: wcdownloadercdn.lavasoft.com

Source: unknown

HTTP traffic detected: POST /api/feature/WC HTTP/1.1Content-Type: application/jsonHost: featureflags.lavasoft.comContent-Length: 194Connection: Keep-Alive

Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://aia.entrust.net/evcs2-chain.p7c01
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl.entrust.net/csbr1.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl.entrust.net/evcs2.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl.entrust.net/g2ca.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geo.lavasoft.com
Source: WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://geo.lavasoft.com/
Source: Newtonsoft.Json.dll.0.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://localhost:9008Fhttp://localhost:9008/webcompanion/4http://rt.webcompanion.com
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net00
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net01
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://ocsp.entrust.net02
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://staging-cloudflow.lavasoft.net/v1/event-stat-wc
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/$
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/:WebHttpBinding4
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetComponentsInfoByProductT
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetComponentsInfoT
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetComponentsVersionInfoT
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/GetProductInfoT
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreen
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValues
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValuesResponse
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/SignZipInstallerByProductT
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/SignZipInstallerT
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://tempuri.org/T
Source: Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wc-update-service.lavasoft.com/components.asmx
Source: Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wc-update-service.lavasoft.com/update.asmx
Source: Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip
Source: Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.entrust.net/rpa0
Source: Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.entrust.net/rpa03
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.lavasoft.com
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: http://www.webcompanion.com
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F24000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/blacklist
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F24000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acs.lavasoft.com/api/v2/url/permanentwhitelist
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acs.lavasoft.comZhttps://acs.lavasoft.com/api/v2/url/blacklistlhttps://acs.lavasoft.com/api/
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acscdn.lavasoft.com/urlnotificationlist.json
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://acscdn.lavasoft.comhhttps://acscdn.lavasoft.com/urlnotificationlist.json0https://webcompanio
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://featureflags.lavasoft.com
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WC
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F4D000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://featureflags.lavasoft.com/api/feature/WC$https://flwadw.comFhttps://flwadw.com/v1/event-stat
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flow.lavasoft.com/v1/event-stat/v1/event-stat
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flwadw.com/v1/event-stat
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flwadw.com/v1/event-stat-wc
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000003103000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002FF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002FF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://flwadw.com/v1/event-stat?Type=Start&ProductID=wc&EventVersion=1
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://flwadw.com/v1/event-statJhttp://staging-cloudflow.lavasoft.netlhttp://staging-cloudflow.lava
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://partner-tracking.lavasoft.com/api/Tracking/Decrypt
Source: Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F24000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WcInstaller.log.1.dr	String found in binary or memory: https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://sandbox-featureflags-api.lavasoft.net/api/Update/WC
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sandbox-featureflags-api.lavasoft.net/api/feature/WC
Source: Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip
Source: Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip
Source: Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe
Source: Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloader-qa.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-internal.zip
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wcdownloadercdn.lavasoft.com
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031C0000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe
Source: Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe
Source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031C0000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr	String found in binary or memory: https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/en/help.php
Source: WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/en/install.php?partner=
Source: WcInstaller.log.1.dr	String found in binary or memory: https://webcompanion.com/images/favicon.ico
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://www.adaware.com/privacy-policy
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	String found in binary or memory: https://www.adaware.com/terms-of-use

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	HTTPS traffic detected: 104.16.148.130:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.149:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.149.130:443 -> 192.168.2.5:49778 version: TLS 1.2

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00416076	0_2_00416076
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0040E38E	0_2_0040E38E
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00412480	0_2_00412480
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004039C8	0_2_004039C8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00418CC1	0_2_00418CC1
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00418D9B	0_2_00418D9B
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_012A0DE0	1_2_012A0DE0
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_012AF0D0	1_2_012AF0D0
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_012AE390	1_2_012AE390
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_062505A8	1_2_062505A8
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06B7A848	1_2_06B7A848
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06B77120	1_2_06B77120
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06C19E60	1_2_06C19E60
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06C1A730	1_2_06C1A730
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06C1B1B0	1_2_06C1B1B0
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06C19B18	1_2_06C19B18

Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00413724 appears 177 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00403A63 appears 33 times

Source: Setup.exe, 00000000.00000003.2039145403.0000000001EF1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll4 vs Setup.exe
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: get_OriginalFilename vs Setup.exe
Source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: get_OriginalFilename vs Setup.exe
Source: Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion.exe> vs Setup.exe
Source: Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe
Source: Setup.exe, 00000000.00000003.2041468940.0000000002096000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebCompanion-Installer.resources.dllL vs Setup.exe
Source: Setup.exe, 00000000.00000003.2041468940.0000000002096000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameICSharpCode.SharpZipLib.dll8 vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameInstaller.exeR vs Setup.exe

Source: Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: ICSharpCode.SharpZipLib.dll.0.dr, InflaterInputBuffer.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.0.dr, DeflaterOutputStream.cs	Cryptographic APIs: 'TransformBlock'
Source: ICSharpCode.SharpZipLib.dll.0.dr, ZipAESTransform.cs	Cryptographic APIs: 'TransformBlock'

Source: WebCompanion-Installer.exe.0.dr, RemoveRegistry.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: WebCompanion-Installer.exe.0.dr, InstallUtils.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: WebCompanion-Installer.exe.0.dr, InstallUtils.cs	Security API names: System.IO.DirectoryInfo.GetAccessControl()
Source: WebCompanion-Installer.exe.0.dr, InstallUtils.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: WebCompanion-Installer.exe.0.dr, App.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: WebCompanion-Installer.exe.0.dr, App.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal45.troj.winEXE@3/17@4/3

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Roaming\Lavasoft

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe

ReversingLabs: Detection: 50%

Source: WebCompanion-Installer.exe	String found in binary or memory: WebCompanion-Installer.resources
Source: WebCompanion-Installer.exe	String found in binary or memory: WebCompanion-Installer.resources.dll
Source: Setup.exe	String found in binary or memory: RunProgram="WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20622070018 --version=13.900.0.1080"

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20622070018 --version=13.900.0.1080
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20622070018 --version=13.900.0.1080	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Setup.exe

Static PE information: certificate valid

Source:	Binary string: Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: &Application/WebCompanion-Installer.pdb source: WebCompanion.zip.1.dr
Source:	Binary string: c:\Temp\Release\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, WebCompanion-Installer.exe, 00000001.00000002.3905745787.0000000006762000.00000002.00000001.01000000.00000007.sdmp, Newtonsoft.Json.dll.0.dr
Source:	Binary string: eApplication/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031AB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031AF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031B3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031A7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: Application/WebCompanion-Installer.pdbPK source: WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031AB000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031AF000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031B3000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031A7000.00000004.00000800.00020000.00000000.sdmp, WebCompanion.zip.1.dr
Source:	Binary string: c:\Windows\Temp\drone-ME4saUyIgSY9rSgY\drone\src\WebCompanion\Installer\WebCompanionInstaller\obj\Release\WebCompanion-Installer.pdb source: Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr
Source:	Binary string: bly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbT source: WebCompanion-Installer.exe, 00000001.00000002.3901258632.00000000010D8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004180F0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004180F0

Source: Setup.exe	Static PE information: real checksum: 0x8a584 should be: 0x93fca
Source: WebCompanion-Installer.resources.dll8.0.dr	Static PE information: real checksum: 0x0 should be: 0xa6a7
Source: WebCompanion-Installer.resources.dll5.0.dr	Static PE information: real checksum: 0x0 should be: 0xc6c2
Source: WebCompanion-Installer.resources.dll1.0.dr	Static PE information: real checksum: 0x0 should be: 0x3e3f
Source: WebCompanion-Installer.resources.dll7.0.dr	Static PE information: real checksum: 0x0 should be: 0xcb69
Source: WebCompanion-Installer.resources.dll2.0.dr	Static PE information: real checksum: 0x0 should be: 0x4885
Source: WebCompanion-Installer.resources.dll4.0.dr	Static PE information: real checksum: 0x0 should be: 0x5659
Source: WebCompanion-Installer.resources.dll6.0.dr	Static PE information: real checksum: 0x0 should be: 0xd8a3
Source: WebCompanion-Installer.resources.dll0.0.dr	Static PE information: real checksum: 0x0 should be: 0xe72f
Source: WebCompanion-Installer.resources.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x2ab0
Source: WebCompanion-Installer.resources.dll3.0.dr	Static PE information: real checksum: 0x0 should be: 0x842b

Source: Setup.exe

Static PE information: section name: .sxdata

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00411130 push ecx; mov dword ptr [esp], ecx	0_2_00411131
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00413724 push eax; ret	0_2_00413742
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00413A90 push eax; ret	0_2_00413ABE
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06562050 push ss; retf	1_2_06562073
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_012AC429 push eax; retf	1_2_012AC42D
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A0CA68 pushfd ; iretd	1_2_05A0CB61
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A0D640 push es; ret	1_2_05A0D650
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A08310 push es; ret	1_2_05A08340
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A08370 push es; ret	1_2_05A08380
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A08350 push es; ret	1_2_05A08360
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A06D21 pushfd ; ret	1_2_05A06D29
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A0DD2E push es; ret	1_2_05A0DD30
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A0DD0E push es; ret	1_2_05A0DD10
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A0DD6E push es; ret	1_2_05A0DD70
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A0DD4E push es; ret	1_2_05A0DD50
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A0DC80 push es; ret	1_2_05A0DC90
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A0DC5F push es; ret	1_2_05A0DC70
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_05A0CB37 pushfd ; iretd	1_2_05A0CB61
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06B7A68A pushad ; iretd	1_2_06B7A691
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06B74A21 push es; ret	1_2_06B74A30
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06B7D051 push F806B5F1h; ret	1_2_06B7D05D
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06C1F66F push esp; retf	1_2_06C1F679
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06C16FC1 push FFFFFFC3h; ret	1_2_06C16FDE
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06C1C770 push es; ret	1_2_06C1C780
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06C1D2FF push eax; retf	1_2_06C1D300
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06C1FB43 pushfd ; iretd	1_2_06C1FB51
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Code function: 1_2_06C1C990 push es; ret	1_2_06C1C9A0

Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

File created: C:\Users\user\AppData\Local\Temp\WcInstaller.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Memory allocated: 1260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Memory allocated: 2D30000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Window / User API: threadDelayed 395

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ru-RU\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ICSharpCode.SharpZipLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\zh-CHS\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\de-DE\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ja-JP\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\tr-TR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\it-IT\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\en-US\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\pt-BR\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\fr-CA\WebCompanion-Installer.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\es-ES\WebCompanion-Installer.resources.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe TID: 4160	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe TID: 4160	Thread sleep time: -600000s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00405434 FindFirstFileA,FindFirstFileW,

0_2_00405434

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: WebCompanion-Installer.exe, 00000001.00000002.3901258632.00000000010D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllX
Source: WebCompanion-Installer.exe.0.dr	Binary or memory string: vmware

Source: C:\Users\user\Desktop\Setup.exe

API call chain: ExitProcess graph end node

graph_0-16410

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004180F0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004180F0

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0041561A SetUnhandledExceptionFilter,		0_2_0041561A
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0041562C SetUnhandledExceptionFilter,		0_2_0041562C

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\en-US\WebCompanion-Installer.resources.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXmlLinq\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXmlLinq.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ICSharpCode.SharpZipLib.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004148D4 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

0_2_004148D4

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter : SELECT * FROM AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	50%	ReversingLabs	Win32.Trojan.XWorm

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ICSharpCode.SharpZipLib.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\Newtonsoft.Json.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe	21%	ReversingLabs	Win32.PUA.Generic
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\de-DE\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\en-US\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\es-ES\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\fr-CA\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\it-IT\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ja-JP\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\pt-BR\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ru-RU\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\tr-TR\WebCompanion-Installer.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\zh-CHS\WebCompanion-Installer.resources.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
geo.lavasoft.com	104.16.148.130	true	false	unknown
wcdownloadercdn.lavasoft.com	104.16.149.130	true	false	unknown
featureflags.lavasoft.com	104.16.148.130	true	false	unknown
flwadw.com	104.18.27.149	true	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://flwadw.com/v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1	false	unknown
https://featureflags.lavasoft.com/api/feature/WC	false	unknown
https://featureflags.lavasoft.com/api/Update/WC	false	unknown
https://flwadw.com/v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1	false	unknown
https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip	false	unknown
https://flwadw.com/v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1	false	unknown
https://flwadw.com/v1/event-stat?Type=Start&ProductID=wc&EventVersion=1	false	unknown
http://geo.lavasoft.com/	false	unknown
https://flwadw.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1	false	unknown
https://flwadw.com/v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.entrust.net/g2ca.crl0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/GetComponentsVersionInfoT	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://featureflags.lavasoft.com/api/Update/WCyhttps://sandbox-featureflags-api.lavasoft.net/api/fe	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe	Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
https://flwadw.com/v1/event-stat-wc	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValuesResponse	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://ocsp.entrust.net02	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	URL Reputation: safe	unknown
http://ocsp.entrust.net01	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://ocsp.entrust.net00	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
https://flwadw.com/v1/event-stat	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloadercdn.lavasoft.com	WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://acs.lavasoft.com/api/v2/url/permanentwhitelist	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F24000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.adaware.com/privacy-policy	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-internal.zip	Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://tempuri.org/:WebHttpBinding4	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://webcompanion.com/images/favicon.ico	WcInstaller.log.1.dr	false		unknown
http://www.webcompanion.com	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip	Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F24000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr, WcInstaller.log.1.dr	false		unknown
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreenResponse	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/csbr1.crl0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://sandbox-featureflags-api.lavasoft.net/api/feature/WC	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F4D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/ILocalyHostedServiceInstaller/GetDropDownValues	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://rt.webcompanion.com/notifications/download/rt/typolist.txt.http://www.lavasoft.com6http://www	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://featureflags.lavasoft.com/api/feature/WC$https://flwadw.comFhttps://flwadw.com/v1/event-stat	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://staging-webcompanion.lavasoft.net/dci/4.0.0.14/Webprotection.zip	Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://aia.entrust.net/evcs2-chain.p7c01	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://rt.webcompanion.com/notifications/download/rt/typolist.txt5Creating	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://acscdn.lavasoft.com/urlnotificationlist.json	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F24000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.entrust.net/rpa0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-internal.zip	Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://tempuri.org/GetProductInfoT	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/$	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://webcompanion.com/en/install.php?partner=	WebCompanion-Installer.exe.0.dr	false		unknown
https://webcompanion.com/en/help.php	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip	Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
https://www.adaware.com/terms-of-use	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/soap/encoding/	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/ILocalyHostedServiceInstaller/ChangeScreen	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://flwadw.com/v1/event-statJhttp://staging-cloudflow.lavasoft.netlhttp://staging-cloudflow.lava	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://www.entrust.net/rpa03	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false	URL Reputation: safe	unknown
https://featureflags.lavasoft.com	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F4D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://flow.lavasoft.com/v1/event-stat/v1/event-stat	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe	Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
https://partner-tracking.lavasoft.com/api/Tracking/Decrypt	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://webcompanion.com/uninstall.php?utm_source=wc&utm_medium=	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://flwadw.com	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F96000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://acs.lavasoft.comZhttps://acs.lavasoft.com/api/v2/url/blacklistlhttps://acs.lavasoft.com/api/	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe	WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031C0000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr	false		unknown
http://localhost:9008Fhttp://localhost:9008/webcompanion/4http://rt.webcompanion.com	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://staging-cloudflow.lavasoft.net/v1/event-stat-wc	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://james.newtonking.com/projects/json	Newtonsoft.Json.dll.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/GetComponentsInfoByProductT	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://geo.lavasoft.com	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F24000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.lavasoft.com	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://webcompanion.com/unsafe.php?utm_source=WCHhttps://webcompanion.com/en/help.php.https://www.a	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://acs.lavasoft.com/api/v2/url/blacklist	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F7B000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F24000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002F21000.00000004.00000800.00020000.00000000.sdmp, WcInstaller.log.1.dr, WebCompanion-Installer.exe.0.dr	false		unknown
https://acscdn.lavasoft.comhhttps://acscdn.lavasoft.com/urlnotificationlist.json0https://webcompanio	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/T	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://sandbox-featureflags-api.lavasoft.net/api/Update/WC	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
https://webcompanion.com/unsafe.php?utm_source=WCghttp://pp.webcompanion.com/unsafe.php?utm_source=W	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://tempuri.org/SignZipInstallerByProductT	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip	Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000002.3902253010.00000000031CC000.00000004.00000800.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://crl.entrust.net/evcs2.crl0	Setup.exe, ICSharpCode.SharpZipLib.dll.0.dr, Newtonsoft.Json.dll.0.dr, WebCompanion-Installer.exe.0.dr	false		unknown
http://wc-update-service.lavasoft.com/update.asmx	Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://wc-update-service.lavasoft.com/components.asmx	Setup.exe, 00000000.00000003.2039757858.0000000002094000.00000004.00000020.00020000.00000000.sdmp, WebCompanion-Installer.exe.config.0.dr	false		unknown
http://tempuri.org/SignZipInstallerT	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/soap/actor/next	WebCompanion-Installer.exe, 00000001.00000002.3902253010.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/GetComponentsInfoT	Setup.exe, 00000000.00000003.2041468940.00000000020CD000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2041682174.0000000000470000.00000004.00001000.00020000.00000000.sdmp, WebCompanion-Installer.exe, 00000001.00000000.2041913868.00000000009A2000.00000002.00000001.01000000.00000004.sdmp, WebCompanion-Installer.exe.0.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.27.149	flwadw.com	United States	13335	CLOUDFLARENETUS	false
104.16.149.130	wcdownloadercdn.lavasoft.com	United States	13335	CLOUDFLARENETUS	false
104.16.148.130	geo.lavasoft.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1539162
Start date and time:	2024-10-22 09:54:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe renamed because original name is a hash value
Original Sample Name:	Setup.ex
Detection:	MAL
Classification:	mal45.troj.winEXE@3/17@4/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 383 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, ocsp.entrust.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target WebCompanion-Installer.exe, PID 5988 because it is empty
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Setup.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.18.27.149	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
	APInstaller (4).exe	Get hash	malicious	Unknown	Browse
104.16.149.130	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	flow.lavasoft.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	flow.lavasoft.com/v1/event-stat-wc?Type=Activity&ProductID=wc&EventVersion=1
	SecuriteInfo.com.Program.Unwanted.2818.3154.4230.exe	Get hash	malicious	Petite Virus	Browse	flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
104.16.148.130	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	flow.lavasoft.com/v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	wcdownloadercdn.lavasoft.com/9.1.0.993/WebCompanion-9.1.0.993-prod.zip
	SecuriteInfo.com.Program.Unwanted.2818.3154.4230.exe	Get hash	malicious	Petite Virus	Browse	flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	Setup.exe	Get hash	malicious	Unknown	Browse	geo.lavasoft.com/
	SecuriteInfo.com.Program.Unwanted.4662.20461.1147.exe	Get hash	malicious	Unknown	Browse	downloadnada.lavasoft.com/update/12.10.158.0/win32/AdAwareWebInstaller.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
wcdownloadercdn.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
geo.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
featureflags.lavasoft.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	Setup.exe	Get hash	malicious	Unknown	Browse	104.16.149.130
flwadw.com	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.27.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.27.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.27.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	WebCompanionInstaller-12.901.5.1061-prod.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.27.149

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://warriorplus.com/o2/a/jxwtscv/0	Get hash	malicious	Unknown	Browse	104.18.35.212
	bin.exe	Get hash	malicious	Unknown	Browse	172.67.177.220
	LTEXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletbrunkagerne.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.21.56.189
	TT Swift copy1.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://freeaccessonline.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	188.114.96.3
	Quotation_final_buy_order_list_2024_po_nos_ART125673211020240000000000024.bat	Get hash	malicious	GuLoader	Browse	188.114.96.3
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
CLOUDFLARENETUS	https://warriorplus.com/o2/a/jxwtscv/0	Get hash	malicious	Unknown	Browse	104.18.35.212
	bin.exe	Get hash	malicious	Unknown	Browse	172.67.177.220
	LTEXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletbrunkagerne.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.21.56.189
	TT Swift copy1.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://freeaccessonline.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	188.114.96.3
	Quotation_final_buy_order_list_2024_po_nos_ART125673211020240000000000024.bat	Get hash	malicious	GuLoader	Browse	188.114.96.3
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
CLOUDFLARENETUS	https://warriorplus.com/o2/a/jxwtscv/0	Get hash	malicious	Unknown	Browse	104.18.35.212
	bin.exe	Get hash	malicious	Unknown	Browse	172.67.177.220
	LTEXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletbrunkagerne.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.21.56.189
	TT Swift copy1.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://freeaccessonline.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	188.114.96.3
	Quotation_final_buy_order_list_2024_po_nos_ART125673211020240000000000024.bat	Get hash	malicious	GuLoader	Browse	188.114.96.3
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://u.to/YaL0IA	Get hash	malicious	Unknown	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	https://warriorplus.com/o2/a/jxwtscv/0	Get hash	malicious	Unknown	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	LTEXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletbrunkagerne.bat	Get hash	malicious	Remcos, GuLoader	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	Quotation_final_buy_order_list_2024_po_nos_ART125673211020240000000000024.bat	Get hash	malicious	GuLoader	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	TicariXHesapXXzetiniz.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	REVISED PROFORMA INVOICE STVC007934196.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	PO FOR CONNECTOR WITH TERMINAL.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	PO 0039499059996600 dtated 10222024.exe	Get hash	malicious	AgentTesla	Browse	104.18.27.149 104.16.149.130 104.16.148.130
	Stima IMP87654 per l'esportazione dell'ultimo trimestre.vbs	Get hash	malicious	GuLoader	Browse	104.18.27.149 104.16.149.130 104.16.148.130

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\Newtonsoft.Json.dll	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ICSharpCode.SharpZipLib.dll	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ICSharpCode.SharpZipLib.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	213656
Entropy (8bit):	5.7590593524797615
Encrypted:	false
SSDEEP:	3072:LK1c/KCOAUXk31Vv91GOtJJKuE1iA5mGPB8qd9OTymIpn+64kRAclDwRNG95ZI4Q:Ge9OAQsFtJrGPBnmIRZUL
MD5:	0CFE19791546A96C6699657A94604596
SHA1:	5D1A1B74CCA9F74FFFEBCB583661C02E4CA626DD
SHA-256:	56FDFD148F0D60805B2873A5A49739909001D11789B75DAB2B0EA8E55BC60913
SHA-512:	586CC695A2C3C03008D0A1032C221CD3384B5F4363E83C9D903753FB1DAD65B340BC8CD0659F7F891A641F8BD7535C9B889219842045854AA98CD380F0FE4AA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......S...........!......... ........... ........@.. .......................@......sC....@.................................d...W........................2... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	438424
Entropy (8bit):	6.09887709092106
Encrypted:	false
SSDEEP:	6144:fHerwzLkqCG3uKWf4g6tUwoOkErUx5/Rsnaszr0tZDPEaN+YB5+GonYy:fHerIacuKUtOkESbKQrvB5+qy
MD5:	461C476F474A5F13D2EA9344AE6F70F6
SHA1:	8F74702B99F08277D4514C63956E2E69E8090073
SHA-256:	4F0EC6439B24652F16DF066F4A38B64518B5A874080EDA63DE45968545830F67
SHA-512:	E69080C205CD82EA2C056FA1328BBEC4C03CA3FDC3EE381C4FB44CB356247BE5FE4B8ADD53036DCB19CAC2C6D59B8E02F81932320EA534B5BA50DB80A0647017
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.R...........!.....t............... ........... ..............................%.....@.....................................K.......8............~...2..........x................................................ ............... ..H............text....s... ...t.................. ..`.rsrc...8............v..............@..@.reloc...............\|..............@..B........................H.......h...................X...P ......................................yK.N...f....i5.#I..xV. ..%BR..^.....t0"..z.%./.G'.j....{...2...k)w...'>.c..P..X.......n...h....E...ex..X/H].R.e.{..;&.-.'....{...."..}....V.(x.....(......}....2.{....oy...2.{....oz...B..(....&..(.......0...........oo........YE....}...............}...n...............n.......I...I...I...I...3...I...X...8D....t......{.....or...o{....ow.....+U..o\|.....{.....o....oo...o}.....o....o....t.....o....o..

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	438936
Entropy (8bit):	6.4311342686757245
Encrypted:	false
SSDEEP:	6144:p0CMChRMg/ZytotgM7/J/NMFkl619WTRIlY57pMF9v2aiSVRlY/8a:CGhGI1Wo/J1l619WQY57pMfi8a
MD5:	A27F9713DB1688D03D2082BFA1827803
SHA1:	B8DF4649659003609419D052757166499D2322E8
SHA-256:	2F86EB0D3902A11DA1F534D9734DABAE37D33E2C57B03F968198A1CFC2E652A9
SHA-512:	F952C6792F10CB60CA3ECC00B317C33AADB65C8471D106171660EC0FCB0603C8D18B8AD2A90AACDA6581D342647290099AF0ED0FDD897EDB390D5BF9209EA905
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf.....................t.......(... ...@....@.. ....................................@..................................(..K....@...q...............2..........X'............................................... ............... ..H............text........ ...................... ..`.rsrc....q...@...r..................@..@.reloc...............~..............@..B.................(......H..................{....i...9............................................~....}.....(......su...}......(....}.....r...pz.(....r'..p.{....(......(........0..j..........{....r...pov...,.(.....+.(......r...p(......(......r...p.{....o....o.......(........sG........o......z..........UU......N.(....r...p..(.....r...p.......{...."..}.....rA..p.rS..p.(....oV...f.~....}.....(......(.....ro..pN.(....r...p..(.....0..i.......~......(....(!...,.r...p.+..(.......(j.....(...+

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe.config

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2273
Entropy (8bit):	5.064418012146103
Encrypted:	false
SSDEEP:	48:c5+qM3DzYnwAGvSy6ZYEcCUkmPlrAn6EVr6R841docr7S3tB:jV3f84CRvur+rAN3r7sz
MD5:	E3D3AA100B93504676414B9268DFBAD4
SHA1:	A7D1E59C9D8C48DFE259D2973C13B0E2965E67AA
SHA-256:	EA7747D876307B0022F055C311C4F8F8112FDDE380E0848FD35508C00EDF8E7A
SHA-512:	9470E0B4784CE3AA94248DDBD9C17BCA988B6A680754511CBE1F1C368270F6D18C75AD1EA0F3A438CA5BB1A12E55E8745F68F2EBC9F78C68B373A6541AC9EFBE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <section name="ProdSettings" type="System.Configuration.NameValueSectionHandler"/>.. <section name="StagingSettings" type="System.Configuration.NameValueSectionHandler"/>.. </configSections>.. <ProdSettings>.. <add key="Installer" value="https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-prod.exe"/>.. <add key="WebProtectionZip" value="https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip"/>.. <add key="InstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/WebCompanion-13.0.0.1080-prod.zip"/>.. <add key="WebInstallerZip" value="http://wcdownloadercdn.lavasoft.com/13.0.0.1080/webinstaller-13.0.0.1080-prod.zip"/>.. </ProdSettings>.. <StagingSettings>.. <add key="Installer" value="https://wcdownloader-qa.lavasoft.com/13.0.0.1080/WebCompanionInstaller-13.0.0.1080-internal.exe"/>.. <add key="WebProtectionZip" va

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\de-DE\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.423116664692943
Encrypted:	false
SSDEEP:	96:5GfMjBmbsmYpthmv13DA+7ZaOrO2I72LYlty5dPolY:5GEjBmb/Ypthmd3k+7LBTUa5NolY
MD5:	A564D6AE745D289B599A010E570E609E
SHA1:	7A698D14CDAB971982B02AF5A9C49D8AEDA56A19
SHA-256:	E20A9695E1322491C57C8A0E61839E5AEEBA40F43AAB400C29F19531D18FA037
SHA-512:	2894F6832F6D20E97E18FF09780D34E7CC25074F0382742838C9A060AF7ADE3FFD3DA9F844E0475697E3854A97379F0961A7F65A1EB5F2ACBA2AF17E49D75B39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................1... ...@....... ....................................@..................................0..O....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......h-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\en-US\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.337584317889265
Encrypted:	false
SSDEEP:	96:tDXGBpbsiopCUoHve6v7ptEAT0VOGSxQ7F0ltEj8dPolY:trGBpbLopDoHm1MeGU8NolY
MD5:	88498F281D2BC857F09C3A0EFFE97A35
SHA1:	5560555DED4D2336EBAAC6AECBD80C2FC6F0AAE7
SHA-256:	2FBD9C10CEC246D5E6EE2F41635F283C3064773724253BAE598BFAEA735B702D
SHA-512:	2550C9C2E42E77A44520EC53418636721C3A56BE7B647C839B7A3063A9BDE4FFD304A6812F51A95DF19B1F04E05285FA9C23AF946472F07DE10F514DDB0DF9C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................N/... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0/......H........+..d...........P ..I...........................................E..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet.... .......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..............v.D\|-......."..&...'c$Q:#Uv=.9.W..Y`..[.F.^:1;jg.Jq........\.......i.......t...............z...O...L...<...5..........................E...........L...

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\es-ES\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.320496600456879
Encrypted:	false
SSDEEP:	96:wfMjBDbsPnpEaLv3lhC3E1Wb/xg/x9lt2EZdPolY:wEjBDbWnpEaLPlhC3fa9ZNolY
MD5:	A22C9231A5562DCA9F0BC186BDA3348D
SHA1:	D4D281A596E272A482C6917DC3CA67C150E72FCB
SHA-256:	AF899C47BDE2A325F3F9F22772F4E305F6B50EAF040670DE508226FEFBED649B
SHA-512:	C140934BF63AADB01F7C0A1A4A7E89FB7CC6DEAA5219BBCB64EB6FB9D29F8139DC4A17C990373BB008A891436BD60E8B21CF748DAB0FA263853663AD17BA9FB4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@.................................<0..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p0......H........,..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\fr-CA\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.4162624308031155
Encrypted:	false
SSDEEP:	96:vfMjBwbssSpcuov88johXbk3LFXRq7hltE5dPolY:vEjBwbJSpcuo0aX07hM5NolY
MD5:	07759138B75C31E8E62E2DCB9E5B4121
SHA1:	C78CAC2D69DD3770256EA1D22FE62F8991AE1735
SHA-256:	460E0EA0F891B4A7D8FCF4D7C1DAF4034B1A8C01F35C55B87C4DE4D34F7E1119
SHA-512:	7089069EFBE9109ED034C9538B16F482573757A6DAED2D870CF1711F15B1F39FFFC6E5F9FF5E3380514EAFCEE49797F63DD0C9E472D37647EE3FCF34E086B189
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@..................................0..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......8-..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\it-IT\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.05939038461759
Encrypted:	false
SSDEEP:	48:64WHsDO4eUqFAjpI1UhCvEWRCYVl6TxNLu6hxPFraKuhuXahZ439M/oKx8Welt4u:UFfAjpI1fvC6StPPtM+7tlth8tdPolY
MD5:	320A49D5E8C225BF7D8C8FC8F0FBA1FE
SHA1:	6986D89BABDB474B16E3074865EEDFFCCECC9337
SHA-256:	53F48BF5DEB5FB756EB61D5EE78BB72EF4509ADB396EB40BEF9671ECAA8D9819
SHA-512:	6EC2883F6542F8EA3966F367E11359B3702B8E8E01FAFA3D3828E16D216CC77CC71B92BB1BFBC0C7F146C79FB4DBEE5FAD84288DFE1C5979F0C59841B92F03D6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!................n,... ...@....... ....................................@..................................,..W....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P,......H........(..d...........P ..`...........................................\..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&#Uv=.9.W.F.^:1;j........a.......J...'...........(...............p.......E...........{...........b.......B...O............B.T.N._.C.L.O.S.E......

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ja-JP\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.697358912630535
Encrypted:	false
SSDEEP:	96:KsC3ASpa3kvBYTnRDzIWI2dPRp0QltdHmdPolY:KsOASpa3kpXoR+Q1GNolY
MD5:	442654050F5E5EBFB286C75A6AD10485
SHA1:	7F9AB13C925DDDE3ADE1EBA334DD17F6BF341F7A
SHA-256:	B85CC7BA82B58AFD8FA00DFCCD820B5B34BC14A942EBDAB5380FCE8F7257C0AE
SHA-512:	E7F9F728603091728451127C02B1F8412C741C57C5ADFED91FECA37989C07570886ACA262ECBDB17A968474E05936C3485602115CBC26EDCEE65DD7764B76795
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................-... ...@....... ....................................@..................................-..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H....... *..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\pt-BR\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.272201212454418
Encrypted:	false
SSDEEP:	96:afMjBsbswapvL6vu1667y4UNGaB3q4kUO6ltMNdPolY:aEjBsb9apvL6ms67yJ3hUNNolY
MD5:	01CCD85F0676258B5E4A223832E3258C
SHA1:	630CD9F369A81A7823905FD842FDDEEFAF23D3A1
SHA-256:	C482D074CFDA0B6921A6750F0CCC1279BA6FCFB9D2037CA6EAAF704D8DAF811F
SHA-512:	1BB2DB0ABF3E0BCA3B131D2DF5329006A56E3FAA4E540621E54AA98DBB0BF4E27093314B477AA66E4F10FE0AF5DF1887FF23CAD938C5B0F98E455433E14FAD01
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................0... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......\|,..d...........P ..,...........................................(..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ru-RU\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.608207837862824
Encrypted:	false
SSDEEP:	96:41fMjBGbsSopXm7vGQdkxbdV2UCwbT+T/UA7+1styo36glt55odPolY:eEjBGbbopXm7eXxbWqExi1splHoNolY
MD5:	F2876EC061D1CC88E44104ED97FC36F8
SHA1:	68BFE2A32CA14B0C379EF725E426AB2FED09E075
SHA-256:	6071DAA27880FE3F6B9FB704890250CA655CAFE832A1B9A4E59F0CFFFB042E04
SHA-512:	E3DD2BAAB3C5AFB124DC9CC0BB2D9318D33707732B4F23C211C2E3BC5A8A8889FAF42003857DA98D43DD7F7368CAFB3A02591BE04DCA4E1343A00283CA071DB6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................3... ...@....... ....................................@..................................3..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H.......L0..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....".......PADPADP......n.....V ...].......}.E(/....xv.\|.-..X:..o.....V..................v...1.D\|-......."..&...'c$Q:#Uv=.9.W*..Y`..[.F.^:1;jg.Jq............g...i...............!.......z...............5...v.......K....... .......3...<...

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\tr-TR\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.204809000235561
Encrypted:	false
SSDEEP:	48:6teH9O4G6ULy3ABApQe1eBpQvu18JvLh4jK0YuPx4S8zqeelt4833PPbknI5Klfy:TsC3AWpt1eYvJgjKZSJltkFdPolY
MD5:	D0009577C38F3338B2A3DCCEE9DF5169
SHA1:	D567D95A61B57885B55D7D70B93BC839EF162436
SHA-256:	598BAD964E2BED4A4EDAFAC5E8838C7B922C6EBBFBA70EDA0D400E543B91E54B
SHA-512:	95F766F541CA5EFC74C3DCC9D5C299798B581F1B302A4EFFDCA9B7ED4177DAF4E8547B7729DB724EB0A8A28C9770FC470BF9BDF2C616F70782DC96056CF8410E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................,... ...@....... ....................................@.................................<,..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p,......H........(..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\zh-CHS\WebCompanion-Installer.resources.dll

Download File

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	4.582926268925439
Encrypted:	false
SSDEEP:	96:vsC3AjpTfYGvqLH+/WZGrlqlt9kdPolY:vsOAjpTfxyb+/gGJq1kNolY
MD5:	322549094C487E49ACEB9899419D8EC6
SHA1:	DD0E5FF6BC3E4590203829DA1BB8BD7B00CBD07E
SHA-256:	7824381C18E86E72C0D4A8BB0ED377DFDB6E3B5374984ED67AF119B14268E70D
SHA-512:	80747F72196406993110D0DB5B736BCA21975C26615D34F771042E69CA0D519ED80C0E9267A90517A5B9862AB44CF9F9D96C354E952CB9CB0C32EB4887F80A1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$Cf...........!.................+... ...@....... ....................................@.................................t+..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........(..h...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........V ...].......}....xv.\|.-..X:.....V..................v...1.D\|-...."..&.9.W.F.^:1;j........a.......)...............(...............O.......$...........{.......j...b...B...O............B.T.N._.C.L.O.S.E......B.T.N._.

C:\Users\user\AppData\Local\Temp\WcInstaller.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe
File Type:	ASCII text, with very long lines (912), with CRLF line terminators
Category:	modified
Size (bytes):	3301
Entropy (8bit):	5.320806931061311
Encrypted:	false
SSDEEP:	96:DK1qtAPy4COl++etLDAeX6xbmeK1qtAnSnWAiH:DK1KAKis+MLxX6xbmeK1KAtAiH
MD5:	31296E0EA4A3D3D9173B1D1C307BB260
SHA1:	2894CBCC7D0E775F2202130938D2E07E22B92D19
SHA-256:	4FFE116A6C9F90B460C82C96B2882317E7D34D65C1E87976CE5E709C8D2017AF
SHA-512:	E4C3C53A37493471CC27823295BA4E0B9FE3284FFEF031EDE575FE9E50D1EEEAB9DBD16B21D5F36B905E7A4EC7017C96414FCC466F24EB31EFE5F41FE76E4ACA
Malicious:	false
Preview:	Detecting windows culture..Preparing request for featureflag: {"Geo":"US","Partner":"IN240402","Campaign":"20622070018","InstallDate":"20241022","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}..Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklis

C:\Users\user\AppData\Local\Temp\WebCompanion.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	10494317
Entropy (8bit):	7.994463819622281
Encrypted:	true
SSDEEP:	196608:pKZsrAth9Vrdx45WtQbJtXWYxEwsOOXd/XUCv1uGJONYTr9udX6:U+rWVBx3WX7EJONION6f
MD5:	C0A2AAF917E6BC1D951EC481213D4138
SHA1:	56308BC1CF014F507E161B518736CD3D3666387D
SHA-256:	2F87DCD36A114502A3C80ECF8A8C5F5EF60475951F9C142A1A68BDEC6CAA3E23
SHA-512:	43EF07470F33BA0FF6A18E343C55ADAF0CDB2B88C3B37FA53F32608F1F78B6266BFACD2BB3BD92BF56EB0E28C4C20278212E06C1873DEA9098ECE5CDB117B9BC
Malicious:	false
Preview:	PK.........%.X....FF...$......Application/7za.exe.yxTE.8\|{I.YH'@CX.V[..%CP.4h_.MnCG@DQ..h..... .`'..\[...u..yg....QGY\........{..d.....S.......~.}y...N.:u..S.NU...`.......k....~.......e..o.`.......[`._..]U..g.s...?..~..J..:.~.s.t.}..q.>}2l.....u.....#.Y..Mt}.......6z......{.:.:.y^KW.]....ys."..Nu.........C.EB..$..P.k......s.(..zN..K.........iH..Z.....[..x.P.7.iB.6..Ta.,..I...#....g.r...<.wg.....zb......QUw..M.:...L...nHN..r...]#..TA.r...vO..5.'.:B]..p}<.lxU... ...6...........?i...o...g..7H...%E_..B...d.... .f.].&I..Q..G.S..x.o.K......../.~...g.Q_..^(..h^...Dq.J\Y2.....&...........Fo`...........}....98E'..Kne+c........._./..o.o.+g.z..M.6.....D.D.^I9..!..0HJ..?h.7..2"U.;...RY..=b..k.^y....0.l...m...h..9.........f....J-N..KU....HH."......Y...I)8..=s>.)MPH!.L....e...J..`bc(.:.-M=}...v...=..9.:..u.7.X.O...T..%e.)V...rS..s....o...[1.C... ...x7g)P..:............8. .u...lv-a..MB.TyW..D..p$..0.x>..'..K..l./g..U......b{.!_...,....<.....$#zh.e....+.

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.619331261111519
Encrypted:	false
SSDEEP:	3:asLGY2K8IA63dX31OY:aqGY29c3pkY
MD5:	A1CAF4009ECFAF24F78FCD8FACA964F0
SHA1:	8B87B1107F16DA5BF57D8A20FCE663D3764433DD
SHA-256:	976DEBD41ED9E00119BFA7B57934924876027E3ACED97456650776834D4D93C0
SHA-512:	010C74FEB50EB0D237EAFAE5B01896BC1DB52408DB9F85DDED78F0BA643E28619C5244AEDEFBF89E3AA100F9819F5631565F2E474FAEFC50C381D0C19D9377FE
Malicious:	false
Preview:	{ "install_id" : "321bcaa0-1466-4c28-be75-23bfee67d933"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.65366062702913
TrID:	Win32 Executable (generic) a (10002005/4) 99.40% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Setup.exe
File size:	545'352 bytes
MD5:	fef9a20fcd13f76e4656a66a95ae336c
SHA1:	f21aca3de231ef5476913b40f3d52d31c5cb9eb8
SHA256:	28fcbf8a60bc702b59e1fb25ece117741822136b6aa755440eec15b229d3f84c
SHA512:	42f025c9461bdc24e5ccacc050fd5adcbd975a02622f03474f65296cbdfc034edb626951e3e10cd1df145383a23bdca15a655ad7a65f281ad93d4e737be778e6
SSDEEP:	12288:nG5knZfFKeTDOydwORmV42Y5RBHtf8WS8sejGxUeRx7/7M:nG50ZfFKMDRCa0gDS8geevM
TLSH:	E4C4F1127DE089B5D5820431CC745FA6A2B6FE560A21887373997E3E7F7F642C232A1D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s..c}...s..Yy...s..w,...s...r./.s..w....s..Yx...s.......s.......s.Zyu...s.Rich..s.................PE..L......M...

File Icon


Icon Hash:	8011090b07071616

Static PE Info

General

Entrypoint:	0x4148d4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4DAC88CE [Mon Apr 18 18:54:06 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e00de6e48b9b06aceb12a81e7bf494c9

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Entrust Extended Validation Code Signing CA - EVCS2, O="Entrust, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	01/05/2024 16:39:26 01/05/2025 16:39:25
Subject Chain	CN=7270356 Canada Inc., SERIALNUMBER=1417258-2, OID.2.5.4.15=Private Organization, O=7270356 Canada Inc., OID.1.3.6.1.4.1.311.60.2.1.3=CA, L=Saint-Laurent, S=Quebec, C=CA
Version:	3
Thumbprint MD5:	0E3940FCE9D8B244F0D82DDEEBE28F5E
Thumbprint SHA-1:	EA06433E6F12D2AADA040F4A6EF7C927404A4CBA
Thumbprint SHA-256:	EB0A666D9DFD790059DF788FBA544ABC93E1690F1425147BA0A6E784AFC6F5B5
Serial:	25D0CB9D7B0D6C700CDAE43D243AB1C6

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 0041B9E8h
push 004147FCh
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [0041B078h]
xor edx, edx
mov dl, ah
mov dword ptr [004233F0h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [004233ECh], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [004233E8h], ecx
shr eax, 10h
mov dword ptr [004233E4h], eax
push 00000001h
call 00007FA80CA62DDBh
pop ecx
test eax, eax
jne 00007FA80CA61F4Ah
push 0000001Ch
call 00007FA80CA62008h
pop ecx
call 00007FA80CA6288Dh
test eax, eax
jne 00007FA80CA61F4Ah
push 00000010h
call 00007FA80CA61FF7h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007FA80CA649FCh
call dword ptr [0041B07Ch]
mov dword ptr [00425A5Ch], eax
call 00007FA80CA648BAh
mov dword ptr [00423360h], eax
call 00007FA80CA64663h
call 00007FA80CA645A5h
call 00007FA80CA64000h
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [0041B080h]
call 00007FA80CA64536h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007FA80CA61F48h
movzx eax, word ptr [ebp+00h]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[ C ] VS2010 build 30319
[ASM] VS2010 build 30319
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e9ac	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0x71d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x81fb0	0x3298
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x200	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x197c0	0x19800	206b62d600beb166f8bf863ad5301f8c	False	0.5831609987745098	DOS executable (COM)	6.60822715389085	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x4490	0x4600	b0314f39355cab7d4674a0928d3b15f2	False	0.312109375	data	4.383775518811042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x5a68	0x3200	8d44c03d32e0c923339cda9fae15827a	False	0.123828125	data	1.3793356235333818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.sxdata	0x26000	0x4	0x200	35925cfdc1176bd9ffc634a58b40ec17	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27000	0x71d4	0x7200	cd606fe2fe8a9aaa6244d6a44a46010a	False	0.3919613486842105	data	4.655199945289653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27354	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.37231182795698925
RT_ICON	0x2763c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5472972972972973
RT_ICON	0x27764	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2833 x 2833 px/m			0.3200354609929078
RT_ICON	0x27bcc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 2833 x 2833 px/m			0.23688524590163934
RT_ICON	0x28554	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2833 x 2833 px/m			0.1721388367729831
RT_ICON	0x295fc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2833 x 2833 px/m			0.1241701244813278
RT_ICON	0x2bba4	0x1a7b	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9648915769287506
RT_DIALOG	0x2d620	0xb8	data	English	United States	0.6684782608695652
RT_STRING	0x2d6d8	0x94	data	English	United States	0.668918918918919
RT_STRING	0x2d76c	0x34	data	English	United States	0.6538461538461539
RT_GROUP_ICON	0x2d7a0	0x4c	data			0.8289473684210527
RT_GROUP_ICON	0x2d7ec	0x22	data	English	United States	1.0
RT_VERSION	0x2d810	0x344	data	English	United States	0.4318181818181818
RT_MANIFEST	0x2db54	0x67f	exported SGML document, ASCII text, with CRLF line terminators	English	United States	0.3692122669873722

Imports

DLL	Import
OLEAUT32.dll	VariantClear, SysAllocString
USER32.dll	SendMessageA, SetTimer, DialogBoxParamW, DialogBoxParamA, SetWindowLongA, GetWindowLongA, SetWindowTextW, LoadIconA, LoadStringW, LoadStringA, CharUpperW, CharUpperA, DestroyWindow, EndDialog, PostMessageA, ShowWindow, MessageBoxW, GetDlgItem, KillTimer, SetWindowTextA
SHELL32.dll	ShellExecuteExA
KERNEL32.dll	GetCurrentDirectoryA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, InterlockedIncrement, InterlockedDecrement, GetProcAddress, GetOEMCP, GetACP, GetCPInfo, IsBadCodePtr, IsBadReadPtr, GetFileType, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, UnhandledExceptionFilter, HeapSize, GetCurrentProcess, TerminateProcess, IsBadWritePtr, HeapCreate, HeapDestroy, GetEnvironmentVariableA, SetUnhandledExceptionFilter, TlsAlloc, ExitProcess, GetVersion, GetCommandLineA, GetStartupInfoA, GetModuleHandleA, WaitForSingleObject, CloseHandle, CreateProcessA, GetCommandLineW, GetVersionExA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, GetLastError, LoadLibraryA, GetModuleFileNameW, GetModuleFileNameA, LocalFree, FormatMessageW, FormatMessageA, SetFileTime, CreateFileW, SetLastError, SetFileAttributesW, SetFileAttributesA, RemoveDirectoryW, RemoveDirectoryA, CreateDirectoryW, CreateDirectoryA, DeleteFileW, DeleteFileA, GetFullPathNameW, GetFullPathNameA, SetCurrentDirectoryW, SetCurrentDirectoryA, GetCurrentDirectoryW, GetTempPathW, GetTempPathA, GetCurrentProcessId, GetTickCount, GetCurrentThreadId, FindClose, FindFirstFileW, FindFirstFileA, FindNextFileW, FindNextFileA, CreateFileA, GetFileSize, SetFilePointer, ReadFile, WriteFile, SetEndOfFile, GetStdHandle, WaitForMultipleObjects, Sleep, VirtualAlloc, VirtualFree, CreateEventA, SetEvent, ResetEvent, InitializeCriticalSection, RtlUnwind, RaiseException, HeapAlloc, HeapFree, HeapReAlloc, CreateThread, TlsSetValue, TlsGetValue, ExitThread

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-22T09:55:33.775006+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49706	104.16.148.130	80	TCP
2024-10-22T09:55:47.588821+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49828	104.16.149.130	443	TCP
2024-10-22T09:55:51.739529+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49850	104.16.149.130	443	TCP
2024-10-22T09:55:55.584810+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49872	104.16.149.130	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 22, 2024 09:55:12.632301092 CEST	49706	80	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:12.638365030 CEST	80	49706	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:12.638601065 CEST	49706	80	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:12.667902946 CEST	49706	80	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:12.673610926 CEST	80	49706	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:13.342528105 CEST	80	49706	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:13.384485960 CEST	49706	80	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:13.500475883 CEST	49707	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:13.500560999 CEST	443	49707	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:13.500657082 CEST	49707	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:13.510560989 CEST	49707	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:13.510600090 CEST	443	49707	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:14.254482985 CEST	443	49707	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:14.254708052 CEST	49707	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:14.261051893 CEST	49707	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:14.261106968 CEST	443	49707	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:14.261567116 CEST	443	49707	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:14.306366920 CEST	49707	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:14.316546917 CEST	49707	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:14.363331079 CEST	443	49707	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:14.363504887 CEST	49707	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:14.363559008 CEST	443	49707	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:14.547698021 CEST	443	49707	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:14.547940969 CEST	443	49707	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:14.548127890 CEST	49707	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:14.550626040 CEST	49707	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:14.650312901 CEST	49708	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:14.650398970 CEST	443	49708	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:14.650491953 CEST	49708	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:14.650788069 CEST	49708	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:14.650818110 CEST	443	49708	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:15.279223919 CEST	443	49708	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:15.279419899 CEST	49708	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:15.285435915 CEST	49708	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:15.285468102 CEST	443	49708	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:15.285943985 CEST	443	49708	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:15.288666010 CEST	49708	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:15.331404924 CEST	443	49708	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:15.331551075 CEST	49708	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:15.331578016 CEST	443	49708	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:15.562370062 CEST	443	49708	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:15.562593937 CEST	443	49708	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:15.562799931 CEST	49708	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:15.563159943 CEST	49708	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:15.571480036 CEST	49709	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:15.571520090 CEST	443	49709	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:15.571600914 CEST	49709	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:15.571809053 CEST	49709	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:15.571825027 CEST	443	49709	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:16.195081949 CEST	443	49709	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:16.198967934 CEST	49709	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:16.198988914 CEST	443	49709	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:16.199201107 CEST	49709	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:16.199208975 CEST	443	49709	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:16.449454069 CEST	443	49709	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:16.449692011 CEST	443	49709	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:16.449754000 CEST	49709	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:16.453511000 CEST	49709	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:16.479911089 CEST	49710	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:16.479938984 CEST	443	49710	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:16.480026960 CEST	49710	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:16.480355024 CEST	49710	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:16.480371952 CEST	443	49710	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:17.103132010 CEST	443	49710	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:17.105261087 CEST	49710	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:17.105304003 CEST	443	49710	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:17.105369091 CEST	49710	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:17.105380058 CEST	443	49710	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:18.410518885 CEST	443	49710	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:18.410767078 CEST	443	49710	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:18.410974979 CEST	49710	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:18.411464930 CEST	49710	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:18.420706987 CEST	49711	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:18.420746088 CEST	443	49711	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:18.420855045 CEST	49711	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:18.421287060 CEST	49711	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:18.421299934 CEST	443	49711	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:19.038069963 CEST	443	49711	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:19.040823936 CEST	49711	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:19.040844917 CEST	443	49711	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:19.040935993 CEST	49711	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:19.040941954 CEST	443	49711	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:20.161040068 CEST	443	49711	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:20.161266088 CEST	443	49711	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:20.161323071 CEST	49711	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:20.161686897 CEST	49711	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:20.969856024 CEST	49712	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:20.969903946 CEST	443	49712	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:20.969975948 CEST	49712	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:20.970207930 CEST	49712	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:20.970213890 CEST	443	49712	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:21.576855898 CEST	443	49712	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:21.578896046 CEST	49712	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:21.578917027 CEST	443	49712	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:21.578969002 CEST	49712	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:21.578978062 CEST	443	49712	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:21.830745935 CEST	443	49712	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:21.830832005 CEST	443	49712	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:21.831079960 CEST	49712	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:21.832720995 CEST	49712	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:21.837426901 CEST	49715	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:21.837519884 CEST	443	49715	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:21.837616920 CEST	49715	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:21.837816954 CEST	49715	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:21.837841034 CEST	443	49715	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:22.457434893 CEST	443	49715	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:22.459655046 CEST	49715	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:22.459687948 CEST	443	49715	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:22.459744930 CEST	49715	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:22.459757090 CEST	443	49715	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:22.704482079 CEST	443	49715	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:22.704757929 CEST	443	49715	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:22.704896927 CEST	49715	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:22.705449104 CEST	49715	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:22.719651937 CEST	49716	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:22.719691038 CEST	443	49716	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:22.719755888 CEST	49716	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:22.720026016 CEST	49716	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:22.720040083 CEST	443	49716	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:23.330715895 CEST	443	49716	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:23.332894087 CEST	49716	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:23.332917929 CEST	443	49716	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:23.333175898 CEST	49716	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:23.333180904 CEST	443	49716	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:23.610894918 CEST	443	49716	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:23.611553907 CEST	443	49716	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:23.611989975 CEST	49716	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:23.612456083 CEST	49716	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:23.617780924 CEST	49718	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:23.617805958 CEST	443	49718	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:23.618027925 CEST	49718	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:23.618252039 CEST	49718	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:23.618262053 CEST	443	49718	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:24.227755070 CEST	443	49718	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:24.230242968 CEST	49718	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:24.230258942 CEST	443	49718	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:24.230309010 CEST	49718	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:24.230315924 CEST	443	49718	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:24.529228926 CEST	443	49718	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:24.529438972 CEST	443	49718	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:24.529499054 CEST	49718	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:24.529867887 CEST	49718	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:24.545506001 CEST	49719	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:24.545598984 CEST	443	49719	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:24.545878887 CEST	49719	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:24.545994997 CEST	49719	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:24.546025038 CEST	443	49719	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:25.161052942 CEST	443	49719	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:25.162564039 CEST	49719	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:25.162612915 CEST	443	49719	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:25.162694931 CEST	49719	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:25.162708044 CEST	443	49719	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:25.443927050 CEST	443	49719	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:25.444032907 CEST	443	49719	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:25.444209099 CEST	49719	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:25.444521904 CEST	49719	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:25.450823069 CEST	49720	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:25.450869083 CEST	443	49720	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:25.450939894 CEST	49720	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:25.451164961 CEST	49720	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:25.451178074 CEST	443	49720	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:26.057923079 CEST	443	49720	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:26.059856892 CEST	49720	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:26.059880972 CEST	443	49720	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:26.059933901 CEST	49720	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:26.059940100 CEST	443	49720	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:26.309880972 CEST	443	49720	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:26.310229063 CEST	443	49720	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:26.310288906 CEST	49720	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:26.311155081 CEST	49720	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:26.335932970 CEST	49722	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:26.335964918 CEST	443	49722	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:26.336020947 CEST	49722	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:26.336478949 CEST	49722	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:26.336489916 CEST	443	49722	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:26.945713997 CEST	443	49722	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:26.949114084 CEST	49722	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:26.949131966 CEST	443	49722	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:26.949223042 CEST	49722	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:26.949227095 CEST	443	49722	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:27.205482006 CEST	443	49722	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:27.206089020 CEST	443	49722	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:27.206177950 CEST	49722	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:27.206573009 CEST	49722	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:27.215171099 CEST	49724	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:27.215259075 CEST	443	49724	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:27.215873003 CEST	49724	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:27.216250896 CEST	49724	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:27.216332912 CEST	443	49724	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:27.828900099 CEST	443	49724	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:27.831146002 CEST	49724	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:27.831211090 CEST	443	49724	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:27.831367970 CEST	49724	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:27.831382036 CEST	443	49724	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.085786104 CEST	443	49724	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.085931063 CEST	443	49724	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.086297989 CEST	49724	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.087035894 CEST	49724	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.095014095 CEST	49727	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.095047951 CEST	443	49727	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.099343061 CEST	49727	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.103018045 CEST	49727	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.103037119 CEST	443	49727	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.718632936 CEST	443	49727	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.720561028 CEST	49727	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.720588923 CEST	443	49727	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.720633030 CEST	49727	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.720643997 CEST	443	49727	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.920618057 CEST	443	49727	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.920722008 CEST	443	49727	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.920774937 CEST	49727	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.921190977 CEST	49727	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.927382946 CEST	49731	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.927475929 CEST	443	49731	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:28.927570105 CEST	49731	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.927928925 CEST	49731	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:28.928010941 CEST	443	49731	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:29.533984900 CEST	443	49731	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:29.535557032 CEST	49731	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:29.535597086 CEST	443	49731	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:29.535650969 CEST	49731	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:29.535660982 CEST	443	49731	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:29.780572891 CEST	443	49731	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:29.780843019 CEST	443	49731	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:29.782798052 CEST	49731	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:29.783169031 CEST	49731	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:29.796767950 CEST	49734	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:29.796858072 CEST	443	49734	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:29.796948910 CEST	49734	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:29.800513029 CEST	49734	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:29.800534010 CEST	443	49734	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:30.418936968 CEST	443	49734	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:30.426868916 CEST	49734	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:30.426887035 CEST	443	49734	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:30.427025080 CEST	49734	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:30.427032948 CEST	443	49734	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:30.720877886 CEST	443	49734	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:30.720961094 CEST	443	49734	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:30.723097086 CEST	49734	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:30.727885962 CEST	49734	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:30.738450050 CEST	49740	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:30.738538980 CEST	443	49740	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:30.738651991 CEST	49740	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:30.739049911 CEST	49740	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:30.739132881 CEST	443	49740	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:31.358774900 CEST	443	49740	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:31.360985041 CEST	49740	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:31.361047983 CEST	443	49740	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:31.361134052 CEST	49740	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:31.361157894 CEST	443	49740	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:31.669233084 CEST	443	49740	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:31.669312000 CEST	443	49740	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:31.669608116 CEST	49740	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:31.669931889 CEST	49740	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:31.674833059 CEST	49747	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:31.674917936 CEST	443	49747	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:31.675005913 CEST	49747	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:31.675394058 CEST	49747	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:31.675477028 CEST	443	49747	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:32.294039011 CEST	443	49747	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:32.304913998 CEST	49747	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:32.304975986 CEST	443	49747	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:32.305041075 CEST	49747	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:32.305061102 CEST	443	49747	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:32.560396910 CEST	443	49747	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:32.560719967 CEST	443	49747	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:32.560782909 CEST	49747	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:32.561306000 CEST	49747	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:32.566968918 CEST	49754	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:32.567035913 CEST	443	49754	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:32.567116022 CEST	49754	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:32.567359924 CEST	49754	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:32.567399025 CEST	443	49754	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:33.188409090 CEST	443	49754	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:33.190009117 CEST	49754	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:33.190052986 CEST	443	49754	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:33.190107107 CEST	49754	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:33.190126896 CEST	443	49754	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:33.488421917 CEST	443	49754	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:33.488553047 CEST	443	49754	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:33.488632917 CEST	49754	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:33.489257097 CEST	49754	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:33.492793083 CEST	49706	80	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:33.498210907 CEST	80	49706	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:33.732594013 CEST	80	49706	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:33.733659029 CEST	49760	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:33.733715057 CEST	443	49760	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:33.733783960 CEST	49760	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:33.734323978 CEST	49760	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:33.734347105 CEST	443	49760	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:33.775006056 CEST	49706	80	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:34.526082993 CEST	443	49760	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:34.528031111 CEST	49760	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:34.528065920 CEST	443	49760	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:34.528204918 CEST	49760	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:34.528229952 CEST	443	49760	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:34.759299040 CEST	443	49760	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:34.759442091 CEST	443	49760	104.16.148.130	192.168.2.5
Oct 22, 2024 09:55:34.759599924 CEST	49760	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:34.760200977 CEST	49760	443	192.168.2.5	104.16.148.130
Oct 22, 2024 09:55:34.772119999 CEST	49766	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:34.772156954 CEST	443	49766	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:34.773931980 CEST	49766	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:34.774307966 CEST	49766	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:34.774321079 CEST	443	49766	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:35.383660078 CEST	443	49766	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:35.386909008 CEST	49766	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:35.386931896 CEST	443	49766	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:35.386986017 CEST	49766	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:35.386995077 CEST	443	49766	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:35.608376026 CEST	443	49766	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:35.608495951 CEST	443	49766	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:35.608587980 CEST	49766	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:35.643990993 CEST	49766	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:35.658052921 CEST	49772	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:35.658097982 CEST	443	49772	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:35.658174992 CEST	49772	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:35.658706903 CEST	49772	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:35.658727884 CEST	443	49772	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:36.263371944 CEST	443	49772	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:36.265563011 CEST	49772	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:36.265587091 CEST	443	49772	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:36.265650988 CEST	49772	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:36.265655041 CEST	443	49772	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:36.579193115 CEST	443	49772	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:36.579307079 CEST	443	49772	104.18.27.149	192.168.2.5
Oct 22, 2024 09:55:36.579359055 CEST	49772	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:36.579848051 CEST	49772	443	192.168.2.5	104.18.27.149
Oct 22, 2024 09:55:36.609863997 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:36.609896898 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:36.610074043 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:36.610404015 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:36.610415936 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:37.352399111 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:37.352497101 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:37.356894016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:37.356914997 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:37.357161999 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:37.358738899 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:37.399343014 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536246061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536339045 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536379099 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536398888 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.536410093 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536437035 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536457062 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.536492109 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536520958 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536525965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.536531925 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536562920 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536565065 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.536573887 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.536616087 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.536639929 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.545170069 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.545221090 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.545234919 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.545258045 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.545296907 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.545301914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.545315027 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.545356035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.545372963 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.545408964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.545437098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.545438051 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.545449018 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.545486927 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.546282053 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.546415091 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.546442032 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.546485901 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.546494961 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.546528101 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.546997070 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.547065020 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.547099113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.547105074 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.547115088 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.547152042 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.547158957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.547916889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.547938108 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.547956944 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.547960997 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.547970057 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.547991991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.551007032 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.551039934 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.551070929 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.551090956 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.551130056 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.551341057 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.551775932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.551827908 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.551841021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.552814960 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.552881956 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.552892923 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.553580999 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.553611994 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.553637981 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.553653002 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.553668022 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.553689957 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.554517031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.555083990 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.555131912 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.555145979 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.555183887 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.556437969 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.556484938 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.556603909 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.556648970 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.556915998 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.556967020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.557287931 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.557343960 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.558563948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.558618069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.558640003 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.558701992 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.558984995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.559024096 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.559071064 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.559119940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.559587955 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.559634924 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.559876919 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.559922934 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.560625076 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.560673952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.560705900 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.560755014 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.560779095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.560825109 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.562171936 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.562225103 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.562261105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.562308073 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.562362909 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.562407970 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.562454939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.562509060 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.562761068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.562814951 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.562836885 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.562874079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.566015005 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.566082954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.566121101 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.566164970 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.566246033 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.566288948 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.566328049 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.566373110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.566412926 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.566454887 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.648560047 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.648686886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.684478998 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.684627056 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.684664965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.684686899 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.684705973 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.684746981 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.684788942 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.684878111 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.684878111 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.684900999 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.728152990 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.767429113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.767541885 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.803281069 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.803406954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.803796053 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.803853989 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.803858995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.803869963 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.803904057 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.803909063 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.803916931 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.803953886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.851669073 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.851742029 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.886581898 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.886693001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.922842026 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.922878981 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.922919035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.922947884 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:38.922950983 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:38.962554932 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.041520119 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.041584015 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.041661978 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.041682005 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.041714907 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.041726112 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.089323044 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.089370012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.089421988 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.089443922 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.089472055 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.089492083 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.160558939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.160590887 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.160797119 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.160814047 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.160854101 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.279333115 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.279367924 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.279488087 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.279520035 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.279537916 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.279565096 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.279568911 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.279581070 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.279606104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.279638052 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.398374081 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.398435116 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.398472071 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.398498058 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.398518085 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.398546934 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.398611069 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.398654938 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.398674011 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.398703098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.398715019 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.398749113 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.517000914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.517070055 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.517097950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.517106056 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.517132044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.517151117 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.517683983 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.517728090 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.517770052 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.517816067 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.517851114 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.517870903 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.836350918 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.836384058 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.836461067 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.836489916 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.836517096 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.836704016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.836704016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.837311029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.837332010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.837388039 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.837395906 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.837420940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.837608099 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.837631941 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.837658882 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.837663889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.837698936 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.873862028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.873894930 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.873933077 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.873946905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.873971939 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.874222994 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.874248981 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.874284029 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.874289036 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.874325037 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.915710926 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.993011951 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.993086100 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.993127108 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.993150949 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.993379116 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.993379116 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.993482113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.993525982 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.993551016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.993561029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:39.993576050 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:39.993598938 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.077953100 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.077985048 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.078027010 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.078039885 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.078061104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.078075886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.111985922 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.112009048 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.112113953 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.112138033 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.112323046 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.154292107 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.154314041 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.154495001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.154501915 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.154551029 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.230318069 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.230339050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.230401993 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.230408907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.230534077 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.231173038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.231193066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.231245995 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.231251001 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.231319904 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.316121101 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.316143036 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.316340923 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.316364050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.316410065 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.349927902 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.349948883 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.350023985 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.350044966 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.350234032 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.392741919 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.392760992 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.392806053 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.392812014 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.392851114 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.468362093 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.468419075 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.468496084 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.468517065 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.468539000 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.468564034 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.469101906 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.469151020 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.469182014 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.469187975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.469208956 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.469238997 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.511780977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.511843920 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.511996031 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.511996031 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.512018919 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.512073994 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.587371111 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.587399960 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.587555885 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.587555885 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.587578058 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.588267088 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.588319063 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.588346004 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.588371992 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.588380098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.591077089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.630629063 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.630678892 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.630727053 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.630748034 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.630774021 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.630786896 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.706237078 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.706296921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.706343889 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.706362963 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.706373930 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.706435919 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.708081007 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.708127022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.708158016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.708163977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.708192110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.708211899 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.753725052 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.753772020 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.753818035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.753838062 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.753856897 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.753876925 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.825094938 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.825160027 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.825202942 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.825227022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.825248003 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.825265884 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.826919079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.826968908 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.826992035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.827003956 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.827028990 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.827049017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.868979931 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.869013071 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.869057894 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.869079113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.869112968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.869128942 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.944576979 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.944643021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.944814920 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.944814920 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.944844007 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.946003914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.946055889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.946072102 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.946089029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.946113110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.946141958 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.987854004 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.987921953 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.988073111 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.988073111 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:40.988096952 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:40.991076946 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.033200979 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.033230066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.033453941 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.033453941 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.033472061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.035077095 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.063883066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.063913107 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.064114094 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.064114094 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.064135075 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.065542936 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.065570116 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.065601110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.065615892 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.065629005 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.065654039 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.111768007 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.111797094 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.111843109 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.111855984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.111881971 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.111902952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.183465958 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.183532000 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.183568001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.183595896 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.183607101 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.183634043 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.185870886 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.185925961 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.185946941 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.185951948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.185977936 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.185997009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.226346016 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.226425886 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.226433039 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.226454973 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.226484060 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.226505041 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.229861975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.229912043 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.229938030 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.229943037 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.229967117 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.229974985 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.301495075 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.301573038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.301599026 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.301621914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.301636934 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.301665068 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.303041935 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.303086996 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.303107023 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.303117037 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.303143024 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.303159952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.345117092 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.345166922 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.345205069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.345226049 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.345237017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.345262051 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.348984003 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.349035025 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.349057913 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.349067926 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.349076986 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.349100113 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.420499086 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.420561075 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.420582056 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.420591116 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.420629978 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.420656919 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.421927929 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.421981096 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.422012091 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.422015905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.422049999 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.422075033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.463982105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.464045048 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.464068890 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.464083910 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.464117050 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.464129925 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.467945099 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.467989922 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.468020916 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.468029976 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.468061924 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.468081951 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.539413929 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.539465904 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.539508104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.539531946 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.539541960 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.539572001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.541058064 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.541100025 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.541134119 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.541138887 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.541169882 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.541189909 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.583290100 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.583354950 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.583440065 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.583450079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.583498001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.583528996 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.586757898 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.586817980 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.586844921 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.586849928 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.586869955 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.586905003 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.627829075 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.627861977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.627996922 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.628010988 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.628179073 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.659609079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.659677982 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.659723997 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.659732103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.659778118 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.659805059 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.660089016 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.660139084 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.660168886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.660173893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.660202026 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.660231113 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.702018023 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.702169895 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.702172995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.702199936 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.702234983 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.705806017 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.705848932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.705889940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.705895901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.705938101 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.759397984 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.777165890 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.777249098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.777272940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.777277946 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.777311087 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.777338028 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.779113054 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.779160023 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.779191971 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.779211044 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.779227972 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.779261112 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.819552898 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.819624901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.819662094 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.819679976 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.819701910 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.819722891 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.824326038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.824378967 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.824414015 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.824418068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.824445963 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.824457884 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.825217009 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.825261116 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.825402021 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.825407982 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.825470924 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.896123886 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.896182060 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.896203995 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.896223068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.896236897 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.896264076 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.897768974 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.897818089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.897840977 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.897849083 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.897876024 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.897897959 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.938469887 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.938544989 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.938575029 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.938590050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.938672066 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.943480968 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.943535089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.943567038 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.943572044 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.943599939 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.943605900 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.944031000 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.944077969 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.944089890 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.944106102 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:41.944134951 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:41.944159985 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.015252113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.015335083 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.015378952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.015393019 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.015418053 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.015439034 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.016735077 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.016788006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.016812086 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.016817093 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.016843081 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.016861916 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.017440081 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.017488003 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.017504930 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.017508984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.017530918 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.017555952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.059135914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.059197903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.059272051 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.059283018 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.059325933 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.059338093 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.063000917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.063054085 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.063087940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.063092947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.063121080 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.063143969 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.134396076 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.134471893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.134531021 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.134548903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.134584904 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.134612083 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.135422945 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.135467052 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.135500908 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.135505915 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.135546923 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.135567904 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.135953903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.136008024 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.136029959 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.136034966 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.136066914 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.136092901 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.177977085 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.178042889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.178107977 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.178126097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.178162098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.178183079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.181359053 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.181413889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.181438923 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.181444883 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.181473017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.181490898 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.223063946 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.223144054 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.223218918 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.223248005 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.223261118 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.223292112 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.259212971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.259248972 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.259370089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.259390116 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.259483099 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.259516001 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.259680986 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.259687901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.259807110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.259879112 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.259912014 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.259958029 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.259964943 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.259989977 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.259996891 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.297164917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.297211885 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.297264099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.297288895 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.297322035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.297333002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.301073074 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.301122904 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.301167011 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.301182985 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.301204920 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.301219940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.378132105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.378192902 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.378304958 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.378328085 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.378353119 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.378369093 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.378396988 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.378439903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.378457069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.378477097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.378513098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.378525972 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.378928900 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.378972054 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.379000902 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.379005909 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.379033089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.379040003 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.379256010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.379298925 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.379323959 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.379345894 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.379367113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.383078098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.416065931 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.416104078 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.416152954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.416176081 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.416209936 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.416230917 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.419804096 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.419827938 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.419888020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.419904947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.419930935 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.419950008 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.460802078 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.460834980 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.460890055 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.460899115 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.460936069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.460957050 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.500142097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.500180006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.500235081 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.500252962 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.500276089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.500302076 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.500303030 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.500320911 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.500329018 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.500365019 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.500436068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.500456095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.500503063 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.500509977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.500533104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.500555038 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.534703970 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.534749985 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.534800053 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.534821033 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.534852982 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.534872055 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.538074017 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.538119078 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.538145065 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.538152933 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.538194895 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.539243937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.539287090 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.539321899 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.539330006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.539347887 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.539369106 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.616202116 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.616254091 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.616288900 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.616305113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.616324902 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.616341114 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.616439104 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.616482973 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.616497040 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.616512060 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.616539001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.616554976 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.616911888 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.616952896 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.616975069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.616978884 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.617002010 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.617018938 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.652424097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.652472019 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.652508974 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.652520895 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.652535915 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.652551889 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.653665066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.653707981 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.653729916 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.653736115 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.653764963 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.653781891 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.657742977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.657804012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.657815933 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.657830954 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.657861948 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.657876968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.698810101 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.698858023 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.698893070 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.698904991 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.698919058 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.699047089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.734987974 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.735033035 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.735105038 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.735116959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.735146046 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.735162020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.735830069 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.735872984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.735905886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.735912085 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.735934019 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.735953093 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.736062050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.736103058 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.736130953 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.736136913 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.736157894 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.736177921 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.771195889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.771243095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.771528006 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.771553993 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.771739006 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.775727987 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.775768995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.775809050 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.775818110 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.775847912 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.775861025 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.776427984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.776470900 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.776501894 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.776508093 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.776531935 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.776555061 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.818685055 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.818775892 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.818783045 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.818815947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.818943977 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.818943977 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.855520010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.855578899 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.855626106 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.855642080 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.855674982 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.855690002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.855746984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.855794907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.855815887 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.855823994 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.855849028 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.855864048 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.855967045 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.856015921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.856035948 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.856041908 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.856064081 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.856081963 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.856327057 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.856369972 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.856399059 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.856404066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.856431007 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.856442928 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.892718077 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.892792940 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.892901897 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.892925024 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.892959118 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.892980099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.895528078 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.895576000 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.895607948 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.895616055 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.895659924 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.895711899 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.896359921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.896401882 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.896435976 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.896441936 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.896475077 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.896492958 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.973187923 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.973234892 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.973305941 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.973330021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.973351955 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.973367929 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.973855019 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.973908901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.973932981 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.973943949 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.973963022 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.973979950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.974622011 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.974664927 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.974694014 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.974704981 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.974729061 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.974750996 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.974941015 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.974980116 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.975009918 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.975017071 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:42.975040913 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:42.975054026 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.010263920 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.010329008 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.011326075 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.011348963 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.014319897 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.014369011 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.014422894 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.014440060 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.014452934 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.014477015 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.014918089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.014957905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.014985085 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.014995098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.015026093 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.015247107 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.015399933 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.015443087 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.015474081 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.015480995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.015505075 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.015520096 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.092075109 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.092132092 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.092242002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.092266083 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.092284918 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.092299938 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.093094110 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.093136072 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.093178034 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.093183994 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.093205929 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.093220949 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.093612909 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.093653917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.093724012 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.093729973 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.093800068 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.094017029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.094059944 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.094177008 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.094182014 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.094221115 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.129453897 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.129503012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.129592896 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.129614115 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.129641056 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.129654884 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.133598089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.133660078 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.133702993 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.133709908 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.133749962 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.133996964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.134042978 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.134057045 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.134073019 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.134098053 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.134111881 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.134406090 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.134464979 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.134494066 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.134499073 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.134522915 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.134536982 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.211230993 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.211287975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.211311102 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.211330891 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.211360931 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.211523056 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.211558104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.211563110 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.211571932 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.211587906 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.211595058 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.211617947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.211637020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.211658001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.212264061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.212312937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.212335110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.212340117 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.212364912 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.212380886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.213026047 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.213072062 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.213085890 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.213095903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.213120937 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.213135958 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.260829926 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.260859966 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.260917902 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.260935068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.260951042 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.260972977 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.261087894 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.261116028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.261145115 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.261149883 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.261174917 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.261190891 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.261460066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.261482000 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.261542082 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.261547089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.261586905 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.261811972 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.261840105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.261874914 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.261878967 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.261903048 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.261917114 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.331243038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.331274986 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.331360102 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.331374884 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.331393003 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.331422091 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.331451893 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.332207918 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.332231045 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.332269907 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.332273960 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.332297087 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.332767010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.332796097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.332823038 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.332827091 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.332853079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.334142923 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.334163904 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.334206104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.334213972 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.334233046 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.379820108 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.379849911 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.379992962 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.380012989 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.380165100 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.380181074 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.380228043 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.380237103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.380574942 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.380594015 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.380659103 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.380673885 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.380678892 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.381062031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.381076097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.381125927 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.381134033 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.424789906 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.448497057 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.448508978 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.448529005 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.448537111 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.448580027 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.448596001 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.448637009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.448971987 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.448991060 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.449052095 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.449059010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.449095964 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.450009108 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.450026989 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.450078011 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.450093031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.450126886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.451369047 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.451389074 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.451445103 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.451462030 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.451512098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.454108000 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.454127073 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.454181910 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.454195976 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.454246044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.498579025 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.498601913 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.498675108 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.498689890 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.498728037 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.498910904 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.498924971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.498976946 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.498984098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.499030113 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.499413013 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.499429941 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.499469042 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.499475956 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.499500036 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.499516010 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.499933004 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.499953032 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.500003099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.500009060 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.500051022 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.500375986 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.500391006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.500447035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.500456095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.500502110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.570043087 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.570064068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.570328951 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.570364952 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.570411921 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.570420980 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.570441008 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.570491076 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.570497990 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.570537090 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.571439028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.571454048 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.571516991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.571528912 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.571566105 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.572462082 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.572479010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.572534084 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.572547913 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.572593927 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.574955940 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.574971914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.575042009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.575054884 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.575100899 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.619306087 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.619329929 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.619389057 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.619406939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.619438887 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.619456053 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.620008945 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.620023966 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.620085001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.620099068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.620136976 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.620512962 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.620528936 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.620585918 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.620608091 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.620649099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.621205091 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.621220112 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.621277094 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.621289015 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.621325016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.653255939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.653273106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.653420925 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.653445959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.653496981 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.687489986 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.687511921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.687619925 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.687628031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.687674046 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.687757015 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.687772036 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.687819004 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.687829971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.687871933 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.687905073 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.688081980 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.688097000 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.688158989 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.688164949 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.688235044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.689073086 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.689088106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.689145088 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.689152002 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.689193964 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.691732883 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.691762924 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.691814899 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.691824913 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.691839933 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.691854954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.736579895 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.736601114 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.736691952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.736715078 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.736761093 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.736960888 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.736982107 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.737042904 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.737050056 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.737092018 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.737270117 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.737282991 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.737339020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.737344980 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.737385988 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.737544060 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.737557888 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.737611055 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.737617970 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.737656116 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.738001108 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.738015890 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.738075018 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.738082886 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.738122940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.806263924 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.806286097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.806344986 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.806354046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.806365967 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.806389093 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.806682110 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.806694984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.806751966 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.806761026 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.806794882 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.806916952 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.806922913 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.806972980 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.806978941 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.807013988 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.808115959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.808135033 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.808171034 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.808177948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.808202028 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.808228016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.808320999 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.808335066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.808382034 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.808388948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.808424950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.842442036 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.842458963 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.842581034 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.842588902 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.842632055 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.855628014 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.855642080 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.855712891 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.855720997 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.855772018 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.856034994 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.856048107 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.856111050 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.856116056 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.856159925 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.856467962 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.856484890 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.856539011 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.856545925 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.856604099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.856787920 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.856802940 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.856858969 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.856864929 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.856904030 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.857175112 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.857189894 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.857245922 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.857253075 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.857294083 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.924717903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.924745083 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.924901962 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.924938917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.924990892 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.925772905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.925793886 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.925841093 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.925848961 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.925868034 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.925880909 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.926129103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.926145077 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.926219940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.926228046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.926279068 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.927138090 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.927159071 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.927231073 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.927237988 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.927284002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.928250074 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.928265095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.928314924 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.928323030 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.928349018 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.928369999 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.930954933 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.930969954 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.931015968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.931021929 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.931040049 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.931068897 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.975243092 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.975305080 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.975363016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.975388050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.975408077 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.975435972 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.975497961 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.975539923 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.975562096 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.975569963 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.975584984 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.975728035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.976186991 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.976236105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.976264954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.976272106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.976291895 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.976317883 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.976478100 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.976526022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.976557016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.976564884 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.976584911 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.976607084 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.976757050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.976795912 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.976824999 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.976833105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:43.976850033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:43.976878881 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.043893099 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.043942928 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.044156075 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.044156075 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.044189930 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.044409037 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.044555902 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.044600010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.044727087 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.044727087 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.044759035 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.044816017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.045543909 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.045581102 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.045610905 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.045619965 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.045634031 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.045661926 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.045859098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.045907021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.045949936 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.045958042 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.045981884 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.046000957 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.046118975 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.047203064 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.047267914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.047296047 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.047303915 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.047327042 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.047338009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.047835112 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.047878981 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.047909021 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.047916889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.047931910 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.047961950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.080656052 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.080709934 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.080811977 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.080846071 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.080864906 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.080893040 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.095343113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.095386982 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.095432997 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.095442057 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.095457077 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.095491886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.095616102 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.095662117 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.095698118 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.095705986 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.095733881 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.095742941 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.096019030 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.096062899 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.096091986 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.096101046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.096132040 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.096132040 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.096705914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.096744061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.096777916 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.096786022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.096808910 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.096820116 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.096911907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.096951962 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.096978903 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.096987009 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.097008944 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.097028017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403119087 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403187990 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403218031 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403244019 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403258085 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403285027 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403393984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403445959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403462887 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403470039 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403497934 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403522015 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403588057 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403640985 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403655052 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403660059 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403698921 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403716087 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403774977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403815031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403850079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403855085 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403886080 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403912067 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.403920889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403973103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.403985023 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404001951 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.404021025 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404062033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404086113 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404201031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.404242039 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.404275894 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404283047 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.404293060 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404318094 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404347897 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.404397011 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.404407978 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404419899 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.404444933 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404474020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404895067 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.404947996 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.404970884 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.404979944 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.405004978 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.405030012 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.405066013 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.405109882 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.405128002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.405133009 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.405174971 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.405625105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.405666113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.405699015 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.405709028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.405719042 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.405739069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.405818939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.405858994 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.405874968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.405879974 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.405905008 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.405917883 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.405965090 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.406013966 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.406028986 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.406038046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.406064034 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.406085968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.406512976 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.406553984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.406584024 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.406589985 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.406598091 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.406620979 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.406785011 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.406843901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.406846046 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.406882048 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.406919003 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.406933069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.412010908 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.412031889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.412075043 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.412087917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.412096024 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.412118912 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.412352085 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.412381887 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.412412882 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.412420988 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.412441015 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.412571907 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.412703991 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.412731886 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.412755966 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.412761927 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.412797928 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.412811041 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.413012028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.413042068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.413072109 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.413079977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.413103104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.413134098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.415208101 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.415227890 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.415294886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.415319920 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.415332079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.415374994 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.415535927 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.415559053 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.415631056 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.415637970 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.415887117 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.415913105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.415950060 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.415955067 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.415966034 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.415997028 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.416059971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416079998 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416106939 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.416111946 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416140079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.416162968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.416263103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416306973 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416320086 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.416327000 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416352987 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.416374922 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.416644096 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416665077 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416719913 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.416726112 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416851044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.416898966 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416919947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.416970968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.416975975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.417098045 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.417119980 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.417151928 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.417156935 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.417180061 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.417202950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.417488098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.417517900 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.417558908 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.417565107 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.417582035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.417606115 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.417913914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.417960882 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.417974949 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.417990923 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.418010950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.418040991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.418349028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.418391943 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.418430090 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.418436050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.418453932 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.418468952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.418726921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.418771982 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.418801069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.418806076 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.418828964 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.418842077 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.419023037 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.419059038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.419090033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.419095039 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.419116020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.419159889 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.419404984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.419456959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.419483900 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.419488907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.419514894 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.419529915 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.419821024 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.437464952 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.437511921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.437572956 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.437587976 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.437593937 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.437633991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.452430010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.452475071 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.452555895 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.452555895 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.452570915 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.452610016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.452857971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.452904940 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.452920914 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.452928066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.452950954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.452966928 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.453368902 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.453409910 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.453438044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.453444004 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.453466892 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.453488111 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.486234903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.486284018 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.486332893 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.486346006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.486386061 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.486398935 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.486731052 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.486778021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.486799955 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.486805916 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.486839056 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.486850023 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.487273932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.487334967 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.487354040 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.487359047 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.487387896 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.487411022 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.487668991 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.487709045 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.487730980 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.487735987 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.487762928 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.487947941 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.520543098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.520606041 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.520653009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.520675898 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.520689964 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.520807981 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.522578955 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.522620916 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.522658110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.522663116 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.522691965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.522710085 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.523200035 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.523240089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.523281097 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.523286104 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.523315907 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.523334980 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.523505926 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.523547888 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.523583889 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.523588896 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.523617983 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.523819923 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.524086952 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.524128914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.524167061 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.524172068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.524199009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.524216890 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.534173965 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.534230947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.534271002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.534276009 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.534310102 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.534337044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.556363106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.556407928 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.556428909 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.556440115 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.556461096 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.556482077 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.571333885 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.571362019 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.571448088 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.571477890 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.571698904 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.571892977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.571919918 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.571983099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.571989059 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.572129965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.572448969 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.572472095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.572525024 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.572530031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.572566986 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.572592020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.572850943 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.572870970 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.572902918 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.572906971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.572937965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.572977066 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.605849981 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.605879068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.605953932 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.605957985 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.606276989 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.606301069 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.606345892 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.606350899 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.606370926 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.606403112 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.606677055 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.606694937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.606750965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.606755972 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.607063055 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.639031887 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.639097929 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.639173031 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.639190912 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.639198065 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.639228106 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.641314983 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.641369104 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.641395092 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.641411066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.641421080 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.641465902 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.642005920 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.642050982 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.642071009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.642076015 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.642108917 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.642132998 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.642746925 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.642791986 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.642813921 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.642817974 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.642843008 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.642865896 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.643289089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.643363953 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.643363953 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.643393040 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.643419981 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.643445015 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.643934965 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.643985987 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.644006968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.644027948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.644059896 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.644079924 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.653222084 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.653269053 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.653302908 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.653316021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.653325081 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.655062914 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.675666094 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.675709009 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.675764084 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.675777912 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.675785065 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.676388025 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.690577984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.690629959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.690767050 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.690767050 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.690788984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.691025972 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.691067934 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.691073895 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.691092968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.691095114 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.691164970 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.691170931 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.691319942 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.691617012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.691672087 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.691852093 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.691858053 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.691920042 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.691978931 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.692022085 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.692049026 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.692053080 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.692080975 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.692092896 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.724267006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.724312067 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.724370003 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.724395037 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.724404097 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.724662066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.724709034 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.724731922 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.724737883 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.724766016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.725220919 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.725260019 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.725302935 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.725308895 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.725334883 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.725349903 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.759043932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.759114027 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.759180069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.759205103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.759212971 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.759246111 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.759299994 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.759303093 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.759355068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.759370089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.759412050 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.761277914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.761321068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.761358976 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.761363983 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.761370897 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.762010098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.762058973 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.762073040 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.762089968 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.762120962 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.762141943 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.762453079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.762495995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.762516022 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.762521029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.762552023 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.762574911 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.763127089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.763181925 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.763199091 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.763205051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.763232946 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.763240099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.763499975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.763550043 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.763566017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.763571978 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.763603926 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.795506954 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.795553923 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.795615911 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.795643091 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.795650005 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.795792103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.795839071 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.795849085 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.795861959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.795895100 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.795924902 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.810393095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.810441971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.810523987 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.810543060 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.810553074 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.810719967 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.810776949 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.810820103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.810841084 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.810847044 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.810873032 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.810898066 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.811558008 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.811633110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.811640024 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.811664104 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.811696053 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.811748028 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.843522072 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.843573093 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.843631983 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.843656063 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.843664885 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.843945026 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.843991041 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.844119072 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.844125986 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.844295025 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.844333887 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.844369888 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.844377041 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.844404936 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.844427109 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.844734907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.844778061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.844805956 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.844810963 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.844824076 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.844851971 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.845364094 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.845417023 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.845438957 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.845444918 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.845465899 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.847069025 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.877105951 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.877147913 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.877188921 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.877211094 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.877238035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.877253056 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.879386902 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.879434109 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.879470110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.879476070 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.879501104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.879518032 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.879935980 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.879987001 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.880022049 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.880026102 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.880050898 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.880079985 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.880393028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.880455017 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.880477905 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.880482912 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.880500078 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.880521059 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.880533934 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.880985022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.881036043 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.881067991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.881072044 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.881093025 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.881123066 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.881308079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.881350040 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.881376028 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.881381035 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.881408930 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.881431103 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.891583920 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.891638041 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.891693115 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.891697884 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.891726017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.891745090 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.912981033 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.913031101 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.913079023 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.913085938 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.913130999 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.913147926 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.928215981 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.928256989 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.928338051 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.928360939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.928381920 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.928416967 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.928679943 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.928719997 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.928755045 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.928761005 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.928786039 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.928806067 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.929094076 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.929137945 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.929169893 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.929174900 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.929199934 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.929219007 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.929656029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.929697037 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.929724932 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.929729939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.929754972 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.929789066 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.961920977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.961965084 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.962124109 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.962145090 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.962301970 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.962476015 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.962517977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.962538958 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.962543011 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.962564945 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.962589979 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.962948084 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.962990999 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.963016033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.963020086 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.963047028 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.963071108 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.963268995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.963309050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.963335991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.963352919 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.963386059 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.963403940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.995716095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.995760918 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.995790958 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.995805025 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.995829105 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.995848894 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.996359110 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.996401072 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.996423960 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.996428013 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.996454954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.996475935 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.998399019 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.998440981 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.998482943 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.998487949 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.998519897 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.998543024 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.998972893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.999012947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.999042988 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.999047995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.999067068 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.999270916 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.999331951 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.999341965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:44.999357939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:44.999399900 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.000430107 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.000472069 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.000507116 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.000510931 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.000541925 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.000560999 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.000763893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.000803947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.000833035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.000837088 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.000951052 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.012008905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.012054920 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.014142990 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.014149904 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.014187098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.015074968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.031949997 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.031991959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.032032967 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.032052040 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.032063961 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.032094002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.032308102 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.032356024 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.032383919 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.032390118 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.032408953 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.032433033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.047549009 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.047635078 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.047637939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.047661066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.047696114 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.047719002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.047898054 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.047938108 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.047961950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.047969103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.047996044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.048005104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.048484087 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.048527002 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.048563957 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.048569918 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.048589945 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.048609018 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.080610037 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.080641985 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.080782890 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.080806971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.081018925 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.081105947 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.081115007 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.081482887 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.081500053 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.081569910 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.081578016 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.081866026 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.081948996 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.081955910 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.082318068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.082334995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.082396030 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.082410097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.083076000 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.114630938 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.114655018 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.114746094 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.114756107 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.115075111 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.117266893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.117290020 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.117342949 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.117350101 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.117369890 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.117399931 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.117650986 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.117696047 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.117719889 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.117727995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.117750883 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.117788076 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.118088007 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.118105888 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.118170977 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.118176937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.118695974 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.118733883 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.118776083 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.118782997 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.118793964 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.119071960 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.119115114 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.119155884 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.119184017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.119191885 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.119199991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.119239092 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.119680882 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.119700909 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.119759083 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.119765043 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.120387077 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.129081011 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.129103899 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.129156113 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.129164934 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.129290104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.150651932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.150722027 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.150758982 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.150775909 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.150789022 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.151119947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.151137114 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.151144028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.151170969 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.151190042 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.151196957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.151233912 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.151263952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.166465044 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.166522980 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.166567087 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.166579008 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.166588068 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.166695118 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.166857004 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.166912079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.166929960 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.166937113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.166973114 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.167212009 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.167258978 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.167289019 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.167294025 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.167321920 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.167510033 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.167557001 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.167574883 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.167592049 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.167622089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.167642117 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.199753046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.199826002 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.199903011 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.199911118 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.199935913 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.199954033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.200016022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.200067997 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.200098038 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.200103998 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.200124025 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.200155020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.200484037 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.200536013 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.200567961 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.200573921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.200597048 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.200623989 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.200962067 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.201004028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.201035976 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.201041937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.201066971 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.201107025 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.233789921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.233859062 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.233908892 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.233916044 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.233926058 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.234030008 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.234081984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.234097004 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.234105110 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.234146118 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.234167099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.236782074 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.236831903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.236865044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.236871004 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.236884117 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.236908913 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.237180948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.237241030 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.237255096 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.237261057 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.237306118 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.237413883 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.237471104 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.237487078 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.237493038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.237550974 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.237895012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.237938881 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.237966061 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.237972021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.237993002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.238023043 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.238236904 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.238279104 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.238313913 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.238321066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.238348007 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.238373995 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.238605022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.238646030 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.238672972 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.238678932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.238693953 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.238718033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.266537905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.266637087 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.266669035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.266675949 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.266729116 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.269556046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.269607067 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.269638062 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.269644022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.269684076 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.269699097 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.270174026 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.270217896 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.270251989 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.270256996 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.270273924 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.270304918 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.285288095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.285346031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.285420895 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.285449028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.285478115 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.285494089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.285669088 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.285715103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.285743952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.285753965 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.285768986 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.285793066 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.286700010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.286747932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.286782980 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.286794901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.286812067 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.286839962 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.287009954 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.287053108 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.287080050 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.287086964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.287110090 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.287118912 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.318991899 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.319063902 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.319102049 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.319133997 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.319153070 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.319379091 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.319431067 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.319433928 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.319462061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.319650888 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.319650888 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.319744110 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.319785118 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.319905996 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.319905996 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.319936991 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.319993973 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.320044041 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.320087910 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.320116043 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.320122957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.320154905 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.320167065 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.323234081 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.323278904 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.323326111 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.323333025 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.323357105 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.323520899 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.352710962 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.352787971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.352921963 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.352950096 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.353508949 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.355761051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.355806112 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.355838060 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.355846882 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.355880022 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.355891943 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.355999947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.356044054 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.356074095 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.356080055 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.356107950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.356117964 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.356416941 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.356462955 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.356492996 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.356498957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.356527090 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.356539011 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.356923103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.356965065 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.356997967 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.357003927 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.357028008 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.357062101 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.357371092 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.357413054 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.357441902 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.357448101 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.357481956 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.357599020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.357769966 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.357826948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.357857943 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.357863903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.357892036 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.357903004 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.357990980 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.358035088 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.358071089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.358077049 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.358098984 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.358119965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.385184050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.385270119 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.385404110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.385432959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.385601044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.388458014 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.388513088 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.388547897 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.388556957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.388573885 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.388597965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.389111042 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.389153004 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.389187098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.389194012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.389220953 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.389230013 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.405252934 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.405328989 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.405486107 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.405503988 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.405534983 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.405571938 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.405584097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.405601025 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.405611038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.405646086 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.405662060 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.405855894 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.405901909 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.405932903 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.405946970 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.405965090 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.405992031 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.406269073 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.406318903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.406352043 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.406358957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.406375885 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.406537056 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.437338114 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.437381983 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.437411070 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.437419891 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.437468052 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.437468052 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.437789917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.437835932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.437871933 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.437880993 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.437901974 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.437935114 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.438530922 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.438596964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.438611984 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.438623905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.438668013 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.438698053 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.439287901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.439351082 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.439356089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.439373970 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.439412117 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.441961050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.442003012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.442044973 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.442051888 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.442065954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.442096949 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.471090078 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.471153975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.471174955 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.471189022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.471220016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.471230984 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.471909046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.471952915 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.471983910 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.471991062 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.472021103 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.472043991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.474782944 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.474826097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.474854946 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.474863052 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.474895000 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.474895000 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.475172043 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.475222111 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.475255013 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.475260973 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.475291014 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.475301981 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.475704908 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.475749016 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.475795031 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.475804090 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.475816965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.475884914 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.476283073 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.476325989 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.476353884 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.476367950 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.476378918 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.476571083 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.476764917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.476814985 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.476835966 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.476843119 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.476871014 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.476871014 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.477044106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.477097034 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.477113962 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.477121115 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.477165937 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.477174997 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.504236937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.504297972 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.504369020 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.504400015 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.504421949 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.504421949 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.504482031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.504486084 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.504513979 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.504560947 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.504585981 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.507870913 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.507915020 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.507957935 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.507968903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.507983923 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.508048058 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.508192062 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.508243084 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.508272886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.508279085 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.508306026 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.508316994 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.524230003 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.524272919 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.524339914 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.524363995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.524383068 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.524538994 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.524575949 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.524616957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.524641037 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.524647951 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.524671078 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.524687052 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.525007963 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.525052071 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.525082111 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.525089979 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.525110006 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.525126934 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.525366068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.525408030 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.525439024 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.525446892 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.525479078 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.525494099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.558959961 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.559005976 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.559073925 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.559107065 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.559125900 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.559184074 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.559230089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.559257030 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.559272051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.559290886 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.559324026 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.559731007 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.559771061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.559803009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.559811115 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.559843063 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.559851885 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.560045958 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.560090065 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.560122967 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.560128927 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.560148954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.560164928 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.560722113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.560762882 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.560791016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.560796976 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.560823917 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.560838938 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.561105013 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.561146021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.561175108 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.561188936 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.561202049 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.561233997 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.590558052 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.590631008 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.590678930 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.590708017 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.590724945 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.591078043 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.593295097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.593349934 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.593374968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.593386889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.593405008 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.593429089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.593647003 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.593693018 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.593712091 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.593719006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.593746901 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.593760967 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.594144106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.594187021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.594203949 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.594211102 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.594245911 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.594266891 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.594405890 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.594459057 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.594489098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.594495058 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.594520092 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.594528913 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.595000029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.595046043 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.595062971 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.595069885 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.595097065 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.595108986 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.595473051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.595521927 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.595545053 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.595551968 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.595572948 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.595593929 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.595809937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.595875025 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.596050024 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.596057892 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.596108913 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.623399019 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.623496056 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.623507977 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.623527050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.623553038 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.623569965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.623656034 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.623702049 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.623719931 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.623728991 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.623754025 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.623836040 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.626626968 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.626678944 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.626729012 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.626744032 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.626763105 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.626787901 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.626924038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.626964092 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.626995087 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.627001047 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.627028942 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.627041101 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644218922 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644268036 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644309998 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644326925 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644342899 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644359112 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644417048 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644460917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644488096 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644495010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644521952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644531965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644596100 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644638062 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644665956 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644671917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644692898 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644714117 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644746065 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644787073 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644809961 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644815922 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.644840002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.644850969 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.676533937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.676616907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.676668882 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.676701069 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.676718950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.676781893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.676831961 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.676848888 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.676883936 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.676903009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.676924944 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.677002907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.677062988 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.677083015 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.677090883 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.677119970 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.677143097 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.677352905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.677395105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.677423000 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.677428961 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.677448034 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.677468061 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.677711964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.677762032 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.677793026 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.677798033 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.677836895 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.677836895 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.679717064 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.679738045 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.679794073 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.679805040 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.679821014 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.679863930 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.709222078 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.709281921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.709315062 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.709348917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.709368944 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.709368944 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.709407091 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.709681034 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.709741116 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.709764004 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.709772110 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.709785938 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.709988117 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.712445974 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.712495089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.712529898 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.712538004 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.712552071 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.712599993 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.712898016 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.712943077 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.713099003 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.713105917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.713233948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.713282108 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.713305950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.713313103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.713326931 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.713341951 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.713352919 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.713892937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.713933945 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.713964939 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.713972092 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.714000940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.714010954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.714225054 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.714266062 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.714298010 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.714303970 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.714330912 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.714339018 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.714404106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.714456081 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.714483023 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.714488029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.714515924 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.714525938 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.714754105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.714797020 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.714828968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.714833975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.714857101 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.714873075 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.742373943 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.742419004 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.742590904 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.742603064 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.742651939 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.742965937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.743006945 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.743038893 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.743045092 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.743072033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.743079901 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.745469093 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.745513916 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.745541096 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.745548010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.745568991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.745584965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.745927095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.745968103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.745995045 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.746001005 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.746021986 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.746037006 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.761578083 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.761600018 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.761646032 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.761655092 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.761673927 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.761687994 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.761847019 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.761864901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.761913061 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.761919022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.761996984 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.762227058 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.762253046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.762295961 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.762301922 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.762470007 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.762928963 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.762950897 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.762988091 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.762994051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.763017893 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.763032913 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.763215065 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.763235092 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.763278008 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.763283014 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.763303041 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.763322115 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.795236111 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.795255899 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.795460939 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.795469999 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.795643091 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.795669079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.795707941 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.795712948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.795731068 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.795754910 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.796216965 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.796233892 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.796292067 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.796298027 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.796377897 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.796597958 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.796616077 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.796665907 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.796673059 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.796741962 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.798544884 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.798563957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.798608065 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.798614979 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.798635006 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.798738956 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.798933029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.798953056 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.798995972 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.799001932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.799021006 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.799038887 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.828229904 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.828250885 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.828322887 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.828331947 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.828372002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.828540087 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.828558922 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.828598976 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.828605890 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.828627110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.828644991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.831592083 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.831610918 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.831665993 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.831674099 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.831747055 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.832056999 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.832076073 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.832123041 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.832128048 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.832142115 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.832160950 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.832374096 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.832391977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.832432032 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.832438946 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.832463026 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.832474947 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.832634926 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.832653046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.832696915 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.832705021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.832787037 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.832948923 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.832967043 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.833000898 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.833007097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.833029985 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.833041906 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.833331108 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.833352089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.833385944 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.833393097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.833415031 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.833440065 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.833622932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.833642006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.833682060 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.833688974 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.833714962 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.833729982 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.861066103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.861090899 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.861166954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.861176968 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.861321926 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.861613989 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.861632109 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.861680031 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.861685038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.861824036 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.864192009 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.864212036 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.864259958 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.864265919 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.864356041 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.864814043 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.864830971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.864876032 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.864881992 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.865056992 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.882632971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.882669926 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.882801056 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.882832050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.882924080 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.882924080 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.882931948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.882950068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.882971048 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.883006096 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.883029938 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.883050919 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.883369923 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.883394957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.883435965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.883444071 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.883471966 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.883872986 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.883891106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.883939981 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.883948088 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.883961916 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.914216995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.914285898 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.914422035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.914422035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.914454937 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.914546967 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.914587975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.914618969 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.914628029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.914655924 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.914721012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.914767981 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.914778948 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.914805889 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.914835930 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.915635109 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.915673971 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.915697098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.915715933 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.915744066 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.915915966 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.915976048 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.915992975 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.916007042 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.916040897 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.917917013 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.917959929 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.918008089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.918018103 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.918040991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.946626902 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.946660042 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.946831942 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.946831942 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.946865082 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.947155952 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.947181940 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.947303057 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.947303057 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.947334051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.947583914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.947608948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.947642088 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.947652102 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.947669983 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.950550079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.950578928 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.950637102 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.950654984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.950671911 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.951266050 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.951291084 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.951370001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.951370001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.951402903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.951728106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.951747894 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.951786041 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.951795101 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.951811075 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.952028990 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.952052116 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.952080011 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.952085972 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.952101946 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.952513933 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.952532053 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.952564001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.952570915 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.952585936 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.952789068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.952812910 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.952845097 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.952852964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.952868938 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.953152895 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.953175068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.953202963 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.953210115 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.953227043 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.956403017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.979965925 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.979976892 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.980161905 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.980191946 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.983710051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.983778000 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.983794928 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.983825922 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.983864069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.983973026 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.984013081 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.984041929 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.984050989 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.984090090 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.985732079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.985794067 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.985804081 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.985826969 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.985862017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.986563921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.986603975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.986632109 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.986639977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.986670017 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.999577999 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.999610901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.999644995 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:45.999651909 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:45.999666929 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.000778913 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.000824928 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.000853062 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.000859022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.001060963 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.001112938 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.001158953 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.001183987 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.001199961 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.001221895 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.001450062 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.001488924 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.001526117 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.001533031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.001549959 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.001756907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.001801968 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.001821041 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.001838923 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.001864910 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.033370018 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.033427000 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.033468008 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.033502102 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.033528090 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.033648014 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.033714056 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.033715963 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.033747911 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.033778906 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.033912897 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.033952951 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.033982992 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.033991098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.034023046 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.034698009 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.034744978 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.034770966 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.034778118 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.034815073 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.035227060 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.035264969 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.035290956 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.035299063 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.035336018 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.036993027 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.037039995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.037066936 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.037074089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.037116051 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.066340923 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.066416979 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.066436052 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.066445112 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.066482067 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.066608906 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.066658020 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.066680908 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.066688061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.066731930 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.066766977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.066823006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.066848040 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.066857100 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.066890001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.069418907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.069447041 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.069487095 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.069493055 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.069506884 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.069916010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.069936037 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.069981098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.069987059 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.070002079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.070513010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.070539951 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.070578098 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.070585012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.070599079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.070908070 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.070928097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.070967913 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.070974112 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.071003914 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.071525097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.071548939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.071594000 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.071600914 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.071614027 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.071764946 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.071783066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.071821928 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.071829081 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.071860075 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.072644949 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.072669029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.072707891 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.072715998 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.072730064 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.072932005 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.072952032 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.072992086 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.072999001 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.073012114 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.102659941 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.102730036 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.102910995 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.102942944 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.102965117 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.103004932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.103039026 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.103046894 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.103075027 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.103178024 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.103225946 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.103245974 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.103252888 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.103307009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.104429007 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.104473114 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.104507923 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.104512930 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.104541063 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.104778051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.104825020 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.104846954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.104854107 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.104907036 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.118496895 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.118547916 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.118604898 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.118613005 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.118627071 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.119415998 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.119518995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.119549990 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.119565964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.119590998 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.119728088 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.119769096 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.119796991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.119802952 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.119828939 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.120259047 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.120305061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.120326996 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.120333910 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.120371103 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.120919943 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.120963097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.120987892 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.120995998 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.121018887 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.152143002 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.152204990 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.152272940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.152285099 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.152301073 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.152853966 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.152870893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.152921915 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.152929068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.152956009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.153140068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.153187037 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.153206110 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.153223038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.153259993 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.153811932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.153851986 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.153888941 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.153894901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.153922081 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.154104948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.154151917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.154175997 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.154181957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.154215097 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.156084061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.156124115 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.156158924 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.156164885 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.156191111 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.156272888 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.156318903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.156352043 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.156358004 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.156373978 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.185373068 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.185445070 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.185456991 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.185476065 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.185502052 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.185745955 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.185796976 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.185806990 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.185823917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.185858965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.188299894 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.188343048 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.188358068 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.188365936 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.188400030 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.188822031 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.188869953 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.188891888 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.188899040 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.188940048 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.189264059 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.189306974 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.189336061 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.189342976 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.189373970 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.190026999 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.190073013 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.190093994 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.190100908 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.190148115 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.190346956 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.190383911 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.190411091 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.190418005 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.190448046 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.190844059 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.190888882 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.190902948 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.190917969 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.190969944 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.191046953 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.191097975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.191128016 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.191133976 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.191147089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.195605993 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.195662022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.195703030 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.195719957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.195736885 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.195760012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.195800066 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.195821047 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.195835114 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.195877075 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.221281052 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.221314907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.221369982 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.221381903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.221405983 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.221745968 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.221764088 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.221800089 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.221807003 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.221836090 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.222104073 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.222129107 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.222158909 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.222165108 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.222182035 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.223592043 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.223613024 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.223685026 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.223692894 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.237292051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.237319946 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.237368107 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.237374067 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.237417936 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.237680912 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.237699032 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.237735033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.237739086 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.237757921 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.238271952 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.238298893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.238331079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.238334894 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.238373995 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.238751888 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.238770008 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.238802910 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.238806963 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.238826990 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.239089012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.239115000 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.239149094 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.239151955 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.239172935 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.239486933 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.239506006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.239541054 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.239546061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.239576101 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.269850969 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.269885063 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.269985914 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.270010948 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.270025015 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.273123026 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.273168087 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.273209095 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.273215055 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.273243904 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.273344994 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.273395061 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.273399115 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.273431063 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.273484945 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.273787022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.273828030 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.273866892 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.273873091 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.273895979 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.274064064 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.274110079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.274142981 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.274147987 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.274177074 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.274425030 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.274463892 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.274502039 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.274507046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.274533033 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.275193930 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.275242090 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.275280952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.275285959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.275310040 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.304025888 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.304089069 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.304151058 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.304172993 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.304205894 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.304280996 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.304307938 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.304337978 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.304344893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.304372072 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.304649115 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.304706097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.304708958 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.304738998 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.304763079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.307456970 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.307506084 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.307529926 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.307537079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.307558060 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.307913065 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.307952881 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.308062077 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.308063030 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.308085918 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.308414936 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.308459997 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.308481932 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.308491945 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.308535099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.308970928 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.309022903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.309061050 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.309066057 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.309077978 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.309293985 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.309340954 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.309355974 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.309374094 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.309411049 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.309777021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.309818029 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.309839010 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.309853077 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.309902906 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.310189009 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.310235977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.310256958 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.310262918 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.310303926 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.310777903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.310822964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.310847044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.310851097 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.310878992 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.311218023 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.311264038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.311288118 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.311306953 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.311337948 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.340629101 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.340668917 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.340718985 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.340727091 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.340744972 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.340955973 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.341001987 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.341012955 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.341027975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.341087103 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.341330051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.341367960 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.341398954 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.341403961 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.341434002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.342538118 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.342583895 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.342612028 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.342617035 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.342647076 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.342833996 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.342873096 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.342901945 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.342905998 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.342938900 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.356611967 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.356666088 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.356687069 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.356695890 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.356725931 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.356899023 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.356936932 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.356962919 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.356969118 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.356998920 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.357397079 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.357443094 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.357462883 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.357467890 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.357533932 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.357803106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.357850075 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.357899904 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.357904911 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.357932091 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.358037949 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.358098984 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.358118057 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.358124018 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.358165979 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.358756065 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.358795881 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.358824968 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.358829975 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.358850002 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.392093897 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392159939 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392184973 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.392206907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392225981 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.392350912 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392390966 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392411947 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.392450094 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392460108 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.392623901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392680883 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392693996 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.392704964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392738104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.392905951 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392945051 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.392975092 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.392982006 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.393007994 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.393256903 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.393304110 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.393323898 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.393335104 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.393382072 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.393584013 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.393623114 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.393649101 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.393656015 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.393699884 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.394258022 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.394310951 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.394335032 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.394340038 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.394366980 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.422614098 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.422665119 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.422694921 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.422700882 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.422746897 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.423177004 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.423218012 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.423247099 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.423252106 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.423274994 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.423506021 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.423552990 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.423572063 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.423577070 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.423605919 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.423626900 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.426561117 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.426604986 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.426649094 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.426654100 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.426668882 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.427141905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.427189112 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.427217960 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.427223921 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.427254915 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.427503109 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.427542925 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.427562952 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.427570105 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.427598000 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.427922964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.427978992 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.427998066 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.428004026 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.428046942 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.428452015 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.428493023 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.428520918 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.428528070 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.428554058 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.428709030 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.428756952 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.428782940 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.428793907 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.428828001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.429212093 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.429250956 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.429280996 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.429286957 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.429316044 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.429419041 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.429469109 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.429497957 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.429502964 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.429538965 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.430088997 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.430126905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.430150032 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.430156946 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.430188894 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.456193924 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.456264973 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.456291914 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.456298113 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.456348896 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.459944010 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.460011959 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.460027933 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.460035086 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.460066080 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.460176945 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.460228920 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.460241079 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.460258007 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.460289001 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.461491108 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.461530924 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.461558104 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.461563110 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.461596966 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.461788893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.461838007 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.461853027 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.461863041 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.461910009 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.462218046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.462236881 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.462280989 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.462285995 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.462311029 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.475666046 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.475713968 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.475756884 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.475763083 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.475800037 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.476044893 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.476085901 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.476115942 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.476123095 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.476166010 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.476758003 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.476804018 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.476829052 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.476836920 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.476870060 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.477001905 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.477060080 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.477101088 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.477106094 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.477118015 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.477303028 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.477348089 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.477364063 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.477370977 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.477410078 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.477472067 CEST	443	49778	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.477528095 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.477986097 CEST	49778	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.717416048 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.717454910 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:46.717792034 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.718081951 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:46.718092918 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.452058077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.453886986 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.453946114 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.588849068 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.588917971 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.588952065 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.589063883 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.589114904 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.589114904 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.589181900 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.589257956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.589628935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.589680910 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.589946985 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.589965105 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.634483099 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.708336115 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708403111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708435059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708462000 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.708472967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708524942 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708560944 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.708584070 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708623886 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.708638906 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708682060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708731890 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.708744049 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708838940 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708872080 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708882093 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.708898067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.708949089 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.708959103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.709840059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.709872961 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.709892988 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.709904909 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.710112095 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.710114956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.710130930 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.710182905 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.710194111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.747108936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.747231007 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.747261047 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.790707111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.823345900 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.823396921 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.823424101 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.823446989 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.823467016 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.823471069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.823508024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.823544025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.824105024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.824158907 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.824165106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.824173927 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.824214935 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.824229956 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.824285984 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.825076103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.825139046 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.825169086 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.825222015 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.825690985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.825817108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.825867891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.825879097 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.825939894 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.826780081 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.826813936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.826834917 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.826850891 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.826874971 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.826891899 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.827685118 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.827740908 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.827816010 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.827861071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.827878952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.827893972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.827918053 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.864582062 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.864653111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.864713907 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.864820957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.910741091 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.910902023 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.942478895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942559004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.942583084 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942626953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942672968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942697048 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942693949 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.942723989 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.942723989 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.942732096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942743063 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942759037 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.942775011 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.942786932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942835093 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942837954 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.942854881 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942879915 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.942892075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.942958117 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.942969084 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.943002939 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.943061113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.943070889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.943092108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.943141937 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.943151951 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.943171978 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.943192005 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.943203926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.943228960 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.943232059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.943265915 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.943278074 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.943320036 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.944088936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.944135904 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.944152117 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.944161892 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.944190025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.944205999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.944273949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.944317102 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.944911957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.944972038 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.945008993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.945038080 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.945045948 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.945060968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.945086956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.945106983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.945929050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.945981026 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.945993900 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.946036100 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.946080923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.946135998 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.946806908 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.946899891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.946944952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.946990013 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.982106924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.982275963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.982297897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.982337952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:47.982388020 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:47.982388020 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.028419971 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.028508902 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.059703112 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.059979916 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.060241938 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.060309887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.060410023 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.060410023 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.060430050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.061136007 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.061151981 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.061212063 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.061227083 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.062001944 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.062017918 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.062077045 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.062093019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.062520027 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.062534094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.062592030 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.062603951 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.067722082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.067735910 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.067804098 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.067817926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.068543911 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.068556070 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.068620920 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.068634033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.069068909 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.069086075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.069143057 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.069154978 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.070008993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.070024967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.070063114 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.070075035 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.070100069 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.071089983 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.071105957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.071137905 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.071151018 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.071173906 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.071475983 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.071499109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.071540117 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.071556091 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.071578979 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.072530031 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.072552919 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.072583914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.072596073 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.072623968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.073354006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.073365927 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.073431969 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.073443890 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.102412939 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.102426052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.102643013 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.102709055 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.145215034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.145231962 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.145361900 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.145361900 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.145430088 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.175476074 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.175491095 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.175534010 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.175590992 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.175616980 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.175640106 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.175932884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.175940990 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.175949097 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.175975084 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.176004887 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.176018000 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.176043034 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.176301956 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.176314116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.176368952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.176383018 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.176692963 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.176704884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.176760912 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.176774025 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.177050114 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.177062988 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.177100897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.177114964 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.177411079 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.177428007 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.177489042 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.177500963 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.177861929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.177872896 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.177908897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.177927017 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.177952051 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.178076029 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.178087950 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.178117037 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.178129911 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.178153038 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.178489923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.178500891 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.178550005 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.178561926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.178905964 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.178916931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.178947926 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.178960085 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.178983927 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.179375887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.179389000 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.179415941 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.179440975 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.179465055 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.179775000 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.179785967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.179805040 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.179816008 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.179842949 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.179922104 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.179996967 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.180094004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.180109024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.180135012 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.180146933 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.180175066 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.180536032 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.180552006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.180607080 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.180619001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.216208935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.216223001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.216368914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.216370106 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.216438055 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.259485006 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.262893915 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.262901068 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.262974977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.263008118 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.263026953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.263053894 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.263072014 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.292268991 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.292284966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.292416096 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.292479038 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.292534113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.292645931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.292659044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.292684078 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.292699099 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.292723894 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.292743921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.292938948 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.292953014 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.292996883 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.293009996 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.293049097 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.293381929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.293395042 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.293412924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.293425083 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.293448925 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.293467999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.293647051 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.293665886 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.293694019 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.293704033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.293731928 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.293751001 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.293962955 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.293977022 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.293998957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.294009924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.294034958 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.294053078 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.294338942 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.294353962 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.294372082 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.294383049 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.294406891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.294424057 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.294642925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.294656038 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.294682980 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.294693947 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.294719934 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.294738054 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.295108080 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.295130014 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.295150995 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.295161963 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.295186043 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.295202971 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.295377970 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.295392990 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.295422077 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.295433044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.295458078 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.295473099 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.295809031 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.295820951 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.295852900 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.295865059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.295893908 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.295907974 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.296094894 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.296108961 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.296134949 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.296145916 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.296169996 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.296186924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.296386003 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.296399117 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.296442986 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.296453953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.296493053 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.296747923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.296761990 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.296785116 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.296796083 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.296822071 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.296839952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.297089100 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.297101974 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.297131062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.297142029 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.297168016 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.297183990 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.333434105 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.333446026 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.333645105 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.333709002 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.333743095 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.333759069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.333765984 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.333781958 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.333807945 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.333827972 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.333847046 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.409542084 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.409554005 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.409703970 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.409766912 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.409809113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.409826040 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.409838915 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.409859896 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.409888983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.409888983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.409914970 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.410140038 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.410152912 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.410228968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.410243034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.410301924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.410391092 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.410423994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.410454988 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.410465956 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.410495043 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.410516977 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.410845995 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.410857916 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.410923004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.410934925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.410990000 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.411231041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.411242008 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.411305904 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.411318064 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.411370039 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.411545038 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.411557913 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.411648989 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.411660910 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.411717892 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.411788940 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.411803007 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.411864996 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.411876917 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.411931038 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.412199974 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.412213087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.412276030 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.412286997 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.412327051 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.412597895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.412635088 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.412687063 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.412697077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.412749052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.413206100 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.413218021 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.413276911 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.413288116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.413347006 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.413458109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.413470030 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.413530111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.413541079 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.413587093 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.414124966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414136887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414196968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.414207935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414257050 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.414360046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414371967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414433956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.414444923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414501905 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.414761066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414783001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414820910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.414830923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414870024 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.414972067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414988041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.414992094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.415004015 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.415031910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.415051937 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.450783968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.450798035 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.450841904 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.450855017 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.450882912 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.450901031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.451142073 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.451153994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.451318026 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.451380014 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.451453924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.526793957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.526813030 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.526864052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.526926041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.526967049 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.526989937 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.527024031 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.527036905 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.527077913 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.527092934 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.527133942 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.527415037 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.527430058 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.527472973 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.527484894 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.527512074 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.527530909 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.527709007 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.527724981 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.527751923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.527764082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.527785063 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.527808905 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.527986050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.527998924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.528028965 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.528038979 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.528069019 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.528069973 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.528213978 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.528228045 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.528263092 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.528274059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.528297901 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.528314114 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.528640985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.528656006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.528721094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.528733015 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.528776884 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.529086113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.529098988 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.529145956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.529156923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.529181004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.529196978 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.529984951 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.529999971 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530033112 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.530042887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530067921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.530085087 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.530236006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530247927 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530303001 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.530314922 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530354023 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.530693054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530705929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530752897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.530764103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530810118 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.530841112 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530853033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530880928 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.530891895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.530919075 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.530946016 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.531375885 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.531389952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.531433105 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.531444073 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.531476021 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.531495094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.531629086 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.531644106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.531691074 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.531702042 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.531725883 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.531745911 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.531886101 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.531898975 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.531959057 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.531969070 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.532026052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.532258987 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.532272100 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.532315016 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.532325983 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.532366037 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.532979012 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.532993078 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.533045053 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.533056021 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.533096075 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.568286896 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.568301916 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.568382978 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.568404913 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.568448067 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.615364075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.615380049 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.615520954 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.615583897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.615642071 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.644957066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.644973993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645072937 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.645133972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645179033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645196915 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645209074 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.645230055 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645256996 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.645256996 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.645284891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.645410061 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645423889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645493031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.645505905 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645565033 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.645760059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645776033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645839930 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.645850897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645903111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.645962954 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.645977020 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646038055 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.646049976 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646100044 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.646213055 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646225929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646291018 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.646301985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646358967 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.646404982 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646442890 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646472931 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.646488905 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646512985 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.646529913 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.646830082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646843910 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646908998 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.646919966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.646976948 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.647557974 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.647572994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.647633076 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.647644043 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.647692919 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.647728920 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.647747040 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.647779942 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.647790909 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.647816896 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.647835970 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.648345947 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.648359060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.648416996 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.648428917 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.648489952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.648679972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.648704052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.648732901 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.648744106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.648766994 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.648787022 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.648951054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.648963928 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649024010 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.649034977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649090052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.649439096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649461985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649493933 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.649502993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649527073 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.649545908 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.649612904 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649637938 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649657965 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.649668932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649714947 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.649714947 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.649866104 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649878025 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649930000 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.649940968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.649996042 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.650181055 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.650193930 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.650255919 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.650266886 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.650291920 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.650307894 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.685619116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.685633898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.685781002 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.685846090 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.685894966 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.685902119 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.685911894 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.685942888 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.685962915 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.685993910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.686006069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.686037064 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.686057091 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.732887030 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.732903957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.733012915 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.733076096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.733136892 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.968857050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.968877077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969026089 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.969094038 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969134092 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969182014 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.969383955 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969397068 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969468117 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.969485998 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969813108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969830990 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969865084 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.969876051 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969896078 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969911098 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.969928980 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.969950914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.969963074 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.970441103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.970458031 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.970500946 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.970514059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.970531940 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.970537901 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.970551968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.970578909 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.970582962 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.970593929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.970623970 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.970642090 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.970674038 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.970684052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.970707893 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.970724106 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.971198082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.971210957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.971276045 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.971287012 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.971326113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.971328020 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.971338034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.971383095 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.971425056 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.971426010 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.971438885 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.971445084 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.971447945 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.971482992 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.971507072 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.971523046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.971545935 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.971721888 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.972146988 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.972160101 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.972218990 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.972229958 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.972280025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.972281933 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.972291946 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.972337961 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.972357035 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.972372055 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.972402096 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.972408056 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.972419024 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.972420931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.972429037 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.972445965 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.972493887 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.973068953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973110914 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973140955 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973143101 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.973154068 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973170996 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.973184109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973218918 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.973228931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973256111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.973287106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973299026 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973325968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.973340034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973362923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.973423004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973433971 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.973478079 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.973490000 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.974332094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.974349976 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.974406958 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.974406958 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.974421024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.974452019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.974478960 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.974495888 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.974520922 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.974536896 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.975130081 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975146055 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975205898 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.975222111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975270987 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975279093 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.975287914 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975306034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975377083 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.975378036 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.975415945 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975429058 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975477934 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.975477934 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975492001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975538969 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975557089 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.975572109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.975599051 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.975614071 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.976069927 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976083994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976126909 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.976141930 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976191998 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.976207018 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976221085 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976270914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.976281881 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976329088 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.976361036 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976376057 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976412058 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.976424932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976444960 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976449013 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.976469994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976473093 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.976483107 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976496935 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.976521969 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.976953983 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.976965904 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977021933 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.977066994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977091074 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977144003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.977144003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.977171898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977247953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977267981 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977282047 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.977299929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977349043 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.977349043 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.977349043 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.977654934 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977669001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977718115 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.977726936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977766037 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.977894068 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977910042 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.977962017 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.977968931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978004932 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.978013992 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978030920 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978061914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.978069067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978101969 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.978192091 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978209019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978245974 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.978254080 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978269100 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.978290081 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.978737116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978750944 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978790998 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978800058 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.978809118 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978841066 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.978873014 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.978884935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978898048 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.978945017 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.978951931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979033947 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979052067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979089022 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.979096889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979111910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.979613066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979626894 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979676008 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.979682922 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979779005 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979796886 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979830027 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.979835987 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979851961 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.979898930 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979912043 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.979959011 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.979968071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.996118069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.996134996 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.996191978 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.996201992 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.996216059 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.997653008 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.997664928 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.997726917 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.997729063 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.997740984 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.997766972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.997781992 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.997790098 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.997807026 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.997828007 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.998061895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.998081923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.998136044 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.998142958 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.998183012 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.998770952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.998785973 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.998840094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.998847961 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.998888016 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.998971939 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.998986959 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.999037981 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.999046087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.999085903 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.999262094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.999275923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.999325991 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.999326944 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.999340057 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.999356031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.999363899 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.999377966 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.999383926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:48.999411106 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:48.999430895 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.000936985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.000950098 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.001004934 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.001013041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.001053095 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.001208067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.001223087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.001271963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.001280069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.001318932 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.001806974 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.001820087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.001871109 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.001878977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.001919031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.002171040 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.002186060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.002238989 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.002245903 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.002285957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.002379894 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.002397060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.002434969 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.002443075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.002460003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.002480030 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.003211975 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.003226995 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.003274918 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.003283978 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.003297091 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.003315926 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.003520966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.003535032 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.003586054 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.003593922 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.003607988 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.003619909 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.003832102 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.003846884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.003895998 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.003904104 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.003946066 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.004288912 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.004303932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.004349947 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.004357100 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.004374027 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.004395008 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.004673004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.004688025 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.004740953 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.004748106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.004786015 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.005062103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.005081892 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.005126953 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.005132914 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.005148888 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.005171061 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.005532980 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.005549908 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.005604029 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.005610943 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.005650997 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.037744045 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.037763119 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.037874937 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.037910938 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.037957907 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.038153887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.038171053 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.038225889 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.038233995 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.038270950 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.084803104 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.084816933 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.084923029 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.084955931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.085005999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.114763021 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.114779949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115035057 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.115046024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115098953 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.115117073 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115138054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115191936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.115200996 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115245104 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.115417004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115436077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115478992 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.115484953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115502119 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115505934 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.115519047 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.115525961 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115540981 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115556002 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.115581989 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.115828037 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115847111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115901947 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.115910053 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.115953922 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.116099119 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.116118908 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.116168976 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.116175890 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.116215944 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.116476059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.116508007 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.116558075 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.116564989 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.116621971 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.117194891 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.117214918 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.117268085 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.117275953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.117316961 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.117644072 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.117660046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.117712975 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.117721081 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.117764950 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.118688107 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.118705988 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.118771076 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.118778944 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.118825912 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.119160891 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.119179010 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.119230032 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.119237900 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.119277954 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.119647026 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.119664907 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.119705915 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.119713068 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.119728088 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.119750023 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.119946957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.119963884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.120012045 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.120018959 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.120059967 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.120467901 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.120485067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.120528936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.120534897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.120549917 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.120568037 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.120878935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.120894909 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.120951891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.120959044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.120996952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.121234894 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.121249914 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.121300936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.121308088 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.121346951 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.121823072 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.121840954 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.121891975 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.121897936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.121937037 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.122057915 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.122073889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.122127056 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.122133017 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.122174025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.122205973 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.122222900 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.122266054 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.122272968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.122289896 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.122307062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.122510910 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.122528076 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.122577906 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.122585058 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.122626066 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.154961109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.154974937 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.155045033 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.155056000 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.155102968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.155143976 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.155158043 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.155210018 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.155217886 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.155252934 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.198710918 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.198740959 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.198801994 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.198816061 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.198976040 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.202398062 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.202413082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.202483892 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.202491045 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.202568054 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.232094049 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.232108116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.232186079 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.232211113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.232356071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.232378006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.232413054 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.232423067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.232440948 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.232462883 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.232695103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.232707024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.232772112 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.232779026 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.232961893 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.232980013 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233007908 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.233017921 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233031034 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.233053923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.233215094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233230114 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233277082 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.233284950 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233514071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233530998 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233562946 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.233572006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233596087 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.233618021 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.233757019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233769894 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233818054 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.233824968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233936071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233956099 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.233983994 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.233992100 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.234014034 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.234038115 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.234669924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.234683037 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.234728098 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.234735012 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.234747887 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.235058069 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.236068964 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.236083031 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.236131907 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.236140013 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.236335039 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.236351013 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.236378908 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.236387014 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.236397982 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.236423969 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.236691952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.236706972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.236756086 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.236763954 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.237334013 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.237350941 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.237387896 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.237395048 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.237407923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.237432003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.237518072 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.237534046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.237571955 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.237580061 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.237591982 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.238075018 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.238092899 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.238121986 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.238130093 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.238142967 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.238166094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.238456011 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.238468885 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.238507032 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.238513947 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.238528013 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.238912106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.238934994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.238965988 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.238976955 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.238990068 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.239012957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.239257097 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.239270926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.239309072 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.239315033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.239342928 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.239644051 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.239660025 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.239696980 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.239706993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.239717960 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.239876032 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.239890099 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.239945889 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.239953995 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.240292072 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.240308046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.240344048 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.240351915 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.240366936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.240386963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.272260904 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.272279024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.272356033 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.272367001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.272536993 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.272581100 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.272605896 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.272651911 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.272660017 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.272676945 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.272701979 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.316018105 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.316044092 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.316184044 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.316216946 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.316273928 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.348138094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.348153114 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.348220110 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.348231077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.348373890 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.349455118 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.349468946 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.349522114 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.349529982 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.349592924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350087881 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350162983 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350176096 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350194931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350219965 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350234985 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350300074 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350320101 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350342035 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350348949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350372076 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350389957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350402117 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350425005 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350459099 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350466013 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350482941 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350502968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350672960 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350697041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350742102 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350750923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.350763083 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.350796938 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.351021051 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.351042986 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.351082087 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.351089001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.351109982 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.351128101 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.351212978 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.351236105 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.351269007 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.351279020 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.351296902 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.351317883 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.351878881 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.351901054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.351953983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.351962090 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.352025986 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.352283955 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.352305889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.352333069 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.352339029 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.352360010 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.352375984 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.353183985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.353209972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.353251934 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.353260040 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.353275061 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.353296995 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.353547096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.353570938 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.353609085 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.353615046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.353630066 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.353647947 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.353813887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.353835106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.353873014 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.353879929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.353895903 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.353918076 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.354105949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.354130983 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.354186058 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.354192972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.354211092 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.354229927 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.354629993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.354655981 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.354681969 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.354688883 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.354708910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.354726076 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.354938030 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.354958057 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.355000019 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.355007887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.355032921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.355045080 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.355340004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.355362892 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.355396032 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.355402946 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.355421066 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.355443001 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.356034994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.356071949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.356101036 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.356108904 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.356127024 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.356146097 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357083082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357105017 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357139111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357146025 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357163906 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357183933 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357222080 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357243061 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357270956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357278109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357297897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357317924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357434988 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357459068 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357486963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357492924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357512951 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357521057 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357758999 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357779980 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357808113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357815027 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357834101 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357850075 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357894897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357916117 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.357954979 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.357961893 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.363094091 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.389744043 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.389784098 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.389970064 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.389970064 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.390006065 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.390026093 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.390053034 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.390059948 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.390079021 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.390081882 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.390124083 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.390325069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.390350103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.390388966 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.390398026 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.390419006 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.390441895 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.436778069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.436808109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.436917067 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.436939001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.436995029 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.465841055 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.465879917 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.465912104 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.465920925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.465934992 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.465955973 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.467051983 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.467072964 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.467135906 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.467143059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.467168093 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.467185020 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.467382908 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.467408895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.467434883 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.467442989 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.467468023 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.467487097 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.468427896 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.468455076 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.468497038 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.468504906 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.468519926 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.468538046 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.468658924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.468682051 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.468707085 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.468713045 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.468733072 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.468751907 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.468935966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.468959093 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.468992949 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.469000101 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.469021082 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.469036102 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.469192028 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.469218969 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.469240904 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.469273090 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.469280005 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.469343901 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.469671965 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.469692945 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.469723940 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.469729900 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.469752073 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.469773054 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.469933033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.469954014 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.469980955 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.469988108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.470004082 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.470016003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.470601082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.470626116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.470659971 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.470668077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.470684052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.470702887 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.470850945 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.470875025 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.470906019 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.470912933 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.470932961 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.470956087 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471190929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471210957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471236944 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471242905 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471265078 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471281052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471400023 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471425056 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471457005 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471463919 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471492052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471501112 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471656084 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471678019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471724987 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471741915 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471802950 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471884012 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471911907 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471939087 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471946955 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.471963882 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.471991062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.472889900 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.472909927 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.472939968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.472948074 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.472968102 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.472985983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.473114967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.473140955 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.473175049 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.473181009 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.473208904 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.473217964 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.473229885 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.473256111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.473278999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.473287106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.473301888 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.473325968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.473932981 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.473957062 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.473982096 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.473988056 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474009037 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474029064 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474180937 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474201918 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474239111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474245071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474270105 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474291086 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474450111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474477053 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474509001 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474515915 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474536896 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474555016 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474602938 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474626064 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474652052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474658966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474672079 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474692106 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474772930 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474792957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474822044 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474828959 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.474847078 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.474864960 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.475353956 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.475382090 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.475413084 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.475420952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.475436926 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.475456953 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.507273912 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.507306099 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.507338047 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.507369041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.507385015 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.507411003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.507556915 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.507581949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.507622004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.507632017 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.507648945 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.507673025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.553939104 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.553980112 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.554081917 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.554081917 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.554115057 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.554178953 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.583411932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.583442926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.583540916 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.583540916 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.583574057 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.583688974 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.584295034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.584321022 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.584347010 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.584357977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.584374905 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.584395885 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.584525108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.584552050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.584587097 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.584594011 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.584615946 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.584633112 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.584727049 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.584748983 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.584784031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.584790945 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.584815025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.584822893 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.585858107 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.585879087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.585922956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.585930109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.585942030 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.585971117 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.586380005 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.586404085 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.586443901 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.586451054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.586468935 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.586483955 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.586719036 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.586741924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.586790085 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.586798906 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.586870909 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.586888075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.586911917 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.586934090 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.586941004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.586961985 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.586977959 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.587212086 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.587234020 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.587269068 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.587275982 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.587290049 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.587308884 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.587387085 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.587414026 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.587492943 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.587492943 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.587502003 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.587539911 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.588146925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.588170052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.588202953 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.588210106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.588263988 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.588392019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.588414907 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.588447094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.588453054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.588476896 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.588495016 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.588648081 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.588673115 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.588701963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.588710070 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.588730097 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.588746071 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589010000 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589034081 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589062929 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589068890 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589085102 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589102983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589178085 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589204073 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589231968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589238882 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589260101 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589279890 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589514971 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589534998 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589565992 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589571953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589586973 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589601040 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589606047 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589617968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589643002 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589649916 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589668036 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589673042 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.589693069 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.589718103 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.590361118 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.590387106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.590425968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.590431929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.590449095 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.590473890 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.590504885 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.590524912 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.590560913 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.590568066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.590584993 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.590605021 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.590802908 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.590823889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.590857983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.590863943 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.590881109 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.590907097 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.591443062 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.591464996 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.591491938 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.591500044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.591516972 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.591537952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.591630936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.591655970 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.591681957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.591689110 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.591711998 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.591722012 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.592559099 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.592581034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.592609882 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.592622042 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.592636108 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.592650890 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.592796087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.592822075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.592864990 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.592871904 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.592885017 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.592919111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.593518972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.593539953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.593590021 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.593596935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.593616962 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.593635082 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.624294043 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.624325991 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.624430895 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.624432087 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.624469995 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.624519110 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.624694109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.624722004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.624753952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.624763012 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.624783039 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.624805927 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.624882936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.624910116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.624957085 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.624964952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.624983072 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.625004053 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.671284914 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.671334028 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.671361923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.671369076 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.671391010 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.671411037 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.700618029 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.700656891 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.700712919 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.700747967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.700762987 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.700930119 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.701530933 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.701554060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.701597929 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.701605082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.701622009 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.701637030 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.702106953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.702131033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.702177048 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.702184916 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.702202082 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.702225924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.702374935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.702403069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.702434063 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.702440977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.702461004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.702478886 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.702972889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.702994108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703027964 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703033924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703049898 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703071117 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703381062 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703402996 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703443050 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703449965 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703463078 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703489065 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703610897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703632116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703670979 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703677893 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703696012 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703715086 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703846931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703867912 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703907013 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703912973 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.703927994 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.703939915 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.704169035 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.704190016 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.704231024 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.704237938 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.704252958 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.704401970 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.704519987 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.704545021 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.704577923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.704585075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.704603910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.704622984 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.705209017 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.705229998 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.705286980 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.705293894 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.705306053 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.705333948 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.705507994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.705528021 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.705559015 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.705565929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.705585957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.705600977 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.705835104 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.705862999 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.705904007 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.705909967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.705924988 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.705941916 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.706217051 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.706245899 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.706289053 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.706296921 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.706307888 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.706351995 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.706460953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.706484079 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.706512928 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.706518888 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.706537008 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.706556082 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.706644058 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.706669092 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.706698895 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.706706047 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.706726074 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.706744909 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707041025 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707062006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707097054 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707103968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707119942 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707139969 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707289934 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707321882 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707354069 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707361937 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707380056 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707405090 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707590103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707612038 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707653046 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707660913 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707678080 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707700014 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707899094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707920074 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707954884 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707962036 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.707982063 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.707997084 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.708142042 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.708163977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.708195925 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.708203077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.708218098 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.708244085 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.708694935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.708717108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.708746910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.708754063 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.708772898 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.708791018 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.708972931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.708992958 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.709028959 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.709037066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.709049940 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.709068060 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.709743977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.709764004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.709803104 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.709810019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.709824085 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.709847927 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.709964991 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.709990978 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.710042000 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.710048914 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.710112095 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.710416079 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.710438967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.710485935 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.710494041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.710587978 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.741609097 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.741645098 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.741700888 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.741714001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.741739035 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.741755009 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.742219925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.742249966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.742404938 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.742412090 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.742433071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.742449045 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.742455959 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.742485046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.742507935 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.742512941 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.742532015 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.742549896 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.788917065 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.788944960 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.789061069 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.789094925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.789288998 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.817760944 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.817790031 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.817831039 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.817847013 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.817859888 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.817888021 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.818671942 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.818702936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.818813086 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.818813086 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.818845034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.818902969 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.819231987 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.819256067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.819297075 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.819305897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.819324970 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.819356918 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.819508076 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.819530010 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.819571972 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.819577932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.819591045 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.819612980 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.819818974 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.819847107 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.819883108 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.819892883 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.819911957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.819938898 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.820766926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.820796967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.820839882 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.820847034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.820864916 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.820884943 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.821204901 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.821225882 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.821275949 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.821284056 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.821296930 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.821311951 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.821646929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.821674109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.821717024 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.821722984 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.821743965 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.821763039 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.821913004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.821940899 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.821968079 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.821974039 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.821995974 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.822009087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.822011948 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.822026014 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.822052002 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.822057962 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.822077990 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.822083950 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.822103977 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.822129965 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.822333097 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.822354078 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.822385073 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.822391033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.822412968 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.822436094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.822746992 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.822771072 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.822962999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.822971106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823004007 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823023081 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823029041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823045015 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823048115 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823091030 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823371887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823399067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823438883 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823446035 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823457003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823501110 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823508024 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823517084 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823539972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823540926 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823566914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823574066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823592901 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823616982 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823906898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823939085 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823967934 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.823976994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.823997974 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824012995 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824064970 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824084997 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824125051 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824131966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824153900 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824168921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824275017 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824296951 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824332952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824341059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824361086 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824377060 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824559927 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824583054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824609995 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824616909 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824630976 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824660063 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824858904 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824881077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824919939 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.824925900 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.824947119 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.825030088 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.825130939 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.825151920 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.825191975 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.825198889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.825216055 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.825233936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.825520039 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.825544119 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.825583935 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.825597048 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.825609922 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.825634956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.825932980 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.825958967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.826009989 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.826016903 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.826081991 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.826167107 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.826195955 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.826226950 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.826234102 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.826250076 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.826268911 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.826729059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.826751947 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.826776028 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.826785088 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.826806068 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.826819897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.827136040 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.827157021 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.827197075 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.827203035 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.827215910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.827228069 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.827598095 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.827622890 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.827662945 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.827670097 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.827682018 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.827701092 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.828877926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.828900099 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.828933954 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.828942060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.828959942 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.828977108 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.859469891 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.859499931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.859568119 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.859576941 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.859607935 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.859631062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.859675884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.859699011 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.859739065 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.859755993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.859767914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.859795094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.859893084 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.859919071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.859960079 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.859967947 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.859986067 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.860006094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.905915022 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.905939102 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.906056881 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.906089067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.906169891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.935636997 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.935673952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.935847044 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.935856104 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.935899973 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.936093092 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.936131001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.936184883 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.936191082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.936263084 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.936743975 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.936773062 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.936813116 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.936820030 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.936836004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.936857939 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.936949968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.936976910 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.937005997 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.937012911 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.937033892 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.937053919 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.937392950 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.937414885 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.937448025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.937455893 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.937477112 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.937494993 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.938141108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.938163996 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.938205004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.938211918 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.938235044 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.938250065 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.939711094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.939758062 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.939784050 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.939790964 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.939811945 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.939826965 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.939905882 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.939929008 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.939971924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.939977884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.939999104 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940016985 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940151930 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940174103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940217018 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940223932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940247059 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940269947 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940373898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940398932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940439939 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940448046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940465927 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940485954 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940633059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940660000 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940712929 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940721035 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940790892 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940882921 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940913916 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.940969944 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.940978050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.941099882 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.941252947 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.941273928 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.941312075 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.941318989 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.941339970 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.941351891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.941528082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.941549063 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.941581964 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.941587925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.941610098 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.941629887 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.941782951 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.941812038 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.941858053 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.941865921 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.941931963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942187071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942212105 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942245960 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942251921 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942272902 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942290068 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942296028 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942312002 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942337036 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942343950 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942359924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942365885 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942388058 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942415953 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942419052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942434072 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942451954 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942475080 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942482948 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942495108 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942517996 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942708969 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942744017 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942770958 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942778111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.942800045 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.942817926 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943017960 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943041086 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943068027 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943074942 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943089008 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943097115 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943114996 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943114996 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943134069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943145990 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943176031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943419933 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943444967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943491936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943500042 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943517923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943541050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943573952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943582058 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943603039 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943623066 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943766117 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943785906 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943833113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943839073 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.943850994 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.943881035 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.944111109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.944137096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.944183111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.944190025 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.944269896 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.944415092 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.944441080 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.944479942 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.944488049 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.944504976 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.944525003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.944783926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.944816113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.944842100 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.944849014 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.944869995 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.944890022 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.945137024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.945164919 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.945221901 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.945229053 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.945322990 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.946268082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.946290016 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.946324110 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.946335077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.946352959 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.946463108 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.976398945 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.976468086 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.976500988 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.976522923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.976545095 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.976564884 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.976954937 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.976999044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.977029085 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.977035046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.977056980 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.977092028 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.977292061 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.977334976 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.977365017 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.977370024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:49.977390051 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:49.977401018 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.023411036 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.023439884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.023493052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.023503065 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.023525000 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.023542881 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.053674936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.053695917 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.053750992 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.053757906 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.053786039 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.053797007 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.054037094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.054064989 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.054097891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.054102898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.054131031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.054141998 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.054357052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.054383993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.054416895 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.054423094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.054457903 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.054482937 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.055066109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.055088043 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.055121899 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.055126905 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.055145025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.055160046 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.055289984 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.055318117 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.055346966 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.055355072 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.055371046 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.055385113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.055509090 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.055536032 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.055583954 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.055589914 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.056332111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.057080030 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.057115078 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.057161093 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.057167053 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.057202101 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.057384014 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.057393074 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.057420969 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.057456970 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.057461977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.057482958 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.057501078 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.057867050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.057889938 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.057945967 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.057950974 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058032036 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058057070 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058085918 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058092117 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058106899 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058131933 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058526039 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058552980 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058581114 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058584929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058614016 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058620930 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058649063 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058672905 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058691978 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058696985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058712959 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058733940 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058746099 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058769941 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058795929 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058801889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.058821917 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.058840036 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059032917 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059056044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059102058 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059108019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059113979 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059134960 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059139013 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059151888 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059182882 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059185028 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059196949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059228897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059542894 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059567928 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059645891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059653044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059684992 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059750080 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059771061 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059802055 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059808016 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.059825897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059845924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.059993982 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060019016 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060071945 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060076952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060098886 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060110092 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060117006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060138941 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060174942 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060180902 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060220957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060230970 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060333967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060357094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060389996 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060395956 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060415983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060432911 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060756922 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060780048 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060828924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060833931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.060858011 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.060869932 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061064005 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061089039 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061158895 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061165094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061172009 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061295986 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061320066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061353922 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061359882 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061368942 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061393023 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061602116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061626911 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061665058 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061671019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061678886 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061697960 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061702013 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061713934 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061745882 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061747074 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061773062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061778069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061799049 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061822891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.061949015 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061969995 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.061997890 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062005997 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062026024 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062040091 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062177896 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062197924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062226057 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062232018 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062254906 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062272072 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062424898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062450886 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062477112 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062482119 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062500000 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062520027 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062547922 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062567949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062601089 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062606096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062625885 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062647104 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062747955 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062767982 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062794924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062799931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.062815905 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.062832117 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.063786030 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.063810110 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.063870907 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.063878059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.064033031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.093893051 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.093925953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.093992949 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.094060898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.094094038 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.094096899 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.094125986 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.094156027 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.094170094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.094194889 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.094347954 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.094486952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.094515085 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.094546080 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.094559908 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.094585896 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.094600916 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.160852909 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.160878897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.160988092 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.160988092 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.161020994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.161055088 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.175030947 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.175056934 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.175107956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.175115108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.175137997 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.175156116 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.175514936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.175534964 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.175559998 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.175565004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.175590038 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.175601006 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.176145077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.176184893 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.176203012 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.176208019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.176239014 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.176250935 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.177401066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.177419901 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.177474976 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.177480936 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.177794933 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.178080082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.178100109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.178137064 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.178149939 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.178178072 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.178200006 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.178467989 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.178484917 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.178577900 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.178590059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.178615093 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.178638935 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.189898968 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.189922094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.189974070 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.189990997 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.190016985 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.190527916 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.190767050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.190787077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.190820932 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.190857887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.190896034 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.190896034 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191039085 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191082001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191095114 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191113949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191138983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191158056 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191159964 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191174984 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191193104 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191200972 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191220999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191237926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191258907 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191267014 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191277027 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191329956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191329956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191350937 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191370964 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191395044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191399097 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191410065 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191426992 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191446066 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191473007 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191485882 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191517115 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191533089 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191555977 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191580057 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191597939 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191627026 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191652060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191678047 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191690922 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191708088 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191735029 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191746950 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191771984 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191778898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191803932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191826105 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191842079 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191871881 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191879988 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191899061 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191925049 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.191936970 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.191962004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192028999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192028999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192174911 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192197084 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192218065 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192229033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192246914 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192253113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192275047 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192276955 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192289114 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192305088 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192320108 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192337036 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192367077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192385912 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192414999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192426920 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192450047 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192456007 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192481041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192482948 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192482948 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192500114 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192528009 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192543030 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192545891 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192559004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192564964 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192574978 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192596912 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192615986 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192631006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192645073 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192670107 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192682028 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192709923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192709923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192713022 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192728043 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192737103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192749977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192764997 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192785025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192857027 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.192956924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.192976952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.193010092 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.193021059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.193047047 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.193063974 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.193201065 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.193324089 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195328951 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195368052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195411921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195420027 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195434093 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195481062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195481062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195506096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195528030 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195542097 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195591927 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195612907 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195614100 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195631981 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195655107 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195787907 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195807934 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195835114 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195852995 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195877075 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195880890 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195899963 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195915937 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195929050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195951939 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195965052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.195970058 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.195981979 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.196012974 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.196032047 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.196053028 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.196058035 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.196069002 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.196080923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.196086884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.196094990 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.196120977 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.196132898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.196161985 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.196177006 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.211635113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.211659908 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.211750031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.211771011 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.211850882 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.211874962 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.211908102 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.211920023 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.211950064 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.215070009 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.215174913 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.215203047 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.215234041 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.215245962 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.215266943 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.215284109 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.215663910 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.215684891 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.215714931 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.215728045 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.215749025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.215768099 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.280376911 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.280404091 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.280474901 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.280500889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.283086061 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.287503958 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.287532091 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.287596941 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.287611008 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.287641048 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.287899017 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.288393974 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.288419008 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.288455963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.288467884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.288496971 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.288738966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.288765907 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.288798094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.288811922 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.288836002 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.288855076 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.289520979 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.289544106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.289588928 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.289607048 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.289629936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.289649963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.289864063 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.289890051 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.289927006 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.289937973 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.289963961 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.290190935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.290211916 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.290246010 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.290258884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.290286064 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.290302038 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.290767908 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.290782928 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.290838957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.290852070 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.291033983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.292346001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.292373896 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.292426109 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.292442083 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.292465925 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.292661905 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.292687893 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.292732954 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.292745113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.292772055 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.292886019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.292906046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.292999029 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.293013096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.293051004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.293068886 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.293178082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.293200970 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.293239117 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.293253899 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.293277025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.293297052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.293785095 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.293812037 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.293849945 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.293855906 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.293879032 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.293901920 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.294094086 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.294114113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.294161081 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.294166088 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.294187069 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.294203043 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.294621944 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.294641972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.294682980 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.294687986 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.294712067 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.294728041 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.294994116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.295013905 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.295053005 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.295058966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.295077085 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.295094967 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.295809031 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.295828104 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.295861959 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.295866966 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.295890093 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.295907021 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.296123981 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.296144009 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.296175003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.296180010 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.296201944 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.296219110 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.296407938 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.296428919 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.296462059 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.296467066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.296484947 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.296500921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.296806097 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.296824932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.296857119 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.296861887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.296881914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.296902895 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297152996 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297171116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297204018 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297209024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297231913 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297246933 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297470093 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297489882 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297527075 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297533035 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297554016 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297569036 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297755957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297774076 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297811985 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297817945 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297832012 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297853947 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297919989 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297940016 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.297981024 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.297986031 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.298007011 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.298021078 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.298274994 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.298295975 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.298326015 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.298336029 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.298357010 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.298376083 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.298654079 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.298675060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.298707008 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.298712969 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.298734903 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.298753977 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.298979998 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.298996925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.299030066 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.299035072 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.299067020 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.299210072 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.299233913 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.299242020 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.299247980 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.299279928 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.299293995 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.299319983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.299490929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.299508095 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.299549103 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.299566984 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.299577951 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300013065 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300036907 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300072908 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300084114 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300092936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300117970 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300349951 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300370932 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300406933 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300415993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300426960 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300446987 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300566912 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300587893 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300623894 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300628901 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300643921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300666094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300820112 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300842047 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300879002 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300884962 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.300900936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.300916910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.301162004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.301182985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.301224947 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.301232100 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.301240921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.301264048 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.328777075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.328804016 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.328907013 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.328934908 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.328986883 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.329010963 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.329039097 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.329046965 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.329061031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.329112053 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.332175016 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.332196951 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.332231998 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.332241058 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.332253933 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.332274914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.332359076 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.332374096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.332406044 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.332412004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.332427979 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.332446098 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.397845984 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.397874117 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.397979021 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.398000956 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.398014069 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.398042917 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.404557943 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.404582977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.404644966 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.404650927 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.404687881 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.404908895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.404928923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.404959917 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.404966116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.404985905 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.405004978 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.405875921 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.405899048 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.405925035 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.405930996 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.405951023 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.405970097 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.407341957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.407366037 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.407407999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.407413006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.407421112 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.407445908 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.407577991 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.407598972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.407628059 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.407633066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.407655001 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.407674074 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.407751083 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.407771111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.407794952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.407799006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.407823086 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.407838106 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.408042908 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.408065081 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.408090115 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.408096075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.408118963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.408130884 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.409053087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.409071922 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.409117937 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.409123898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.409509897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.409529924 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.409557104 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.409562111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.409571886 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.409598112 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.409723997 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.409744024 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.409801960 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.409802914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.409809113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.409996033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.410016060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.410064936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.410064936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.410073042 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.410104036 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.410214901 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.410228014 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.410259962 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.410264969 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.410274982 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.410495043 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.410516977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.410546064 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.410552025 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.410566092 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.410567045 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.410592079 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.411174059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.411191940 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.411226034 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.411231041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.411246061 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.411531925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.411545992 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.411578894 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.411586046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.411607981 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.412204027 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.412221909 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.412250996 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.412256956 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.412302971 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.412491083 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.412516117 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.412549019 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.412564039 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.412574053 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.412621975 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.412636995 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.412669897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.412677050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.412695885 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.412982941 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.413001060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.413033009 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.413038969 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.413053036 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.413482904 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.413503885 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.413541079 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.413553953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.413563013 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.413724899 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.413743019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.413774014 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.413791895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.413804054 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.414221048 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414237976 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414285898 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.414292097 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414314032 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.414644003 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414663076 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414695024 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.414700985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414712906 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.414772987 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414787054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414819956 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.414827108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414841890 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.414957047 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414972067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.414999008 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.415004969 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415028095 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.415034056 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415054083 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415081024 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.415096045 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415103912 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.415298939 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415326118 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415365934 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.415374041 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415389061 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.415492058 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415505886 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415534019 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.415541887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415560007 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.415848017 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415862083 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415893078 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.415899038 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.415914059 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.416263103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416277885 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416310072 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.416316986 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416326046 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.416335106 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416357040 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416383028 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.416388988 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416404009 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.416582108 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416604042 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416630030 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.416635990 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416644096 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.416675091 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416691065 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416714907 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.416722059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.416738033 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.417073965 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.417088985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.417141914 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.417148113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.417162895 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.417469025 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.417485952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.417515039 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.417521954 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.417546988 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.446295977 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.446317911 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.446377993 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.446388006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.446415901 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.449246883 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.449265957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.449307919 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.449315071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.449323893 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.449635029 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.449651003 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.449702978 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.449707985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.449721098 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.449736118 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.449747086 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.449765921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.449771881 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.449795008 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.449816942 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.515023947 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.515048027 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.515091896 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.515099049 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.515124083 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.515146971 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.522021055 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.522051096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.522095919 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.522102118 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.522136927 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.522732019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.522757053 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.522797108 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.522802114 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.522810936 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.522838116 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.523170948 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.523195982 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.523224115 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.523228884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.523256063 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.523269892 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.523663044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.523684978 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.523725033 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.523731947 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.523747921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.523762941 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.524446964 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.524465084 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.524517059 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.524522066 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.524590015 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.524643898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.524662971 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.524699926 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.524710894 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.524732113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.524745941 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.525233984 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.525255919 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.525299072 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.525304079 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.525326967 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.525345087 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.526242971 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.526263952 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.526304007 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.526309967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.526326895 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.526349068 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.526595116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.526614904 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.526635885 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.526640892 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.526664972 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.526679993 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.526909113 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.526927948 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.526963949 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.526968956 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.526983023 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.527002096 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.527353048 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.527373075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.527415991 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.527421951 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.527465105 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.527611971 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.527631044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.527673960 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.527678967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.527693033 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.527699947 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.527717113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.527719021 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.527735949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.527748108 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.527774096 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.528239965 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.528259993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.528297901 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.528305054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.528316021 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.528335094 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.528496027 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.528517008 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.528557062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.528562069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.528578043 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.528601885 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.528804064 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.528821945 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.528862000 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.528868914 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.528883934 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.528903008 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.529771090 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.529787064 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.529814959 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.529824018 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.529839993 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.529854059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.529855967 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.529867887 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.529885054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.529896975 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.529903889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.529917955 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.529937029 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.530162096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.530178070 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.530216932 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.530221939 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.530230999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.530251026 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.531425953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531445980 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531490088 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.531495094 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531517029 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.531533003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.531563997 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531579018 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531608105 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.531613111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531632900 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.531650066 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.531876087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531899929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531924963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.531929970 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531948090 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.531955957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531966925 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.531971931 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.531987906 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532001972 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532018900 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532026052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532061100 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532067060 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532079935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532097101 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532105923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532118082 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532121897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532144070 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532166004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532269001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532284975 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532327890 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532334089 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532351971 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532367945 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532458067 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532474995 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532500029 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532505035 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532526016 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532533884 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532624006 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532639027 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532672882 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532679081 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532700062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532716990 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532810926 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532824993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532845974 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532851934 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.532866001 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.532886982 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533014059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533031940 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533061028 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533066034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533087969 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533104897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533200979 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533219099 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533246040 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533252001 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533278942 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533291101 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533363104 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533380985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533421040 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533426046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533508062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533545971 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533565044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533597946 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533606052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533627987 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533638954 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533665895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533684969 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533710003 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533714056 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.533730030 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533747911 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.533987999 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.534008980 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.534035921 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.534040928 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.534064054 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.534080982 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.534152031 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.534169912 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.534193993 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.534198999 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.534215927 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.534233093 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.534437895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.534455061 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.534502983 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.534507990 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.534535885 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.563354015 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.563384056 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.563410997 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.563416958 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.563446999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.563462973 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.563610077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.563631058 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.563657999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.563662052 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.563683033 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.563702106 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.566967010 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.566992998 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.567032099 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.567038059 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.567050934 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.567065954 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.567070961 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.567085028 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.567090988 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.567106962 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.567125082 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.567137003 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.567156076 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.567178965 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.567184925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.567200899 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.567218065 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.632256985 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.632282972 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.632339001 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.632345915 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.632385969 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.639336109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.639363050 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.639413118 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.639420986 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.639511108 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.639512062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.639883995 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.639903069 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.639946938 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.639961004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.639976025 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.640003920 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.640198946 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.640218973 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.640256882 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.640261889 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.640290022 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.640301943 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.640829086 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.640847921 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.640899897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.640904903 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.640979052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.641513109 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.641535044 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.641581059 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.641587019 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.641599894 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.641621113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.641952991 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.641977072 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.642018080 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.642023087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.642049074 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.642061949 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.642313957 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.642338037 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.642390966 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.642395973 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.642463923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.642618895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.642646074 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.642682076 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.642687082 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.642708063 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.642726898 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.643811941 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.643837929 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.643870115 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.643874884 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.643898010 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.643915892 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.644277096 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.644305944 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.644346952 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.644351959 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.644371033 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.644395113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.644527912 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.644551039 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.644592047 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.644597054 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.644610882 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.644638062 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.644742012 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.644764900 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.644804955 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.644810915 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.644824028 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.644843102 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.645370960 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645394087 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645442963 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.645448923 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645474911 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645499945 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645526886 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.645533085 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645549059 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.645566940 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.645626068 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645643950 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645697117 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.645703077 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645766973 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.645852089 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645872116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.645946980 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.645952940 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.646045923 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.646292925 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.646311998 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.646363020 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.646368980 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.646447897 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.646970034 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.646990061 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.647036076 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.647042036 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.647049904 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.647075891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.647243023 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.647264004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.647308111 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.647317886 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.647341967 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.647365093 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.647393942 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.647398949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.647442102 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.647442102 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.648736000 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.648760080 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.648801088 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.648808002 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.648822069 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.648830891 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.648989916 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649010897 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649044991 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649053097 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649075031 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649084091 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649085999 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649099112 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649121046 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649135113 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649142027 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649163008 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649182081 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649606943 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649625063 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649666071 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649672985 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649686098 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649704933 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649729967 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649738073 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649749041 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649825096 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649871111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649884939 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.649929047 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.649935007 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650012970 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650031090 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650038004 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650043011 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650060892 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650089979 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650177956 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650196075 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650233984 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650238991 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650248051 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650274038 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650343895 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650363922 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650403023 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650408983 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650429964 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650434971 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650543928 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650558949 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650605917 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650612116 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650650978 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650669098 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650685072 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650696993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650717020 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650743961 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650918961 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650933027 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.650986910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.650994062 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651061058 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651165962 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651180029 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651225090 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651232004 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651241064 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651257992 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651287079 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651293993 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651308060 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651334047 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651416063 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651431084 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651474953 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651482105 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651546001 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651670933 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651685953 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651736975 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651742935 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651804924 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651818991 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651832104 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651864052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651870012 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.651884079 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651899099 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.651992083 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.652007103 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.652039051 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.652045012 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.652060032 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.652075052 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.681490898 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.681514978 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.681581974 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.681602001 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.681616068 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.681639910 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.681657076 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.681674957 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.681682110 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.681699991 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.681718111 CEST	443	49828	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.682291985 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.682311058 CEST	49828	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.865541935 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.865565062 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:50.865643978 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.865963936 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:50.865977049 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.599590063 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.601218939 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.601229906 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.739597082 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.739726067 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.739784002 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.739800930 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.739876032 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.739917994 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.739927053 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.740047932 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.740134954 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.740278959 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.740304947 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.740310907 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.740320921 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.740428925 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.740492105 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.740497112 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.790635109 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.856555939 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.856714010 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.856796026 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.856831074 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.856844902 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.856884956 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.856941938 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.857134104 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.857192039 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.857198000 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.857728004 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.857809067 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.857861996 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.857867002 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.858189106 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.858211040 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.858364105 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.858407021 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.858412981 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.858511925 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.858560085 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.858563900 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.859184980 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.859251976 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.859256983 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.859348059 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.859396935 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.859401941 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.860006094 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.860060930 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.860068083 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.899996996 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.974215984 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.974409103 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.974498987 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.974514961 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.974526882 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.974562883 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.974589109 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.974740982 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.974802971 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.974807978 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.974895000 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.974941015 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.974946022 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.975061893 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.975120068 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.975123882 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.975246906 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.975307941 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.975316048 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.975357056 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.975366116 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.976121902 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.976177931 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.976181984 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.976210117 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.976229906 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.976234913 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.976257086 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.976963997 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.977016926 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.977020979 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.977051973 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.977065086 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.977086067 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.977102041 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.977932930 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.977982998 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.977986097 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.977997065 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.978027105 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.978029966 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.978045940 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.978068113 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.978112936 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.978117943 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.978199005 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:51.978873968 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:51.978928089 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.091454983 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.091557026 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.091598034 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.091655970 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.091660976 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.091684103 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.091694117 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.091711998 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.091722012 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.091821909 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.091865063 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.091869116 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.091902018 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.091917038 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.091929913 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.091949940 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.092025995 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.092073917 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.092077971 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.092124939 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.092416048 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.092480898 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.092711926 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.092771053 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.092814922 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.092871904 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.092905045 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.092951059 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.093571901 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.093636036 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.093673944 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.093720913 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.093776941 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.093825102 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.093863010 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.093911886 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.094445944 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.094505072 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.094546080 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.094603062 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.094651937 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.094705105 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.094743013 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.094799995 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.095376968 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.095432997 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.095501900 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.095571041 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.095597982 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.095650911 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.096355915 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.096414089 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.096462965 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.096514940 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.096535921 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.096587896 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.096621990 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.096672058 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.097362995 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.097420931 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.097462893 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.097515106 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.097548008 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.097620010 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.208657026 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.208719015 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.208884001 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.208904982 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.208940029 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.208941936 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.208990097 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.208996058 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.209137917 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.209189892 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.209198952 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.209203959 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.209261894 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.209300041 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.209342003 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.209366083 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.209372044 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.209397078 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.209415913 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.213819981 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.213872910 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.213900089 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.213906050 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.213936090 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.213948965 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.214247942 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.214292049 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.214310884 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.214315891 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.214339972 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.214353085 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.214488029 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.214533091 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.214546919 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.214571953 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.214584112 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.214622021 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.214840889 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.214884043 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.214907885 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.214911938 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.214937925 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.214946985 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.215003967 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.215048075 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.215060949 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.215068102 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.215087891 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.215100050 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.215816975 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.215857983 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.215890884 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.215894938 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.215920925 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.215939999 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.215981960 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216032028 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216048956 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216056108 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216084003 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216098070 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216254950 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216305971 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216324091 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216330051 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216355085 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216363907 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216463089 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216504097 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216548920 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216553926 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216578007 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216595888 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216631889 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216680050 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216697931 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216703892 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.216717958 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.216738939 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.217010021 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.217060089 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.217077017 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.217082024 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.217113018 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.325941086 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.326001883 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.326066971 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.326082945 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.326098919 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.326121092 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.326689005 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.326733112 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.326766968 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.326773882 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.326797962 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.326814890 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.327384949 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.327428102 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.327460051 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.327465057 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.327487946 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.327508926 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.327609062 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.327650070 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.327673912 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.327677965 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.327697992 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.327718019 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.327769041 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.327821970 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.327843904 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.327863932 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.327881098 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.327903032 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.328150988 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.328192949 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.328221083 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.328223944 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.328247070 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.328263998 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.328675985 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.328718901 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.328739882 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.328744888 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.328763962 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.329107046 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.329147100 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.329170942 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.329175949 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.329196930 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.329735994 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.329777002 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.329798937 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.329804897 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.329830885 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.330158949 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.330199003 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.330224991 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.330229044 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.330254078 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.331284046 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.331338882 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.331342936 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.331365108 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.331393003 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.331478119 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.331516027 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.331532955 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.331537962 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.331562996 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.331949949 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.331989050 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332012892 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.332017899 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332042933 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.332153082 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332216024 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.332221031 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332232952 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332279921 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.332283974 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332487106 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332525969 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332547903 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.332555056 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332580090 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.332693100 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332731009 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332751989 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.332756996 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.332786083 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.333210945 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.333266020 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.333278894 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.333290100 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.333319902 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.333492041 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.333528996 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.333554983 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.333559036 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.333580017 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.334017038 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334057093 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334070921 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.334079981 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334110975 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.334271908 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334322929 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334342003 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.334347963 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334381104 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.334516048 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334558964 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334580898 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.334585905 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334608078 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.334681034 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334733963 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334739923 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.334759951 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.334805965 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.384396076 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.443017006 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.443062067 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.443129063 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.443150043 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.443175077 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.443200111 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.443799973 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.443842888 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.443871975 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.443876028 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.443897963 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.443911076 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.444197893 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.444237947 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.444263935 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.444268942 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.444289923 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.444303036 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.444928885 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.444969893 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.444993019 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.444997072 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.445028067 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.445028067 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.445322037 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.445363998 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.445522070 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.445522070 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.445528030 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.445910931 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.445964098 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.445985079 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.445995092 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.446023941 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.446049929 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.446280956 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.446321964 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.446348906 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.446353912 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.446377993 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.446394920 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.446819067 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.446858883 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.446887016 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.446891069 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.446914911 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.446933985 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.447055101 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.447099924 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.447114944 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.447119951 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.447160006 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.447452068 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.447490931 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.447524071 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.447529078 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.447545052 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.447565079 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.448498011 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.448539019 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.448569059 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.448571920 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.448596001 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.448652983 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.448796034 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.448834896 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.448853970 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.448858976 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.448889971 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.449295044 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.449347973 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.449382067 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.449384928 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.449402094 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.449420929 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.449635983 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.449678898 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.449704885 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.449709892 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.449733019 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.449749947 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.449872971 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.449915886 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.449942112 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.449948072 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.449960947 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.449987888 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.450349092 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.450387001 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.450417042 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.450421095 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.450447083 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.450468063 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.450686932 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.450726986 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.450753927 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.450757980 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.450787067 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.450804949 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.450855017 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.450894117 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.450913906 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.450921059 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.450952053 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.450964928 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.451214075 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.451288939 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.451289892 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.451327085 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.451353073 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.451371908 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.451836109 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.451878071 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.451914072 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.451917887 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.451942921 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.451957941 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.452547073 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.452589989 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.452621937 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.452625990 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.452646971 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.452668905 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.452748060 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.452790022 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.452809095 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.452816010 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.452843904 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.452861071 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.453119040 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.453159094 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.453187943 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.453191996 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.453226089 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.453244925 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.560520887 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.560601950 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.560607910 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.560625076 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.560664892 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.560676098 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.560975075 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561019897 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561057091 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561064959 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561084032 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561103106 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561424971 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561464071 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561534882 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561538935 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561568022 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561589003 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561708927 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561749935 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561781883 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561785936 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561806917 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561829090 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561876059 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561923981 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561953068 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561958075 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.561975956 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.561994076 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.562601089 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.562644005 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.562664032 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.562669992 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.562690020 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.562709093 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.562844038 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.562885046 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.562906981 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.562911987 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.562930107 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.562947989 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563087940 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563134909 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563155890 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563160896 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563174963 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563194036 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563311100 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563384056 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563393116 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563421011 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563440084 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563453913 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563635111 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563685894 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563694954 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563699007 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563745022 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563888073 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563930988 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563951969 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563956976 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.563975096 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.563992023 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.564857006 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.564901114 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.564920902 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.564925909 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.564949036 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.564960003 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.565387011 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.565440893 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.565448046 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.565457106 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.565496922 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.565685987 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.565726042 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.565752983 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.565757036 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.565783024 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.565787077 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.566761017 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.566804886 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.566834927 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.566838026 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.566854000 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.566871881 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.566982985 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567025900 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567048073 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567063093 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567075014 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567116022 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567461967 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567502022 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567523003 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567528963 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567549944 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567564011 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567714930 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567755938 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567780018 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567785025 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567804098 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567816019 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567879915 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567923069 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567950010 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567954063 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.567981958 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.567987919 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.568202972 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.568255901 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.568278074 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.568283081 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.568290949 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.568319082 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.568964958 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.569009066 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.569031000 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.569036961 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.569050074 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.569073915 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.569569111 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.569610119 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.569643021 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.569647074 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.569653988 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.569684029 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.569808006 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.569845915 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.569860935 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.569883108 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.569894075 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.569932938 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.570036888 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.570080996 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.570099115 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.570103884 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.570126057 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.570144892 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678013086 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678076029 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678113937 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678138971 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678155899 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678167105 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678266048 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678316116 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678338051 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678345919 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678369999 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678394079 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678436995 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678478003 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678493023 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678498030 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678533077 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678879976 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678929090 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678953886 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678958893 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.678983927 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.678999901 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.679105043 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.679161072 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.679181099 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.679188013 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.679199934 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.679225922 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.679377079 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.679435015 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.679451942 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.679459095 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.679481983 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.679501057 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.679913044 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.679960966 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.679987907 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.679991961 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.680016041 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.680035114 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.680145025 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.680185080 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.680207014 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.680212021 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.680241108 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.680249929 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.680413961 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.680430889 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.680471897 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.680476904 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.680537939 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.680537939 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.681155920 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.681206942 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.681266069 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.681271076 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.681368113 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.681432009 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.681443930 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.681468964 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.681502104 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.681530952 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.682219982 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.682261944 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.682296038 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.682300091 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.682308912 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.682358980 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.682442904 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.682492971 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.682502031 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.682506084 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.682538033 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.682564020 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.683713913 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.683754921 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.683789015 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.683794022 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.683815956 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.683834076 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.683893919 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.683943033 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.683970928 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.683980942 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.684005022 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.684020996 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.684156895 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.684205055 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.684236050 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.684240103 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.684258938 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.684281111 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.684412003 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.684452057 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.684477091 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.684482098 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.684499025 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.684518099 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.684617996 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.684659958 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.684679985 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.684685946 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.684722900 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.685039997 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.685081005 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.685110092 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.685113907 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.685132980 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.685158014 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.685247898 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.685311079 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.685332060 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.685396910 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.685889006 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.685930014 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.685957909 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.685964108 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.685981989 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.686001062 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.686090946 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.686135054 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.686150074 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.686158895 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.686198950 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.686208010 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.686690092 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.686734915 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.686760902 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.686765909 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.686788082 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.686805010 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.687078953 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.687122107 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.687138081 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.687144041 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.687181950 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.687391996 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.687439919 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.687468052 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.687472105 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.687495947 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.687515974 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.795346022 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.795408010 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.795429945 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.795444965 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.795456886 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.795481920 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.795603991 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.795650959 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.795686960 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.795691013 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.795701981 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.795727015 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.795819044 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.795869112 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.795878887 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.795897007 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.795918941 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.795943975 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.796124935 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.796169043 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.796186924 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.796192884 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.796217918 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.796235085 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.796418905 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.796466112 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.796489000 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.796494961 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.796511889 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.796530962 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.796684027 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.796731949 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.796755075 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.796758890 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.796780109 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.796802998 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.797070026 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.797108889 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.797133923 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.797137976 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.797154903 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.797173023 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.797307968 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.797348976 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.797375917 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.797379971 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.797394991 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.797410011 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.798319101 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.798369884 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.798383951 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.798393011 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.798418999 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.798437119 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.798676968 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.798717022 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.798744917 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.798749924 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.798768044 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.798791885 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.798952103 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.798995018 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.799012899 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.799019098 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.799031019 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.799053907 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.799463987 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.799514055 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.799539089 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.799542904 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.799609900 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.799643993 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.800273895 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.800313950 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.800337076 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.800340891 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.800364971 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.800374985 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.800781965 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.800822973 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.800851107 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.800856113 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.800868034 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.800893068 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.801676989 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.801721096 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.801744938 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.801749945 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.801763058 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.801789999 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.802099943 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.802164078 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.802180052 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.802184105 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.802196026 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.802217960 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.802582026 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.802623034 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.802645922 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.802651882 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.802664042 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.802686930 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.802936077 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.802977085 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.802997112 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.803002119 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.803035975 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.803035975 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.803394079 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.803442955 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.803457975 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.803462982 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.803491116 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.803500891 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.803831100 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.803878069 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.803934097 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.803934097 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.803939104 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.803982973 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.804131031 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.804172993 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.804198027 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.804202080 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.804225922 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.804234982 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.804331064 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.804380894 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.804399967 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.804404020 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.804429054 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.804446936 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.804824114 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.804868937 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.804893017 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.804898024 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.804912090 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.804930925 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.805222988 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.805263996 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.805293083 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.805296898 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.805305958 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.805329084 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.805696011 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.805744886 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.805768013 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.805778027 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.805789948 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.805818081 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.806225061 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.806278944 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.806296110 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.806301117 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.806334019 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.806345940 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.808408022 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.808429003 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.808473110 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.808478117 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.808500051 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.808515072 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.912790060 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.912851095 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.912890911 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.912904024 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.912939072 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.912954092 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.913177013 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.913229942 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.913254976 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.913259983 CEST	443	49850	104.16.149.130	192.168.2.5
Oct 22, 2024 09:55:52.913300991 CEST	49850	443	192.168.2.5	104.16.149.130
Oct 22, 2024 09:55:52.913320065 CEST	49850	443	192.168.2.5	104.16.149.130

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 22, 2024 09:55:12.578049898 CEST	192.168.2.5	1.1.1.1	0xcb3c	Standard query (0)	geo.lavasoft.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:55:13.489933968 CEST	192.168.2.5	1.1.1.1	0x53c7	Standard query (0)	featureflags.lavasoft.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:55:14.641978979 CEST	192.168.2.5	1.1.1.1	0x3042	Standard query (0)	flwadw.com	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:55:36.600141048 CEST	192.168.2.5	1.1.1.1	0xcb92	Standard query (0)	wcdownloadercdn.lavasoft.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 22, 2024 09:55:12.587935925 CEST	1.1.1.1	192.168.2.5	0xcb3c	No error (0)	geo.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:55:12.587935925 CEST	1.1.1.1	192.168.2.5	0xcb3c	No error (0)	geo.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:55:13.499736071 CEST	1.1.1.1	192.168.2.5	0x53c7	No error (0)	featureflags.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:55:13.499736071 CEST	1.1.1.1	192.168.2.5	0x53c7	No error (0)	featureflags.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:55:14.649669886 CEST	1.1.1.1	192.168.2.5	0x3042	No error (0)	flwadw.com	104.18.27.149	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:55:14.649669886 CEST	1.1.1.1	192.168.2.5	0x3042	No error (0)	flwadw.com	104.18.26.149	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:55:36.609081030 CEST	1.1.1.1	192.168.2.5	0xcb92	No error (0)	wcdownloadercdn.lavasoft.com	104.16.149.130	A (IP address)	IN (0x0001)	false
Oct 22, 2024 09:55:36.609081030 CEST	1.1.1.1	192.168.2.5	0xcb92	No error (0)	wcdownloadercdn.lavasoft.com	104.16.148.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	104.16.148.130	80	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 22, 2024 09:55:12.667902946 CEST	66	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com Connection: Keep-Alive
Oct 22, 2024 09:55:13.342528105 CEST	310	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:13 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ec7f4da63aa8-DFW Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}
Oct 22, 2024 09:55:33.492793083 CEST	42	OUT	GET / HTTP/1.1 Host: geo.lavasoft.com
Oct 22, 2024 09:55:33.732594013 CEST	310	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:33 GMT Content-Type: text/plain Content-Length: 76 Connection: keep-alive Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecfebcdf3aa8-DFW Data Raw: 7b 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 78 2d 67 65 6f 63 6f 75 6e 74 72 79 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 66 2d 69 70 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 7d Data Ascii: {"x-geocountry":"US","x-geocountryname":"United States","cf-ipcountry":"US"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	104.16.148.130	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:14 UTC	143	OUT	POST /api/feature/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 194 Connection: Keep-Alive
2024-10-22 07:55:14 UTC	194	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 36 32 32 30 37 30 30 31 38 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 31 30 32 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 69 6e 73 74 61 6c 6c 65 72 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 66 65 61 74 75 72 65 77 70 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 7d Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20622070018","InstallDate":"20241022","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
2024-10-22 07:55:14 UTC	249	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:14 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ec86e9a26c57-DFW
2024-10-22 07:55:14 UTC	884	IN	Data Raw: 33 36 64 0d 0a 5b 7b 22 73 65 63 74 69 6f 6e 43 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 64 65 22 3a 22 57 41 43 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 49 63 6f 6e 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 65 62 63 6f 6d 70 61 6e 69 6f 6e 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 5c 22 2c 20 5c 22 41 70 70 4e 61 6d 65 5c 22 3a 20 5c 22 57 65 62 20 43 6f 6d 70 61 6e 69 6f 6e 5c 22 2c 20 5c 22 53 65 74 74 69 6e 67 73 5c 22 3a 20 5b 5c 22 57 43 41 75 74 6f 55 70 64 61 74 65 5c 22 2c 20 5c 22 45 6e 61 62 6c 65 47 72 61 6e 75 6c 61 72 69 74 79 5c 22 2c 20 5c 22 50 6f 73 74 52 75 6e 56 32 41 63 74 69 6f 6e 5c 22 2c 20 5c 22 50 6f 73 74 52 75 6e 54 69 6d 65 72 41 63 74 69 6f 6e 5c 22 2c 20 5c 22 45 6e 61 Data Ascii: 36d[{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"Ena
2024-10-22 07:55:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:15 UTC	166	OUT	POST /v1/event-stat?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 447 Connection: Keep-Alive
2024-10-22 07:55:15 UTC	447	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 54 72 69 67 67 65 72 22 3a 20 22 69 6e 73 74 61 6c 6c 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "Trigger": "install", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId"
2024-10-22 07:55:15 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:15 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ec8cfe9d4756-DFW
2024-10-22 07:55:15 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:16 UTC	145	OUT	POST /v1/event-stat-wc?Type=Start&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 398
2024-10-22 07:55:16 UTC	398	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 54 72 69 67 67 65 72 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","Trigger":"install","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402"
2024-10-22 07:55:16 UTC	235	IN	HTTP/1.1 400 Bad Request Date: Tue, 22 Oct 2024 07:55:16 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ec92aafd3acf-DFW
2024-10-22 07:55:16 UTC	39	IN	Data Raw: 32 31 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 49 6e 76 61 6c 69 64 20 66 6f 72 6d 61 74 2f 64 61 74 61 22 7d 0d 0a Data Ascii: 21{"message":"Invalid format/data"}
2024-10-22 07:55:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:17 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 508
2024-10-22 07:55:17 UTC	508	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:55:18 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:18 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ec985ef84612-DFW
2024-10-22 07:55:18 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49711	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:19 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 646
2024-10-22 07:55:19 UTC	646	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:55:20 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:19 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67eca46d556ba0-DFW
2024-10-22 07:55:20 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49712	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:21 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 515
2024-10-22 07:55:21 UTC	515	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:55:21 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:21 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecb44a70e7d3-DFW
2024-10-22 07:55:21 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49715	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:22 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 482
2024-10-22 07:55:22 UTC	482	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:55:22 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:22 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecb9c978e534-DFW
2024-10-22 07:55:22 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49716	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:23 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 515
2024-10-22 07:55:23 UTC	515	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:55:23 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:23 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecbf49190b95-DFW
2024-10-22 07:55:23 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49718	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:24 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 488
2024-10-22 07:55:24 UTC	488	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:55:24 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:24 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecc4e996478c-DFW
2024-10-22 07:55:24 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49719	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:25 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 527
2024-10-22 07:55:25 UTC	527	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:55:25 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:25 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67eccababe476d-DFW
2024-10-22 07:55:25 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49720	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:26 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 466
2024-10-22 07:55:26 UTC	466	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:55:26 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:26 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecd04872e73a-DFW
2024-10-22 07:55:26 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49722	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:26 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 527
2024-10-22 07:55:26 UTC	527	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:55:27 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:27 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecd5d98f2cd5-DFW
2024-10-22 07:55:27 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49724	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:27 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 458
2024-10-22 07:55:27 UTC	458	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:55:28 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:28 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecdb69a7e7cf-DFW
2024-10-22 07:55:28 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49727	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:28 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 520
2024-10-22 07:55:28 UTC	520	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:55:28 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:28 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ece0fdade702-DFW
2024-10-22 07:55:28 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49731	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:29 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 460
2024-10-22 07:55:29 UTC	460	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:55:29 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:29 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ece60bb87d57-DFW
2024-10-22 07:55:29 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49734	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:30 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 520
2024-10-22 07:55:30 UTC	520	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:55:30 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:30 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67eceb9c71476d-DFW
2024-10-22 07:55:30 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49740	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:31 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 475
2024-10-22 07:55:31 UTC	475	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:55:31 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:31 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecf17be22d29-DFW
2024-10-22 07:55:31 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49747	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:32 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 520
2024-10-22 07:55:32 UTC	520	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:55:32 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:32 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecf75d196c07-DFW
2024-10-22 07:55:32 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49754	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:33 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 491
2024-10-22 07:55:33 UTC	491	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:55:33 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:33 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ecfceab18d2c-DFW
2024-10-22 07:55:33 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49760	104.16.148.130	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:34 UTC	118	OUT	POST /api/Update/WC HTTP/1.1 Content-Type: application/json Host: featureflags.lavasoft.com Content-Length: 194
2024-10-22 07:55:34 UTC	194	OUT	Data Raw: 7b 22 47 65 6f 22 3a 22 55 53 22 2c 22 50 61 72 74 6e 65 72 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 22 3a 22 32 30 36 32 32 30 37 30 30 31 38 22 2c 22 49 6e 73 74 61 6c 6c 44 61 74 65 22 3a 22 32 30 32 34 31 30 32 32 22 2c 22 54 72 69 67 67 65 72 54 79 70 65 22 3a 22 69 6e 73 74 61 6c 6c 22 2c 22 54 72 69 67 67 65 72 45 76 65 6e 74 22 3a 22 69 6e 73 74 61 6c 6c 65 72 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 66 65 61 74 75 72 65 77 70 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 61 6c 22 3a 74 72 75 65 7d Data Ascii: {"Geo":"US","Partner":"IN240402","Campaign":"20622070018","InstallDate":"20241022","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
2024-10-22 07:55:34 UTC	249	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ed0538ade7e7-DFW
2024-10-22 07:55:34 UTC	327	IN	Data Raw: 31 34 30 0d 0a 7b 22 63 6f 64 65 22 3a 22 55 50 44 22 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 22 3a 22 7b 5c 22 56 65 72 73 69 6f 6e 5c 22 3a 20 5c 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 5c 22 2c 20 5c 22 49 6e 73 74 61 6c 6c 65 72 45 78 65 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 31 33 2e 30 2e 30 2e 31 30 38 30 2f 57 43 49 6e 73 74 61 6c 6c 65 72 5f 4e 6f 6e 41 64 6d 69 6e 2e 65 78 65 5c 22 2c 20 5c 22 49 6e 73 74 61 6c 6c 65 72 5a 69 70 5c 22 3a 20 5c 22 68 74 74 70 73 3a 2f 2f 77 63 64 6f 77 6e 6c 6f 61 64 65 72 63 64 6e 2e 6c 61 76 61 73 6f 66 74 2e 63 6f 6d 2f 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 2f 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 2d 31 33 2e 39 30 Data Ascii: 140{"code":"UPD","configuration":"{\"Version\": \"13.900.0.1080\", \"InstallerExe\": \"https://wcdownloadercdn.lavasoft.com/13.0.0.1080/WCInstaller_NonAdmin.exe\", \"InstallerZip\": \"https://wcdownloadercdn.lavasoft.com/13.900.0.1080/WebCompanion-13.90
2024-10-22 07:55:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49766	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:35 UTC	152	OUT	POST /v1/event-stat?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 517
2024-10-22 07:55:35 UTC	517	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:55:35 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:35 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ed0a9e7c6b9d-DFW
2024-10-22 07:55:35 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49772	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:36 UTC	155	OUT	POST /v1/event-stat-wc?Type=ProgressInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 485
2024-10-22 07:55:36 UTC	485	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:55:36 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:36 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67ed101b6a2cbc-DFW
2024-10-22 07:55:36 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49778	104.16.149.130	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:37 UTC	127	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com Connection: Keep-Alive
2024-10-22 07:55:38 UTC	381	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:37 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "3718275022" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 2426 Expires: Tue, 22 Oct 2024 11:55:37 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8d67ed16e8e96b39-DFW
2024-10-22 07:55:38 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-10-22 07:55:38 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-10-22 07:55:38 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-10-22 07:55:38 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-10-22 07:55:38 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-10-22 07:55:38 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-10-22 07:55:38 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-10-22 07:55:38 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-10-22 07:55:38 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-10-22 07:55:38 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49828	104.16.149.130	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:47 UTC	103	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com
2024-10-22 07:55:47 UTC	381	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:47 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "3718275022" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 2436 Expires: Tue, 22 Oct 2024 11:55:47 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8d67ed55ff4e358e-DFW
2024-10-22 07:55:47 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-10-22 07:55:47 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-10-22 07:55:47 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-10-22 07:55:47 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-10-22 07:55:47 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-10-22 07:55:47 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-10-22 07:55:47 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-10-22 07:55:47 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-10-22 07:55:47 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-10-22 07:55:47 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49850	104.16.149.130	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:51 UTC	103	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com
2024-10-22 07:55:51 UTC	381	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:51 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "3718275022" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 2440 Expires: Tue, 22 Oct 2024 11:55:51 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8d67ed6feb8fe76a-DFW
2024-10-22 07:55:51 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-10-22 07:55:51 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-10-22 07:55:51 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-10-22 07:55:51 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-10-22 07:55:51 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-10-22 07:55:51 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-10-22 07:55:51 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-10-22 07:55:51 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-10-22 07:55:51 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-10-22 07:55:51 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49872	104.16.149.130	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:55 UTC	103	OUT	GET /13.900.0.1080/WebCompanion-13.900.0.1080-prod.zip HTTP/1.1 Host: wcdownloadercdn.lavasoft.com
2024-10-22 07:55:55 UTC	381	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:55 GMT Content-Type: application/zip Content-Length: 10494317 Connection: close ETag: "3718275022" Last-Modified: Wed, 15 May 2024 10:29:47 GMT CF-Cache-Status: HIT Age: 2444 Expires: Tue, 22 Oct 2024 11:55:55 GMT Cache-Control: public, max-age=14400 Accept-Ranges: bytes Server: cloudflare CF-RAY: 8d67ed87fe756c5c-DFW
2024-10-22 07:55:55 UTC	988	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 d3 25 ae 58 c9 f2 0a dc 46 46 03 00 98 24 07 00 13 00 00 00 41 70 70 6c 69 63 61 74 69 6f 6e 2f 37 7a 61 2e 65 78 65 ec bd 79 78 54 45 d6 38 7c 7b 49 d2 59 48 27 40 43 58 c4 56 5b 8d 84 25 43 50 93 34 68 5f d2 4d 6e 43 47 40 44 51 a3 a0 68 0b ae 18 fa 86 20 8b 60 27 be e9 5c 5b 1d c5 19 75 1c c7 79 67 9c cf 19 97 51 47 59 5c bb 13 c8 c2 be b8 b0 8c 8a 7b 85 16 64 91 10 b6 dc ef 9c 53 b7 b7 10 a2 cf f7 fc 7e ff 7d 79 9e f4 dd aa 4e 9d 3a 75 ea d4 a9 53 a7 4e 55 dc f4 a4 60 10 04 c1 08 ff aa 2a 08 6b 04 fe e7 10 7e fd 8f c1 7f f6 f9 ef 65 0b ef a4 6f be 60 8d ce b3 f9 82 eb e6 ce 5b 60 9d 5f f5 c0 5d 55 b7 dd 67 9d 73 db fd f7 3f e0 b3 de 7e a7 b5 4a be df 3a ef 7e ab 73 ca 74 eb 7d 0f dc 71 e7 a8 3e 7d 32 6c 1a 8c f3 87 dd dd Data Ascii: PK%XFF$Application/7za.exeyxTE8\|{IYH'@CXV[%CP4h_MnCG@DQh `'\[uygQGY\{dS~}yN:uSNU`*k~eo`[`_]Ugs?~J:~st}q>}2l
2024-10-22 07:55:55 UTC	1369	IN	Data Raw: 24 23 7a 68 16 65 1b d6 f6 c2 2b 0c 82 7f 89 ad 50 f0 0d c7 24 f9 1c 18 0a 38 68 10 2c ec c3 6c ed 56 62 6f c3 6d fb fd 54 69 fc f2 b7 f8 97 67 a3 b7 c5 2c 88 25 fb d7 cd 25 ee 8b b7 51 b0 a2 98 0d de 1e 6d 9f 4d 67 b5 71 b0 42 62 27 b7 f5 f6 3d 9f ed e9 e5 bb 12 c4 aa 32 33 2f 1d 93 38 81 1f ad dd fa ae 14 6b b7 0a e5 90 47 f9 46 52 0e 17 ed 2d b9 c9 64 ae 3d 4f 8f b4 d7 7b fd c5 23 cd 75 39 f0 a0 34 69 e4 73 06 ef 51 95 88 d3 be b1 fa 41 e8 f4 6e 65 a0 72 aa 78 b0 af 9f 84 dd 51 52 43 c5 79 f2 71 85 a7 14 ed 67 96 95 04 cb 75 a2 dd 69 33 2d cc 77 2b 59 36 e0 4b 3d db d1 4f 10 4a 9b 7c d9 ca fa 28 48 e5 e7 48 8e 96 29 92 a6 dd a8 eb dd fe 96 3c fb 6b b6 57 e0 a1 ea 8f 4e 7b 64 e9 40 29 78 8d 55 0a 5a 76 6f 33 0a 6c df 00 41 18 13 6a af 86 51 46 0c ce 80 Data Ascii: $#zhe+P$8h,lVbomTig,%%QmMgqBb'=23/8kGFR-d=O{#u94isQAnerxQRCyqgui3-w+Y6K=OJ\|(HH)<kWN{d@)xUZvo3lAjQF
2024-10-22 07:55:55 UTC	1369	IN	Data Raw: 6f 01 92 a9 81 72 98 19 0c 9d 00 5c 03 59 ae 80 c1 ad 64 96 c9 37 92 0b a1 2b 53 50 08 39 6d 33 71 74 cb 26 71 d8 ca fe 60 e1 63 1b ca a3 2d ac 76 04 f5 84 c2 59 b7 26 4b 94 c4 3e 33 93 0d 4e 11 12 f5 5e f1 3a 69 c5 4f cb b1 9e d1 01 44 54 18 2a 3b f0 38 97 b4 6f ae b0 ce 65 83 7c 28 66 1d a5 2d 72 4a 3b 33 e0 10 ad 69 80 73 d9 25 f7 c2 14 92 3e 6c c5 0f 2b 96 d8 f2 f7 a9 ea c3 55 29 ed 1f 1b a2 aa ed 97 a0 d7 3c b9 e2 cc 9b 30 01 35 d7 4e 00 96 5a 71 e6 2d ba bf 42 c7 93 cc 64 8b fb 90 d4 01 55 15 74 a2 3b aa 73 51 ae e2 fb bf e0 e0 8e af 3d c1 c7 6c ad a4 12 81 d0 bd 0e 68 41 a5 33 ad f4 21 38 aa cf 64 25 c6 98 7a 39 0a 6f db ed 80 03 48 f8 56 52 0d 00 8a 4f 4b 98 13 4f 98 42 09 fb 6a c8 ce 65 97 dd 23 08 1e a5 d2 36 53 cb 37 a1 7e 5c 9e 02 63 a7 dd 97 Data Ascii: or\Yd7+SP9m3qt&q`c-vY&K>3N^:iODT*;8oe\|(f-rJ;3is%>l+U)<05NZq-BdUt;sQ=lhA3!8d%z9oHVROKOBje#6S7~\c
2024-10-22 07:55:55 UTC	1369	IN	Data Raw: 63 ef f8 41 c2 42 a3 d7 df 68 f5 06 72 71 34 32 af ce f5 d6 ed 90 bf 6b da 14 d5 c7 78 e3 79 94 af 61 b4 18 6a f3 2a 4b 05 34 e4 a2 44 f7 da bf f2 4d f3 fa 4f dd 56 95 0b bf 0f 2d 4c 09 2e d8 17 01 4d f2 d4 c3 0b 53 bc ca d1 48 96 79 f5 46 d5 e2 f8 00 2b 71 c8 eb 57 6f ab 1a 06 bf 0f 2d 4c f5 fa 7f b6 46 fa c2 fd c3 d5 90 66 ab 6a 19 4a 69 3a bd f6 e3 72 5f 6f dd 5e 79 25 ef 79 9a 5c 87 5e 79 78 13 e8 fe e9 91 e1 2e a8 a0 1b d0 04 fd 94 e3 9e 02 3a 74 c8 1a 14 3f 1e 37 68 a1 61 79 d8 6a 5e d5 06 b5 0d cb 59 0d 19 a0 1c d7 b6 c9 9b df d4 01 00 ac 6f 16 52 2e 4f e2 a3 2e 0c c9 40 1a bb 0e 2a 15 f2 fd 00 09 20 19 96 b1 dd d5 a0 77 36 64 b8 21 95 da e8 2a 0d fb 2e c4 a2 00 78 aa 18 94 ac 30 e7 68 68 15 79 69 46 98 0d 59 c5 d2 36 d9 04 70 e5 d6 68 31 08 03 80 Data Ascii: cABhrq42kxyajK4DMOV-L.MSHyF+qWo-LFfjJi:r_o^y%y\^yx.:t?7hayj^YoR.O.@ w6d!*.x0hhyiFY6ph1
2024-10-22 07:55:55 UTC	1369	IN	Data Raw: 57 5e b3 d1 64 1a 2d 78 47 82 fd 0b 2a 94 76 04 3e 17 80 13 64 ad b6 9f e1 c4 cb 0f 80 9d 41 17 cc c6 b3 ec c0 47 6e e5 53 36 1f 5e f1 02 f2 63 2b 09 bc 1f 89 8a c3 54 a1 98 9c ca 04 a8 76 5f 9c 14 3a 6d e4 e2 11 80 19 11 ab 51 a3 53 8f c2 84 be 87 cb ef 6d 5e b1 c4 14 f0 d8 1c 4e a5 cd 67 4e 68 8e 12 93 fc 0b 2d 91 56 28 ad 31 a8 1b d9 a8 24 48 67 8d 1f 38 68 b0 65 87 7a 18 3f 34 8e 8c 8e 20 b1 3e 6d 5e b5 e7 3d 6e 6d 3e c1 6e 3b a3 8d 00 2d 5e 31 30 c4 2b b6 94 e9 f9 54 64 16 95 a5 c9 ae bd dc d8 ea 2d 19 0c 3a 3a c8 0f 40 58 6d 22 f6 f9 05 9a fb 3c 9a 65 65 3b 83 65 3a 20 1a 32 8e 7d 25 f6 bf e6 38 ff 27 c3 29 1e 1c 13 81 4d 5c 04 ee 64 bb 4e ab 6a 1d 34 c5 30 df 40 b7 b2 51 d9 69 5e 95 26 81 64 0e 90 6e 28 a9 1b e4 83 80 9c f1 66 21 19 6e b7 f1 ec e9 Data Ascii: W^d-xG*v>dAGnS6^c+Tv_:mQSm^NgNh-V(1$Hg8hez?4 >m^=nm>n;-^10+Td-::@Xm"<ee;e: 2}%8')M\dNj40@Qi^&dn(f!n
2024-10-22 07:55:55 UTC	1369	IN	Data Raw: 84 41 a0 2e a4 b0 9a 0b 5d ca 3a 34 0d 6f 61 af 9f 46 fd 0d 6a 8a 0f 87 40 a7 15 0d 07 ec f7 9b aa 36 24 29 ac 09 e3 7b 31 88 d0 16 91 34 45 51 61 a4 22 3a 95 49 d0 72 47 a0 1a d0 c4 e6 da 97 04 5c 3a d4 2b 9b 8b 76 80 46 cb fd 9a d0 c8 2f d0 22 40 fe 3f 10 49 a5 53 b6 a9 96 fe 74 ef ab 82 29 d2 8a a9 7c 8a 34 1b 52 ce f6 5d 63 14 d8 a7 8f 01 e7 d8 cb b2 aa 33 10 d3 8d ec 2f 47 b0 25 0c 4e 18 c5 3c 4a 6a d1 0e 65 73 60 89 2d 1f 57 db ad aa 65 c7 cb 08 49 c6 c9 d6 95 67 41 52 10 52 a0 cc 84 d3 3b 50 6a 8d 12 69 a8 c5 bc 66 ce fa 24 9f 42 8f f2 5f 6e 7f d6 79 94 bf db b0 2a ae a2 0e 67 e0 41 93 b3 be d0 55 3f d6 86 75 05 ed c6 a3 ec 77 d9 b7 50 75 33 75 54 dd 8a c0 82 4e f8 3f e4 0a 2c 60 80 dc 56 b8 df a7 5a 26 00 5e a2 bd 59 39 24 8f 56 2d 17 f3 07 73 ed Data Ascii: A.]:4oaFj@6$){14EQa":IrG\:+vF/"@?ISt)\|4R]c3/G%N<Jjes`-WeIgARR;Pjif$B_ny*gAU?uwPu3uTN?,`VZ&^Y9$V-s
2024-10-22 07:55:55 UTC	1369	IN	Data Raw: e6 3a d4 cb 00 19 f3 ca 50 fb 03 70 fb a6 ae 1d 5d d8 34 bd 9e e6 03 1b d0 6d 20 38 74 02 a8 63 92 7d 0f fa fe 95 e1 9c a5 d2 97 0d bf a3 7d 26 c9 0e 44 d8 25 33 50 5c dc 4a 9b a7 a0 d1 bd bd 93 2d 26 f3 0b f0 dd 56 ae 3c b5 ff e3 20 1a 3d 7b 81 3b da eb 5f dc 55 09 5d 1b 2e a3 65 23 70 70 d7 6f 2f 2e ab 7b 71 57 1e e4 36 d6 e9 49 56 8a 3d b1 8e fe e3 61 cc b0 d5 19 74 c0 3c c7 30 29 d8 df c1 fe 8b c6 f3 84 05 16 65 9a a9 08 cd b2 30 9f 49 f7 fa 4b 86 fb fa c1 ef d5 be 3e 2a ad 5b da 1b ab f6 f3 15 59 18 10 8a 76 78 ed 8d be 7c af 7f 91 be 54 be c0 5b 32 cd 28 0f f1 8e bf 4d a8 4a f5 8e 7f 48 a8 06 69 26 0a 7c cd 92 4c 75 0d 8d f1 39 d7 f2 45 b9 82 af 70 f9 a2 be 82 6f f8 f2 45 fd 04 9f ed 7d 4c 52 72 a3 09 f4 27 45 07 83 fd 88 bf 62 5b 9a c8 b5 23 ff 45 Data Ascii: :Pp]4m 8tc}}&D%3P\J-&V< ={;_U].e#ppo/.{qW6IV=at<0)e0IK>*[Yvx\|T[2(MJHi&\|Lu9EpoE}LRr'Eb[#E
2024-10-22 07:55:55 UTC	1369	IN	Data Raw: b5 df a9 ea 93 4a 93 12 b1 9f aa be 97 76 1e 57 08 5e d1 3f 2e ab d2 67 a2 eb 68 79 b2 53 59 af 99 38 79 9e 6a d0 1d 39 5b bc f6 09 d2 9a cf d4 71 37 82 39 b6 d7 2e 15 f5 50 03 36 3d 37 01 1d 39 a5 17 82 2e 1d 6e 56 5c a7 b7 ff 5c f5 c7 82 4e 65 1b 6e 73 c6 3d 7c e4 33 89 90 87 c6 20 5f db 0d 72 7c 17 df 6b df d1 4a b6 b6 d3 e1 79 80 ab f9 51 4e fe 84 c8 27 f5 d0 10 c9 7e 94 1b fe d0 db 1e bb e5 c4 2b 3b 93 5c 96 cf fa fe 55 fc bb b3 de 69 cb d3 64 14 b5 55 3e b6 95 5b 39 2c 36 30 50 cd 80 6b 5d 0d ad 1e a5 b1 68 07 bb ec 04 17 c1 cd a9 02 28 a4 57 e2 16 cb 54 9d b3 61 33 e8 7c 6f eb 70 2a 86 7b b1 1c 0d 0c 3a a8 ce fc e8 40 f2 eb 07 1a e6 e0 a7 41 9d aa 8a 16 09 50 5f ea 4f 6a 3b d4 80 66 85 6c d7 49 cd 65 bb 10 dd 20 80 e7 2d d8 8d af 42 04 95 8d ec 8a Data Ascii: JvW^?.ghySY8yj9[q79.P6=79.nV\\Nens=\|3 _r\|kJyQN'~+;\UidU>[9,60Pk]h(WTa3\|op*{:@AP_Oj;flIe -B
2024-10-22 07:55:55 UTC	1369	IN	Data Raw: 70 49 c3 67 73 38 e1 47 c2 1f 0f 3e 4e c5 bb 99 f8 53 89 8f b3 f1 6e 2e fe dc 2b 05 a7 e4 91 fa cf 1c 5d 04 94 56 5e 59 a4 13 45 a6 c7 36 95 7d ad dd 39 d8 5d 31 65 98 8d 6b a5 a5 5c c0 d6 6d d7 74 ca cb 5a b9 44 bd 80 ae 99 38 03 4e d2 88 cf 7b 80 7b 81 88 ea 66 51 d9 84 2a b1 a4 8c 6b 25 6d fc 7f d0 8b de 59 b2 c0 e4 1b 4c 95 ef 8f 3d 58 49 67 6f ec a7 aa cb 46 67 fd 82 7e 62 e9 41 54 1b a7 e4 a3 fe b5 0e 54 80 08 48 f9 29 c5 f8 b4 0a 9f ce 4f 4a f0 37 7c 95 15 4d f0 0c 0f 7e 30 3f 39 06 53 d2 bc e5 a9 ce de f6 51 e6 13 6f 1c 0c 74 8f 65 54 93 c0 e8 38 1b 91 fc 8d c5 34 3a 17 80 40 2e 3a 50 72 8f d5 fc e8 7f 31 6e 86 66 9b 33 a6 e2 bc eb 15 ea 2f 21 13 de d3 32 2f 5f 2b 7a 3a 82 06 30 73 a0 8e 9c 37 a9 55 57 6a cb c0 48 f3 9c cf 01 64 08 7b 8f 03 fe f1 Data Ascii: pIgs8G>NSn.+]V^YE6}9]1ek\mtZD8N{{fQ*k%mYL=XIgoFg~bATTH)OJ7\|M~0?9SQoteT84:@.:Pr1nf3/!2/_+z:0s7UWjHd{
2024-10-22 07:55:55 UTC	1369	IN	Data Raw: 48 d7 c2 01 c4 42 01 24 fa 51 1e e2 1b fd d8 87 80 57 d1 de d2 26 19 03 08 0c 74 2a cd 68 a3 db ac 5a c6 03 0c c9 0e b3 bb 34 2d bc 65 f7 bd 6e 5c ed 67 4b 13 f3 c3 e4 6e 8b 6a c9 e8 96 35 ea f3 02 03 7b 21 6d ab 00 54 fb cc 90 52 b5 ce ae 18 a2 0b 2e 6b 52 30 60 08 da 38 bc dc 17 51 b5 34 2f 35 0a e3 8d f0 7a a1 05 6a 94 1b f3 1a bf 7f 0b d9 43 d1 56 b8 62 1d 42 e5 b8 f5 68 4b 89 ca 18 f6 f2 26 f2 51 93 f8 7e 8f 8d 6c 1e b7 cd 5e 40 f1 d0 b6 a3 66 56 63 51 43 f6 32 d3 82 ec 64 4f 44 5c f1 c1 31 cd 52 5e cb e3 7b dd b3 35 79 e3 cf d9 be 6c 52 cc 97 4d 42 5f 36 07 5b f9 70 82 2f 9b 66 97 c1 2d 47 3c a8 a5 83 34 1d 8a 3a e1 20 a1 cc 3a 61 fe db c2 43 a5 e9 a2 41 85 34 49 a9 49 6d 2d d4 1a 5a b5 d1 b9 4c 69 29 da b1 56 e8 87 54 2b 5c 4c 0c 70 13 ea 75 cf 6a Data Ascii: HB$QW&t*hZ4-en\gKnj5{!mTR.kR0`8Q4/5zjCVbBhK&Q~l^@fVcQC2dOD\1R^{5ylRMB_6[p/f-G<4: :aCA4IIm-ZLi)VT+\Lpuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49889	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:55:59 UTC	149	OUT	POST /v1/event-stat?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 728
2024-10-22 07:55:59 UTC	728	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 0d 0a 20 20 22 4d 61 63 68 69 6e 65 49 64 22 3a 20 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 0d 0a 20 20 22 49 6e 73 74 61 6c 6c 49 64 22 3a 20 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 0d 0a 20 20 22 56 65 72 73 69 6f 6e 22 3a 20 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 0d 0a 20 20 22 4f 73 56 65 72 73 69 6f 6e 22 3a 20 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 0d 0a 20 20 22 4f 73 42 69 74 22 3a 20 22 36 34 22 2c 0d 0a 20 20 22 50 61 72 74 6e 65 72 49 64 22 3a 20 22 49 4e 32 34 30 34 30 32 22 2c 0d 0a 20 20 22 43 61 6d 70 61 69 67 Data Ascii: {"Data": { "MachineId": "fdd42ee1-88e9-3143-7f4f-be2c09611698", "InstallId": "321bcaa0-1466-4c28-be75-23bfee67d933", "Version": "13.900.0.1080", "OsVersion": "Microsoft Windows 10 Pro", "OsBit": "64", "PartnerId": "IN240402", "Campaig
2024-10-22 07:55:59 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:55:59 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67eda169b06c16-DFW
2024-10-22 07:55:59 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:55:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49895	104.18.27.149	443	5988	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-22 07:56:00 UTC	152	OUT	POST /v1/event-stat-wc?Type=ErrorInstall&ProductID=wc&EventVersion=1 HTTP/1.1 Content-Type: application/json Host: flwadw.com Content-Length: 674
2024-10-22 07:56:00 UTC	674	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 20 7b 22 4d 61 63 68 69 6e 65 49 64 22 3a 22 66 64 64 34 32 65 65 31 2d 38 38 65 39 2d 33 31 34 33 2d 37 66 34 66 2d 62 65 32 63 30 39 36 31 31 36 39 38 22 2c 22 49 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 31 62 63 61 61 30 2d 31 34 36 36 2d 34 63 32 38 2d 62 65 37 35 2d 32 33 62 66 65 65 36 37 64 39 33 33 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 31 33 2e 39 30 30 2e 30 2e 31 30 38 30 22 2c 22 4f 73 56 65 72 73 69 6f 6e 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 22 2c 22 4f 73 42 69 74 22 3a 22 36 34 22 2c 22 50 61 72 74 6e 65 72 49 44 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 50 61 72 74 6e 65 72 49 64 22 3a 22 49 4e 32 34 30 34 30 32 22 2c 22 43 61 6d 70 61 69 67 6e 49 44 22 3a 22 32 30 36 32 32 Data Ascii: {"Data": {"MachineId":"fdd42ee1-88e9-3143-7f4f-be2c09611698","InstallId":"321bcaa0-1466-4c28-be75-23bfee67d933","Version":"13.900.0.1080","OsVersion":"Microsoft Windows 10 Pro","OsBit":"64","PartnerID":"IN240402","PartnerId":"IN240402","CampaignID":"20622
2024-10-22 07:56:00 UTC	479	IN	HTTP/1.1 200 OK Date: Tue, 22 Oct 2024 07:56:00 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin Access-Control-Expose-Headers: Content-Length,Content-Range CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8d67eda6fab94781-DFW
2024-10-22 07:56:00 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 6d 65 73 73 61 67 65 22 3a 22 45 76 65 6e 74 20 70 65 72 73 69 73 74 65 64 22 7d 0d 0a Data Ascii: 1d{"message":"Event persisted"}
2024-10-22 07:56:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:55:09
Start date:	22/10/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0x400000
File size:	545'352 bytes
MD5 hash:	FEF9A20FCD13F76E4656A66A95AE336C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	03:55:09
Start date:	22/10/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe
Wow64 process (32bit):	true
Commandline:	.\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=20622070018 --version=13.900.0.1080
Imagebase:	0x9a0000
File size:	438'936 bytes
MD5 hash:	A27F9713DB1688D03D2082BFA1827803
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe, Author: Joe Security
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	14

Executed Functions

Function 004148D4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 004148FA

Part of subcall function 004157C8: HeapCreate.KERNELBASE(00000000,00001000,00000000,00414932,00000001), ref: 004157D9
Part of subcall function 004157C8: HeapDestroy.KERNEL32 ref: 00415818

GetCommandLineA.KERNEL32 ref: 0041495A
GetStartupInfoA.KERNEL32(?), ref: 00414985
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004149A8

Part of subcall function 00414A01: ExitProcess.KERNEL32 ref: 00414A1E

Strings

`&, xrefs: 00414974

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID: `&
API String ID: 2057626494-1405188806
Opcode ID: d0b0bc6d91067fd433c2cc4b1856fc531dfd5f25a3beb9f48f66dbad23e013fe
Instruction ID: fb65514f2d73941f5fb5fe300876562abb5c146ee9b99336205dd39c2cb12ef3
Opcode Fuzzy Hash: d0b0bc6d91067fd433c2cc4b1856fc531dfd5f25a3beb9f48f66dbad23e013fe
Instruction Fuzzy Hash: BD219EB19407159FDB14EFB6DC46AEE7BB8EF44704F10412FF910AB291DB3C89818A58

Function 00405434 Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405414: FindClose.KERNELBASE(?,000000FF,00405445,000000FF), ref: 0040541F

FindFirstFileW.KERNELBASE(?,?,000000FF), ref: 00405497

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

FindFirstFileA.KERNEL32(?,?,000000FF), ref: 00405467

Part of subcall function 0040551C: __EH_prolog.LIBCMT ref: 00405521

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$FileFirstH_prolog$Close
String ID:
API String ID: 3335342080-0
Opcode ID: 01ff4a9bc94c78cd279a0d863a54892268cf469c718bfc53d66ce16def007dff
Instruction ID: 44fa9ff84b7e7cb6f1e8d7f9ea47a8a098aa0700a3472251c04f15a334366322
Opcode Fuzzy Hash: 01ff4a9bc94c78cd279a0d863a54892268cf469c718bfc53d66ce16def007dff
Instruction Fuzzy Hash: 33014830401505ABCF20AF64DC456EE7779DF51329F20827AE855672D1D73C9A85CF98

Function 00401014 Relevance: 48.0, APIs: 8, Strings: 19, Instructions: 715
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401A7B: GetVersionExA.KERNEL32(?), ref: 00401A95

GetCommandLineW.KERNEL32(00000003,00000003,00000003,00000003,?,00000000), ref: 0040108B

Part of subcall function 004038D7: __EH_prolog.LIBCMT ref: 004038DC

Part of subcall function 0040460B: __EH_prolog.LIBCMT ref: 00404610
Part of subcall function 0040460B: GetModuleFileNameA.KERNEL32(00400000,?,00000105,00000000,00000000), ref: 00404649

Part of subcall function 0040237B: __EH_prolog.LIBCMT ref: 00402380

Part of subcall function 00402340: __EH_prolog.LIBCMT ref: 00402345

Part of subcall function 00403DE4: __EH_prolog.LIBCMT ref: 00403DE9

MessageBoxW.USER32(00000000,?,?,00000010), ref: 004015DE
ShellExecuteExA.SHELL32(0000003C,?,00000001,?,?,00000003,?,00000003,00420240,;!@InstallEnd@!,?,00000003,00000000,00000002,00420278,00000003), ref: 004016D5
MessageBoxW.USER32(00000000,?,?,00000024), ref: 004012FF

Part of subcall function 00410EC0: MessageBoxW.USER32(00000000,?,7-Zip,00000010), ref: 00410EC9

Part of subcall function 00402EFE: __EH_prolog.LIBCMT ref: 00402F03

CloseHandle.KERNEL32(?,?,00000000), ref: 004019A8
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 004019C7
CloseHandle.KERNEL32(?,?,00000000), ref: 004019CE

Strings

Can not create temp folder archive, xrefs: 004014DD
Config failed, xrefs: 004011F7
ExecuteParameters, xrefs: 0040141A
Can't load config info, xrefs: 00401185
Can not find setup.exe, xrefs: 004017DB
RunProgram, xrefs: 0040139A
Directory, xrefs: 004012A2
;!@Install@!UTF-8!, xrefs: 00401172
Can not load codecs, xrefs: 00401529
Title, xrefs: 0040120B
setup.exe, xrefs: 004017B9
<, xrefs: 0040166A
, xrefs: 004016DB
;!@InstallEnd@!, xrefs: 0040116D
%%T\, xrefs: 00401803
%%T, xrefs: 00401832
Can not open file, xrefs: 004016ED
ExecuteFile, xrefs: 004013DA
D, xrefs: 00401886

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$Message$CloseHandle$CommandExecuteFileLineModuleNameObjectShellSingleVersionWait
String ID: $%%T$%%T\$;!@Install@!UTF-8!$;!@InstallEnd@!$<$Can not create temp folder archive$Can not find setup.exe$Can not load codecs$Can not open file$Can't load config info$Config failed$D$Directory$ExecuteFile$ExecuteParameters$RunProgram$Title$setup.exe
API String ID: 785510900-2114487665
Opcode ID: 20e8c7a8f7e6940306f3fdf478fc142a0ef1d370bcf065af3063073fbf025805
Instruction ID: f92d1a5b025e5f1856d93d01be2b226abe75c3e6546c85d9ed47549f0c040395
Opcode Fuzzy Hash: 20e8c7a8f7e6940306f3fdf478fc142a0ef1d370bcf065af3063073fbf025805
Instruction Fuzzy Hash: 485228719002199ACF25EFA5DC82AEDBB75AF04308F1040BFE156721F2DA395B86CF58

Function 0040AB05 Relevance: 14.2, APIs: 9, Instructions: 682
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040AB0A

Part of subcall function 0040D5A3: __EH_prolog.LIBCMT ref: 0040D5A8

Part of subcall function 004130E0: InitializeCriticalSection.KERNEL32(?,?,?,00000000,00000000), ref: 0041310E

DeleteCriticalSection.KERNEL32(?), ref: 0040AD3E
DeleteCriticalSection.KERNEL32(?), ref: 0040AFCB
DeleteCriticalSection.KERNEL32(?), ref: 0040B036
DeleteCriticalSection.KERNEL32(?), ref: 0040B093
DeleteCriticalSection.KERNEL32(?), ref: 0040B1A2
DeleteCriticalSection.KERNEL32(?), ref: 0040B1FC
DeleteCriticalSection.KERNEL32(?,?,?,00000004,00000004), ref: 0040B271
DeleteCriticalSection.KERNEL32(?), ref: 0040B303

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$Delete$H_prolog$Initialize
String ID:
API String ID: 3452124646-0
Opcode ID: dea6bec7755b29b7e46bcd3bec54f2d253f19e881b251d9b3d1cd047beedd60e
Instruction ID: 4c9a54a47b38b58bbaef36bcc828af5c6ca02983ed7c574d3216c54edcd042c8
Opcode Fuzzy Hash: dea6bec7755b29b7e46bcd3bec54f2d253f19e881b251d9b3d1cd047beedd60e
Instruction Fuzzy Hash: FC627E7090024ADFDB14DFA5C944BDEBBB4FF14308F1080AEE805B7291DB789A49DB99

Function 004051B7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 004051C5
GetTickCount.KERNEL32 ref: 004051D0
GetCurrentProcessId.KERNEL32(?,00000000,?,?,00405334,?,00000000,?,00000003,00000003,00000000,00000000,00000003,?,00000000), ref: 004051DB
GetTickCount.KERNEL32 ref: 00405240
SetLastError.KERNEL32(000000B7,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00405273
GetLastError.KERNEL32(00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00405299

Part of subcall function 004049F4: CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A13

Strings

d, xrefs: 004052AE
.tmp, xrefs: 00405257

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CountCurrentErrorLastTick$CreateDirectoryProcessThread
String ID: .tmp$d
API String ID: 3074393274-2797371523
Opcode ID: 2fda1539db0041318063c64b288010cc5c4c3aedaa5e381c7d8f696092406eab
Instruction ID: 4fab17955b769304b7d1cf71853489b42ead9ac2cf2e2055059d54e7646dac87
Opcode Fuzzy Hash: 2fda1539db0041318063c64b288010cc5c4c3aedaa5e381c7d8f696092406eab
Instruction Fuzzy Hash: CC31C1326506009BDB10ABA098897EF7760EFA5315F14807FE902BB2D2D77C9842CF99

Function 00404908 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000078,.@,00000000,00402AB0,00000000,?,?,?,?), ref: 00404918
CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,?,.@,00000000,00402AB0,00000000,?,?,?,?), ref: 00404934
SetFileTime.KERNELBASE(00000000,00000000,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000,?,.@,00000000,00402AB0,00000000), ref: 0040494B
CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,?,.@,00000000,00402AB0,00000000,?,?,?), ref: 00404957

Strings

.@, xrefs: 00404911

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID: .@
API String ID: 2291555494-2582305824
Opcode ID: 134b82ee1bee937397c61f831c6e8a998fcbb54d8f51f8998ece3d2421389dbd
Instruction ID: b13e78268552c33248838deebc4f257ca571263cc4fefdaa9dfe176c52576776
Opcode Fuzzy Hash: 134b82ee1bee937397c61f831c6e8a998fcbb54d8f51f8998ece3d2421389dbd
Instruction Fuzzy Hash: 66F0E2B12812107BE2201B74BC48F9B6E5CDBCA715F108135B661A21E0C3284D19D7B8

Function 004083AB Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004083B0

Strings

Unknown error, xrefs: 00408671, 00408676
X3B, xrefs: 004086A4

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID: Unknown error$X3B
API String ID: 3519838083-1496835351
Opcode ID: 47f253f86f2cbe6f5ea7b7729e7e95f0c02779c145a6591478a86d185b5344b5
Instruction ID: 10ffca09dccd2053a4a89f972bfe6bbc607f2b880b0d523777cfa28ffc571443
Opcode Fuzzy Hash: 47f253f86f2cbe6f5ea7b7729e7e95f0c02779c145a6591478a86d185b5344b5
Instruction Fuzzy Hash: 89D16070900219EFCF05DFA4C984ADEBB74BF48304F14846EE846BB2D1DB78AA45CB95

Function 00405620 Relevance: 4.6, APIs: 3, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00405625

Part of subcall function 00405434: FindFirstFileA.KERNEL32(?,?,000000FF), ref: 00405467

GetLastError.KERNEL32(?,?,00000000,?,00000001), ref: 00405653

Part of subcall function 00405414: FindClose.KERNELBASE(?,000000FF,00405445,000000FF), ref: 0040541F

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Find$CloseErrorFileFirstH_prologLast
String ID:
API String ID: 364955512-0
Opcode ID: e39f0d4d85096f3cd882782c1d04852b930387ce9b142e76bb949cb0f7f9728b
Instruction ID: 04b13d9487752735ca5a27f2fc382c225ef0a6c39b2ce108fc8834fd1c85259b
Opcode Fuzzy Hash: e39f0d4d85096f3cd882782c1d04852b930387ce9b142e76bb949cb0f7f9728b
Instruction Fuzzy Hash: F0418E36900519AACF14FBA5D942AEFBB75EF14308F10403AE412772E1DB795E41DEA8

Function 00406F68 Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00406F6D
EnterCriticalSection.KERNEL32(00000000,?,?,?,00406FF7,?,?,?,?,?), ref: 00406F7E
LeaveCriticalSection.KERNEL32(00000000,?,?,?,00406FF7,?,?,?,?,?), ref: 00406FB2

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID:
API String ID: 367238759-0
Opcode ID: 07f6c1fd103800f188fec5f91ab3bb47b81eb91ba650842d040f77beb3819d41
Instruction ID: 97c3a8bfcec3db19a0bb52fb413a425f8ec3aea0187b5ae5e4fa4e2c7e55e4ea
Opcode Fuzzy Hash: 07f6c1fd103800f188fec5f91ab3bb47b81eb91ba650842d040f77beb3819d41
Instruction Fuzzy Hash: 4C013C76A00214EFCB118F94DC08B9ABBB9FF48755F11886AFD16E7250C7B4A910DFA4

Function 0040280E Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00402813

Part of subcall function 00402D81: EnterCriticalSection.KERNEL32(?,?,?,00409336), ref: 00402D86
Part of subcall function 00402D81: LeaveCriticalSection.KERNEL32(?,?,?,?,00409336), ref: 00402D90

Strings

.@, xrefs: 00402A17, 00402C0B, 00402C67

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID: .@
API String ID: 367238759-2582305824
Opcode ID: cedc18b6d8ddfe7347772caf672a5f70dce2edf6ac44908b4b815bcfdd64f500
Instruction ID: fb4838387da9abac6519c3a0e173b295c4de01f89ec6b6ed0d4ee3fc8d60aaac
Opcode Fuzzy Hash: cedc18b6d8ddfe7347772caf672a5f70dce2edf6ac44908b4b815bcfdd64f500
Instruction Fuzzy Hash: F3F1DF70900248DFCF14EFA5C985ADEBBB4AF54308F10807EE446B72E1DB785A85DB19

Function 004030FC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00403101

Part of subcall function 00405620: __EH_prolog.LIBCMT ref: 00405625

Part of subcall function 00404A3E: __EH_prolog.LIBCMT ref: 00404A43

Part of subcall function 004092E6: __EH_prolog.LIBCMT ref: 004092EB

Strings

Default, xrefs: 00403213

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID: Default
API String ID: 3519838083-753088835
Opcode ID: 0fc91ddac6c1b16fe72a6cc7b41e2781a7216c9bd00a9ca8bd5645336c638fb0
Instruction ID: 203c82e13c85383a660d5cb73dbb10af46e9aa8c77eacbcc0267a4e11568a844
Opcode Fuzzy Hash: 0fc91ddac6c1b16fe72a6cc7b41e2781a7216c9bd00a9ca8bd5645336c638fb0
Instruction Fuzzy Hash: E4514E75900209EFDB14EFA5D8819EEBBB8FF18308F00456EE556772D1DB38AA06CB14

Function 00404A3E Relevance: 3.2, APIs: 2, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00404A43
GetLastError.KERNEL32(?,?,?,00000000), ref: 00404ACB

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID:
API String ID: 1057991267-0
Opcode ID: cf2054507fd1ee53753d2eae408e5b803be4a538542d8802e2091fe77905cd97
Instruction ID: 397979b183d08822f23b565ee303c4952bc02ec102e27be1c48eee89bea9c2ad
Opcode Fuzzy Hash: cf2054507fd1ee53753d2eae408e5b803be4a538542d8802e2091fe77905cd97
Instruction Fuzzy Hash: 1E5105719441099ACF10EBA5C942AFEBB75AF91308F11017FE602731E1DB3DAE46CB99

Function 00408755 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040875A
GetLastError.KERNEL32(?,00000000,?,?,00000000,?,?,0040893F,?,?,00000000,004149B4,?,?,?,00000000), ref: 004087E8

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorH_prologLast
String ID:
API String ID: 1057991267-0
Opcode ID: 3fff607fbbb18c810b60b5715c755df2af7f02dc56ee627f626541e13130f925
Instruction ID: 0128b321cd566d1ceb50e896689a501b942dab3b414a73cd3b5e456030195100
Opcode Fuzzy Hash: 3fff607fbbb18c810b60b5715c755df2af7f02dc56ee627f626541e13130f925
Instruction Fuzzy Hash: EE317C719012499FCB10DF95CE849AEBBB0FF44314B24817FE496B7292CB388D40DB69

Function 0041468E Relevance: 3.0, APIs: 2, Instructions: 45
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416CCC: RtlAllocateHeap.NTDLL(00000008,?,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00416DC2

CreateThread.KERNELBASE(00000000,00000003,004146F9,00000000,00000000,?), ref: 004146CF
GetLastError.KERNEL32(?,?,?,00413009,00000000,00000000,004032CA,?,00000000,00000000,?,00402FAB,?,00000000,?), ref: 004146D9

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocateCreateErrorHeapLastThread
String ID:
API String ID: 3346699961-0
Opcode ID: cec5c64bb062ebc125788ebde052a3221cd8e292eb447cdba6d28e4e36d824ba
Instruction ID: 928dc59a5e1d7113ba94efa25a55b36d47ae035f635b84aed830f8a2a3c61c12
Opcode Fuzzy Hash: cec5c64bb062ebc125788ebde052a3221cd8e292eb447cdba6d28e4e36d824ba
Instruction Fuzzy Hash: D6F02D362006156BCB209F66EC019DB3BA5EF81375F10402EF958C2290DF3DC8914BAC

Function 00405892 Relevance: 3.0, APIs: 2, Instructions: 45
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405905: CloseHandle.KERNELBASE(00000000,000000FF,004058A0,?,?,00000000), ref: 00405910

CreateFileW.KERNELBASE(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004058EF

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

CreateFileA.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004058CB

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateFile$CloseH_prologHandle
String ID:
API String ID: 449569272-0
Opcode ID: 34b674e9a04a5ff3e8c8923f5916708bcc46c4f31befc859c171c75614de22e6
Instruction ID: 7cb04d8d1853a58e30318ad4c29bda14cf4b58fee7e46fc4002fe1391b6e6e2b
Opcode Fuzzy Hash: 34b674e9a04a5ff3e8c8923f5916708bcc46c4f31befc859c171c75614de22e6
Instruction Fuzzy Hash: 4F01287240020AFFCF11AFA4DC45C9B7F6AEF08364B10853AF991661A1D73699A1EF94

Function 00404965 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,?,00000003,?,00000000), ref: 0040499C

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

SetFileAttributesA.KERNEL32(?,00000000,?,00000003,?,00000000), ref: 00404985

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AttributesFile$H_prolog
String ID:
API String ID: 3790360811-0
Opcode ID: 5366c93646a32060bc4a1fe11ea500c12b8b92d1211a98e2b8e7846322785de3
Instruction ID: f078d443d6654451da1bdd33dee3a4941b810ca2709c1c0422ffd448cadfd8b3
Opcode Fuzzy Hash: 5366c93646a32060bc4a1fe11ea500c12b8b92d1211a98e2b8e7846322785de3
Instruction Fuzzy Hash: 12E0E5B19002106BCB302B749C08AD73F6CCB82314B108177E816B72D0DA388E06C6D9

Function 004049F4 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A2C

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A13

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateDirectory$H_prolog
String ID:
API String ID: 2325068607-0
Opcode ID: a1e0d02f5bfc64bfc09281de4819c2c8931d1b3daee1640bd6a36795e0d5f738
Instruction ID: e8b418caba4fa0c83fd0f6cce2293bab18ef6c4fa53c548cc4c0ebfda5fe1645
Opcode Fuzzy Hash: a1e0d02f5bfc64bfc09281de4819c2c8931d1b3daee1640bd6a36795e0d5f738
Instruction Fuzzy Hash: 3CE0E570B002006BDB206B64AC05B977B68CB41709F104176E902F71D0DA78DE01DA9C

Function 004157C8 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00414932,00000001), ref: 004157D9

Part of subcall function 00415680: GetVersionExA.KERNEL32 ref: 0041569F

HeapDestroy.KERNEL32 ref: 00415818

Part of subcall function 00415825: HeapAlloc.KERNEL32(00000000,00000140,00415801,000003F8), ref: 00415832

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 0d18dfc85a1640e6673d81f03e6c6359104a03ea7de3319d0e450716895a192f
Instruction ID: ed3d0d0d9fb025b00032fbfed5580f0a7fafafb3549905f7ec75d8b7e0a93aa3
Opcode Fuzzy Hash: 0d18dfc85a1640e6673d81f03e6c6359104a03ea7de3319d0e450716895a192f
Instruction Fuzzy Hash: 6CF06530A54B01EEDF207B706C867EA2B90EB84795F60483BF401D81A0EB7884D1D659

Function 00405970 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 0040598B
GetLastError.KERNEL32(?,?,?,?), ref: 00405999

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 4eb004f5f0e538f15da8fb4a4b1192dc0e26d9ca4b62000b247bbe798b79ae76
Instruction ID: b27308c8a3af6e3091502473baf333c9532b4c6e1f366657fcb3ad1a7c3590d9
Opcode Fuzzy Hash: 4eb004f5f0e538f15da8fb4a4b1192dc0e26d9ca4b62000b247bbe798b79ae76
Instruction Fuzzy Hash: 93F0B7B4500208EFDF04CF94D9458AE7BB5EF49364B208169F815E7390D7359E00DFA9

Function 00404F2C Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,?,00000000), ref: 00404F62

Part of subcall function 00403B85: __EH_prolog.LIBCMT ref: 00403B8A

SetCurrentDirectoryA.KERNEL32(00000000,00000000,?,00000000), ref: 00404F48

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CurrentDirectory$H_prolog
String ID:
API String ID: 3531555294-0
Opcode ID: 37bd0973ac103fd303293487a19168a5ccebfcf95a8c4f288a103cb7951a30b5
Instruction ID: 9edf083e53dd0555a3085cbe496080ff7240eda39e21aa363a26468641b3ea5b
Opcode Fuzzy Hash: 37bd0973ac103fd303293487a19168a5ccebfcf95a8c4f288a103cb7951a30b5
Instruction Fuzzy Hash: 75E02630B400093FDF112F78EC4A9AA3BB89B40309F10427AB403E20E1EF38CA48CA48

Function 0040B98F Relevance: 2.0, APIs: 1, Instructions: 515COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040B994

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a11c13ecc7348690c9950298e9b4123e17515457bca919a0a6ec543c4fca9b97
Instruction ID: 4fbed39282daa38b1d3be95d0829f5567439209fdd6a1d56e89862dfcbe45c3a
Opcode Fuzzy Hash: a11c13ecc7348690c9950298e9b4123e17515457bca919a0a6ec543c4fca9b97
Instruction Fuzzy Hash: 05324B70904249DFDB10DFA8C584BDEBBB0AF58304F1441AEE845B7382DB78AE45CB99

Function 0040EB99 Relevance: 2.0, APIs: 1, Instructions: 500COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040EB9E

Part of subcall function 0040E770: __EH_prolog.LIBCMT ref: 0040E775

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 93af7643a127ff2c8fcf7066a9c121e1979c0be22eb581a0e33d5eb75e035ebc
Instruction ID: 765616d13d330a71392781af4293cea344630bd2be9376268a28767dce44cac6
Opcode Fuzzy Hash: 93af7643a127ff2c8fcf7066a9c121e1979c0be22eb581a0e33d5eb75e035ebc
Instruction Fuzzy Hash: F6325C70900249DFCB24DFA5C880BEEBBB5BF55308F14847ED549B7282DB386A89CB55

Function 0040888F Relevance: 1.9, APIs: 1, Instructions: 374COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408894

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f8f61f009d3daf8c2db6a732b574bcd6eafb3dea196858b7c2c201f5376d76a6
Instruction ID: dff2ad87a4df39db6f8fa6ff6a697358cee08fb6a23258ae47e5232e80a59da3
Opcode Fuzzy Hash: f8f61f009d3daf8c2db6a732b574bcd6eafb3dea196858b7c2c201f5376d76a6
Instruction Fuzzy Hash: FFE16E70904249DFDF10DFA4C988AAEBBB4AF48314F2444AEE556F7391CB389E45CB25

Function 0040E7F4 Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E7F9

Part of subcall function 0040F836: __EH_prolog.LIBCMT ref: 0040F83B

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4ed558b650c164779cc9b57daec31bf164f2a891cd885c72c4fce8c115d9c0a5
Instruction ID: 639e188e3e769c4c76ba7ddc7be71c767d86a570cac8f7036ff280b2304c1e48
Opcode Fuzzy Hash: 4ed558b650c164779cc9b57daec31bf164f2a891cd885c72c4fce8c115d9c0a5
Instruction Fuzzy Hash: 5DC13670900259DFDB14DFA5C985BDEBBB4BF14308F1480AEE945B7282CB786A48CF65

Function 0040F449 Relevance: 1.7, APIs: 1, Instructions: 207COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F44E

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9b629b237c488f6570121b27c448209f08593b0ec605445137fe85d2b2ac4caf
Instruction ID: 37dc011919f3b1358f9a833e213d0996983958fb9ee029613f358e4c9ba25a45
Opcode Fuzzy Hash: 9b629b237c488f6570121b27c448209f08593b0ec605445137fe85d2b2ac4caf
Instruction Fuzzy Hash: 3C815C70E00605ABCB24DFA5C881AEEFBB1BF48304F14453EE445B3791D739A949CB99

Function 00408D5E Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408D63

Part of subcall function 00408F0B: __EH_prolog.LIBCMT ref: 00408F10

Part of subcall function 00402635: __EH_prolog.LIBCMT ref: 0040263A

Part of subcall function 00403981: __EH_prolog.LIBCMT ref: 00403986

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bcf0b27f7940fdf4ab6ab46148421c4db8d9215ceab31526f7f4e6d2df862243
Instruction ID: 2e5fef73c4a961ecd91826de13bda49669b7ee5ae1afd1ab178ba291f64b6413
Opcode Fuzzy Hash: bcf0b27f7940fdf4ab6ab46148421c4db8d9215ceab31526f7f4e6d2df862243
Instruction Fuzzy Hash: E5516D7190060AEFCF11DFA5C984A9EBBB4BF08314F10462EE556B72D1CB789A45CFA4

Function 0040DB62 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040DB67

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6102bc3ab49ae424949eee4761875b821dd30f392df23a536a372274e60046df
Instruction ID: 67e57bbcfb5e62c28ba97e2c762051c7e2fb602a8ee489b014dcb5d1e96c76cd
Opcode Fuzzy Hash: 6102bc3ab49ae424949eee4761875b821dd30f392df23a536a372274e60046df
Instruction Fuzzy Hash: DA419EB1E042059BEB14DF99C985ABEB7B5FF48304F14453EE402B7381D7B8A945CBA8

Function 0040CD84 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CD89

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 305c79b04e93cb02db0d94eb430663c97d837b050eba01e1428f85ec3b32050d
Instruction ID: 716710645470f9cf712b82a1641bf3e3a23618a4fc30be00c3c641d866b01c52
Opcode Fuzzy Hash: 305c79b04e93cb02db0d94eb430663c97d837b050eba01e1428f85ec3b32050d
Instruction Fuzzy Hash: 3151C531804146DFCB15CB68C4D4AEE7771EF48348F14827BE8167B2D2D6399A06DBEA

Function 00401B11 Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401B16

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4a7b8dc75b00dab3078b6f2c0b685c16519ae0cc3006f02a661cb725d39e4b70
Instruction ID: dc66995ee082b2e59fd72de07b50a9d1ecefa8465c91578acc64d6d85ae5b981
Opcode Fuzzy Hash: 4a7b8dc75b00dab3078b6f2c0b685c16519ae0cc3006f02a661cb725d39e4b70
Instruction Fuzzy Hash: 7A51D071C042499FDF21DFA4C940BEEBBB4AF05394F14416AE851732E2E7789A41CB68

Function 00402EFE Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402F03

Part of subcall function 0040335F: __EH_prolog.LIBCMT ref: 00403364

Part of subcall function 004034CC: __EH_prolog.LIBCMT ref: 004034D1

Part of subcall function 00403086: __EH_prolog.LIBCMT ref: 0040308B
Part of subcall function 00403086: ShowWindow.USER32(004149B4,00000001,000001F4,00000000,?,?,00000000,00000003,00000000,00000000), ref: 004030E4

Part of subcall function 00412FB0: CloseHandle.KERNEL32(00000000,00000000,0040301E,?,?,00000000,00000003,?,00000000,?,?,00000003,00000000,00000000), ref: 00412FBA
Part of subcall function 00412FB0: GetLastError.KERNEL32(?,00000003,00000000,00000000), ref: 00412FC4

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$CloseErrorHandleLastShowWindow
String ID:
API String ID: 2740091781-0
Opcode ID: 435d4de2c910343181235d516f57e862e2f77dc60e703a2f4f1f759955e8b0df
Instruction ID: 576321bfec054c9ee934bf83a6d4a944d332aa9064831fab6676e01313dc7821
Opcode Fuzzy Hash: 435d4de2c910343181235d516f57e862e2f77dc60e703a2f4f1f759955e8b0df
Instruction Fuzzy Hash: FF419C71900248DBCB11EFA5C991AEDBBB4AF04304F1080BFE90AB72D2DA785B45CB59

Function 00416CCC Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 92b4faeaac62a11c55726f20cbc86f997f13f42f024e800a303f467701001e9d
Instruction ID: f2acf3a48da84c562062ad1c6646dc126276902ed4d81f34dbf0f6df9bf8b06c
Opcode Fuzzy Hash: 92b4faeaac62a11c55726f20cbc86f997f13f42f024e800a303f467701001e9d
Instruction Fuzzy Hash: F631A371E00618EBCF20AF99AC816DEB774FB05764F12422FE825B62D0C77C98C18A5C

Function 0040C557 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C55C

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 039900a8d840d8f65cf18cf377fd5bff5d9e595a8fad608146d0eb9be483e555
Instruction ID: 41554ca9dc53ee1e5d6d797d633c48513fe02739bc2a4d97afccdd4c6a3ff44e
Opcode Fuzzy Hash: 039900a8d840d8f65cf18cf377fd5bff5d9e595a8fad608146d0eb9be483e555
Instruction Fuzzy Hash: 89416C71A00645DFCB24CF68C48486ABBF1FF48314B244AAED096AB791C731ED46CF91

Function 0040CF82 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CF87

Part of subcall function 0040F6E0: __EH_prolog.LIBCMT ref: 0040F6E5

Part of subcall function 0040D0A6: __EH_prolog.LIBCMT ref: 0040D0AB

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 247e6e783af1532b670e604df5ee4666ee67329ca8b2db34e45a1f618534d241
Instruction ID: 59bb91874275df73172cd70bf395014d1b371f9bee4586dc4e729df687399cc5
Opcode Fuzzy Hash: 247e6e783af1532b670e604df5ee4666ee67329ca8b2db34e45a1f618534d241
Instruction Fuzzy Hash: 87319630D01248DFCB11DFA9C548BEDBBB5AF15308F14406EE8457B381C7789A49DB66

Function 004061BF Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004061C4

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e5e892bd4f2dea64c0cb8d9120272725db7c3bac4477bec6e08c9f5bde4bc1f1
Instruction ID: a24cbab5944e5cd80d4d0b45cab95027a2511e7323fd1c0fe5e5f9bfcab47c11
Opcode Fuzzy Hash: e5e892bd4f2dea64c0cb8d9120272725db7c3bac4477bec6e08c9f5bde4bc1f1
Instruction Fuzzy Hash: 97218F71A05246DBCB24FFA5C44046FB7A1AB4130472285BFE053772C1C738AE61CB6A

Function 00413C73 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 00413D5A

Part of subcall function 004154DA: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415517
Part of subcall function 004154DA: EnterCriticalSection.KERNEL32(?,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415532

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: cdeed90e400f99c9328ec8b59033d7a90e074e0a5ab5361bfbc3574a04fde8a1
Instruction ID: 026ee179866774db734838c78619ddc809868a86b22b68076f663e2312d1f49b
Opcode Fuzzy Hash: cdeed90e400f99c9328ec8b59033d7a90e074e0a5ab5361bfbc3574a04fde8a1
Instruction Fuzzy Hash: D4219772A00605EBDB10DF69EC42BDA7764FB00765F20411BF421EB6D0D77CAAC28A9C

Function 00413D6F Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,00000000,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074), ref: 00413E43

Part of subcall function 004154DA: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415517
Part of subcall function 004154DA: EnterCriticalSection.KERNEL32(?,?,?,00416D82,00000009,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00415532

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapInitialize
String ID:
API String ID: 641406236-0
Opcode ID: 841176424f551508ca039d1f5d574a0052902f767b8dc575c65ddda1a9f22b4e
Instruction ID: 5a14261a50f2f4ae8fe925cd7ff68077a924e970bbdc1eb83d0c2eed9fb11c58
Opcode Fuzzy Hash: 841176424f551508ca039d1f5d574a0052902f767b8dc575c65ddda1a9f22b4e
Instruction Fuzzy Hash: 2421C272901705FADB10AF96DC02BDE7BB8EB04725F24012BF414B21C0D77C9AC08AA9

Function 004052CF Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004052D4

Part of subcall function 004050EE: __EH_prolog.LIBCMT ref: 004050F3
Part of subcall function 004050EE: GetTempPathA.KERNEL32(00000105,?,00000000,?,00000000), ref: 00405127

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$PathTemp
String ID:
API String ID: 3652545363-0
Opcode ID: 1ef5fa40e20091595c8a07c7add8e04f0ea87ba7b14c6b9ab7bd2a47fc7370d7
Instruction ID: 884fa5787797a708672a5e156f09df22a5f972d3b51e26f7068c24b8b673b68a
Opcode Fuzzy Hash: 1ef5fa40e20091595c8a07c7add8e04f0ea87ba7b14c6b9ab7bd2a47fc7370d7
Instruction Fuzzy Hash: 5211A3759401059ACF00EFA5C552AEFBBB8EF95348F14402FE841732D1C7B90A49DE54

Function 00409DFC Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409E01

Part of subcall function 004099F1: __EH_prolog.LIBCMT ref: 004099F6

Part of subcall function 00409A39: __EH_prolog.LIBCMT ref: 00409A3E

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e2be988a2ed4eac1d18d94ffb3dcbee280352d40f72ce7d9b7b55f505c73744e
Instruction ID: 728224cdcdeea9a50de84ff331f734dd83e0a6071a74e90d77f9a4778d081c57
Opcode Fuzzy Hash: e2be988a2ed4eac1d18d94ffb3dcbee280352d40f72ce7d9b7b55f505c73744e
Instruction Fuzzy Hash: 931182B0A01254DADB09EBAAC1153DDFBF59FA1318F54415F9552732C2CBF82B0487A6

Function 00409070 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409075

Part of subcall function 00402635: __EH_prolog.LIBCMT ref: 0040263A

Part of subcall function 00405620: __EH_prolog.LIBCMT ref: 00405625

Part of subcall function 00413B0D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413B3B

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog$ExceptionRaise
String ID:
API String ID: 2062786585-0
Opcode ID: 17dae63e629c91cb1e915b62325b494edd8ae92648c1e9e6482c4593510b450f
Instruction ID: c87fc69b1ce411278b5c4cd36917e57d7785db396d8ca4da128de4c157d2198f
Opcode Fuzzy Hash: 17dae63e629c91cb1e915b62325b494edd8ae92648c1e9e6482c4593510b450f
Instruction Fuzzy Hash: 1601D2B5A402049ECB10EF26C451ADEBBB1FF84314F10852FE896A32E1CB796649CB54

Function 004027A7 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004027AC

Part of subcall function 004049F4: CreateDirectoryA.KERNEL32(?,00000000,00000000,00000000,?,00000000,?,?,00405334,?,00000000,?,00000003), ref: 00404A13

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CreateDirectoryH_prolog
String ID:
API String ID: 3554458247-0
Opcode ID: 1d6ed87279fcce4dfaa36ce39d8da3d177537eb6a1ece7d61f11b0fb4062048b
Instruction ID: aa96bd448e9fa33173a2259148c0e22656dcd3e9b7c7d25cba760d9f6e75f00f
Opcode Fuzzy Hash: 1d6ed87279fcce4dfaa36ce39d8da3d177537eb6a1ece7d61f11b0fb4062048b
Instruction Fuzzy Hash: 55F03C729005069BCB05EB5AC8429EEBBB5EF94308F10403FE152775E2DA786986DB94

Function 00406297 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040629C

Part of subcall function 004061BF: __EH_prolog.LIBCMT ref: 004061C4

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6c2e6a82ad44a3596cf000a5615c5b739901b0aaac1cec813de11ba17f646bcd
Instruction ID: d002f29cd99a7d9c36b9a014c837f136803fcb54798139eb5382dd41199f51d8
Opcode Fuzzy Hash: 6c2e6a82ad44a3596cf000a5615c5b739901b0aaac1cec813de11ba17f646bcd
Instruction Fuzzy Hash: 2BF03A72A00218EFDB15DF94CC01BEEB779FB48315F10816AB422E72D0C7798A10CB14

Function 0040C96C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C971

Part of subcall function 0040C9E3: __EH_prolog.LIBCMT ref: 0040C9E8

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 97d13476a1578dbbb8b7321e23e8bd518515a52fd3c7649a69e8943f484a5e8b
Instruction ID: 180fbe891bab88941c19a906eef3a01802dada044b7360aafa1ebd8752043cfb
Opcode Fuzzy Hash: 97d13476a1578dbbb8b7321e23e8bd518515a52fd3c7649a69e8943f484a5e8b
Instruction Fuzzy Hash: 66F0FCB0911640DEC719EB74D1153DDFBB4AF55308F50419E9956736C2CFB81708C765

Function 0040A54A Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A54F

Part of subcall function 0040A5D9: __EH_prolog.LIBCMT ref: 0040A5DE

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d8805e27eeb942700c1eb76102a6c0285398587c05a30b707de990f650fa90d7
Instruction ID: fef1742e57798b56b1d4fc7713b7e996aea94f2a6c39cc2131b70cb4ddbfac94
Opcode Fuzzy Hash: d8805e27eeb942700c1eb76102a6c0285398587c05a30b707de990f650fa90d7
Instruction Fuzzy Hash: A8E09271A00215FFCB48EF689802A9D7AE5AB09314F10823FB022F32C0DF784E00879D

Function 0040F7B7 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F7BC

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 088fd97f6fc5847c45be180ca84b51a63f3bbfcbd59c111394970e536e4fce29
Instruction ID: ac64c31c834abe54e412618b162bf05c7167bd146dfe5a37d1803cc4d2d3be92
Opcode Fuzzy Hash: 088fd97f6fc5847c45be180ca84b51a63f3bbfcbd59c111394970e536e4fce29
Instruction Fuzzy Hash: 94E012B1A00155ABCB58EF69D80669DBAA5AB09318F10863FB026F36C1DB784A418B59

Function 00409DA0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409DA5

Part of subcall function 00409917: __EH_prolog.LIBCMT ref: 0040991C

Part of subcall function 0040A54A: __EH_prolog.LIBCMT ref: 0040A54F

Part of subcall function 00409DFC: __EH_prolog.LIBCMT ref: 00409E01

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6f10149a06308562acf37f860464d110ca3a5937ebbaf0a47fa221278f853281
Instruction ID: e1493f0b6e19cfb62b99a23f4382a724d2d4ef91e4db048f0079351f8f85d4bd
Opcode Fuzzy Hash: 6f10149a06308562acf37f860464d110ca3a5937ebbaf0a47fa221278f853281
Instruction Fuzzy Hash: 5FF05431501519DBCB25DF54C951BD8B7B4FF14318F1042AF9112635E2DB356F19CB54

Function 00405BFB Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00405C13

Part of subcall function 00413B0D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413B3B

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocExceptionRaiseString
String ID:
API String ID: 1415472724-0
Opcode ID: 585828f0663470c28d012fa7c31560623ec32af21cf032640c5ea50ac41654d0
Instruction ID: bf266c775eafc0cd132ea201270a7534faa964ceb55315cc87c56e89072e7831
Opcode Fuzzy Hash: 585828f0663470c28d012fa7c31560623ec32af21cf032640c5ea50ac41654d0
Instruction Fuzzy Hash: B7E06D32200708A7CB20AF65D84198B7BE8FF00385B10C43FF949DA240E779E9808BD8

Function 00405800 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405805

Part of subcall function 00405620: __EH_prolog.LIBCMT ref: 00405625

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d031f65d966fd76414b5e485b8cf5b0e5999cd66b44c505832369a9b765ef076
Instruction ID: a0f610f1b5e032532ed1cec3649959bf66a41b4e8af70f58d5593db508bcf515
Opcode Fuzzy Hash: d031f65d966fd76414b5e485b8cf5b0e5999cd66b44c505832369a9b765ef076
Instruction Fuzzy Hash: 46E04FB3D410049ACB05EB65E9527EDB378EF61319F50407FE412735D18B381F09CA58

Function 00405B29 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00405B4C

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f685ec6030a7cae57bc9182c2f64f11e19c4f82e6ad9756b6e5eb0af141a467c
Instruction ID: fda623b9c22c7fd134ddab0a411968f0e63156441233f4ee367e8c40c556ab77
Opcode Fuzzy Hash: f685ec6030a7cae57bc9182c2f64f11e19c4f82e6ad9756b6e5eb0af141a467c
Instruction Fuzzy Hash: 17E0E575640208FBCB11CFA5C801B8E7BF9EB08354F20C169F914AA260D739EA11DF54

Function 0040C931 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C936

Part of subcall function 0040C96C: __EH_prolog.LIBCMT ref: 0040C971

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2f93a48584fc243b76bceec8380402125645ced17a7c1bf7a60211c0ce45116c
Instruction ID: 8adf79bcf0a25fb823e60414124b99f072840e3085735b9c49c9779a3d641231
Opcode Fuzzy Hash: 2f93a48584fc243b76bceec8380402125645ced17a7c1bf7a60211c0ce45116c
Instruction Fuzzy Hash: 6EE01A71811620EBC724EF58C4456DEB7B4EF08725F00875EA4E6B36D1C7B8AE40CB94

Function 004147B4 Relevance: 1.5, APIs: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 004147E9

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 6c939c18724e7789034020813005a1b29b75e21fb5f5d6c1b381c2503cc8d902
Instruction ID: 835638d51d7e690d80ddf8f11569568d1c7a5f433119f1d0283a2071334468ba
Opcode Fuzzy Hash: 6c939c18724e7789034020813005a1b29b75e21fb5f5d6c1b381c2503cc8d902
Instruction Fuzzy Hash: CDE08C32900925AADB223BA1DC06AEE3620AF81394F00002BF8146A5A0DBA88CD186D9

Function 0040F6E0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F6E5

Part of subcall function 0040F449: __EH_prolog.LIBCMT ref: 0040F44E

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0c00a6b9b995e6d122d0d1e5645fdc19a4d57d2469026a55dc4bfd6035115874
Instruction ID: 32d4a89d334c2aba7f1f5d27adfa0c04a02a885b7174eb98eed18e47b0b867f7
Opcode Fuzzy Hash: 0c00a6b9b995e6d122d0d1e5645fdc19a4d57d2469026a55dc4bfd6035115874
Instruction Fuzzy Hash: 1DD012B2515104FBD7109F45D842BDEBBB8EB51369F10813BF00171540D37D5644966A

Function 00405A1D Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(000000FF,00000000,?,?,00000000,000000FF,?,00405A68,00000000,?,00000000,?,00405A8E,00000000,?,00000000), ref: 00405A33

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7899785fd51540d5028ce756fcdedcbfaef9db2fe3ec3db1f53401f618f66a8a
Instruction ID: 33e006b7c7266c94de2827aaddd493f3c8d551b448fa911b85e4ce9a1db514e9
Opcode Fuzzy Hash: 7899785fd51540d5028ce756fcdedcbfaef9db2fe3ec3db1f53401f618f66a8a
Instruction Fuzzy Hash: A4E0EC75200208FBCB01CF91CC05FCE7BB9FB49754F208058E90596160C375AA14EB54

Function 004147BF Relevance: 1.5, APIs: 1, Instructions: 17threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 004147E9

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 24773d02a99502e401f88b35345ffc50176b794b148236fecf9e645f2ac90187
Instruction ID: b4e95b568d212fcbc8e7df7edbfd3446e029e3f46d4ca6baaecf21535c38ed65
Opcode Fuzzy Hash: 24773d02a99502e401f88b35345ffc50176b794b148236fecf9e645f2ac90187
Instruction Fuzzy Hash: 2AD0A732600E25AAD6223771DC467EF2244AF81795B04012BF818895A0DFA8CDC145DD

Function 00405414 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,000000FF,00405445,000000FF), ref: 0040541F

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: f0ce2bef5821c107b9489e8e4dd061de71a9af92eaf728c2451e2811c290832d
Instruction ID: ad963fc5273d8b9d86916b47fb17bcd605870b12c06d71a74b716dd917e87850
Opcode Fuzzy Hash: f0ce2bef5821c107b9489e8e4dd061de71a9af92eaf728c2451e2811c290832d
Instruction Fuzzy Hash: D4D0123151453157CA641E7C7848AD333D99A1637537157AAF4B4D32E0D3749CC34A98

Function 00405AFC Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,00405B26,00000000,00000000,?,00402E13,?), ref: 00405B0A

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 2b6a10e293fa4a8bd52839064a41e39e160aca85d3804aec240939be71bd967c
Instruction ID: 4beff7ba357006865f39a04876becaa9faf69e640e246345c6c1d8862761ec95
Opcode Fuzzy Hash: 2b6a10e293fa4a8bd52839064a41e39e160aca85d3804aec240939be71bd967c
Instruction Fuzzy Hash: 29C04C36159106FF8F120F70CC04D1ABFA2EF99311F10C958B165C5070C7328024EB52

Function 00412FF0 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 0041468E: CreateThread.KERNELBASE(00000000,00000003,004146F9,00000000,00000000,?), ref: 004146CF
Part of subcall function 0041468E: GetLastError.KERNEL32(?,?,?,00413009,00000000,00000000,004032CA,?,00000000,00000000,?,00402FAB,?,00000000,?), ref: 004146D9

GetLastError.KERNEL32(?,?,00000003,00000000,00000000), ref: 00413018

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLast$CreateThread
String ID:
API String ID: 665435222-0
Opcode ID: fdfffcc17890bcc66e85f81167f5a4f4e376ab203a2f001e3d39f9f51099ce04
Instruction ID: 8241f09584fde1b7b47d6c8a5a56a0c389c2bf5d01a37efb599b640c9bda9e89
Opcode Fuzzy Hash: fdfffcc17890bcc66e85f81167f5a4f4e376ab203a2f001e3d39f9f51099ce04
Instruction Fuzzy Hash: 4EE086B22042126AE310DF509C05FE76ADCDB94B05F00443EB944C6184EB64CA40C3A9

Function 00405905 Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,000000FF,004058A0,?,?,00000000), ref: 00405910

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9cbe10086181c6cf337a739c26a2519d1510d6718cc7d35307e3d92904545fb4
Instruction ID: c924a9121967eb2c43d42ee71539138ee39fbcc7c8c6d5ba34c486a20a6e0004
Opcode Fuzzy Hash: 9cbe10086181c6cf337a739c26a2519d1510d6718cc7d35307e3d92904545fb4
Instruction Fuzzy Hash: 93D0127151456197CE742E7C78445C337D8DA463303311B6BF4B0D32E0D3748D835A98

Function 00410F40 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00020000,00001000,00000004,004103C8), ref: 00410F51

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 91e70fcb83806e64083a323eb2e3944731c0f93bc5a264736d7e7e867113384b
Instruction ID: 07720a170ef6d50c918e2da5ca2fe5f7ddfb2e687cae5d42b3df39ad5892c3a5
Opcode Fuzzy Hash: 91e70fcb83806e64083a323eb2e3944731c0f93bc5a264736d7e7e867113384b
Instruction Fuzzy Hash: DDB012B039138075FF7843208C1FFE71200A340B87F0080A8BB05D81C4E7D064C0501C

Function 00410F60 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,0040664A,?,00406624), ref: 00410F6C

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1327e01bd96d07ee7a5a75ed87afd8ac78764046635013dfe708143c48cadece
Instruction ID: a132bef15ba7b425f1065e5a097c2bb543b957559febc4b94616fea76008790a
Opcode Fuzzy Hash: 1327e01bd96d07ee7a5a75ed87afd8ac78764046635013dfe708143c48cadece
Instruction Fuzzy Hash: 3BB0123424120031ED7807200C1AB5711005701701F10C1183102642C087D4B440450C

Non-executed Functions

Function 004180F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0041772A,?,Microsoft Visual C++ Runtime Library,00012010,?,0041BD34,?,0041BD84,?,?,?,Runtime Error!Program: ), ref: 00418102
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041811A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041812B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00418138

Strings

GetActiveWindow, xrefs: 00418125
GetLastActivePopup, xrefs: 0041812D
MessageBoxA, xrefs: 00418114
user32.dll, xrefs: 004180FD

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 595171f737e70550edc5abd38f068ead7bf618b78638dd3ba3c6e0fb0d2712e4
Instruction ID: 415fa372477fd235fe75ca2ef0ffa9dc0df8c28a9075a0eab2fce08d3bc4b09a
Opcode Fuzzy Hash: 595171f737e70550edc5abd38f068ead7bf618b78638dd3ba3c6e0fb0d2712e4
Instruction Fuzzy Hash: F5012572700241BF87219FB5AD849DBBAE9EB49751354443FB504C2220DB7CC9C39B69

Function 0040E38E Relevance: 1.7, APIs: 1, Instructions: 246COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E393

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ef3f0dd97c369c2370b5d413364e2112772f158c67037ae1847bc74799d93c78
Instruction ID: 6f1b27b05ce828494dcdc0ca2a3df983f9883c238a6bb878f092976797e95433
Opcode Fuzzy Hash: ef3f0dd97c369c2370b5d413364e2112772f158c67037ae1847bc74799d93c78
Instruction Fuzzy Hash: 68A1EB70E002099BCB18DF96C8919AEB7B2FF94318F14883FE915A7391D738AD52CB55

Function 0041561A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000155D4), ref: 0041561F

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c73d5215fbd9f9fa44ce3c8db65af6300706d886bcb472667e49ab47f89b2735
Instruction ID: 5929198a1c1d143ebb6d47ac1dc9c369120d6613942f0ebcbf50c4dd8c3cbf29
Opcode Fuzzy Hash: c73d5215fbd9f9fa44ce3c8db65af6300706d886bcb472667e49ab47f89b2735
Instruction Fuzzy Hash: 57A001B5A41605DA8A209F60A8095C5BE62A689B42B608166A811E5268DFB812419A69

Function 0041562C Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00415631

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 80fdf592cfe35f6ca0a49e156fc06359dfcc477da488757324292bdf2a3d88f1
Instruction ID: 3aa75b883a8314cf8793ebdd48d7cbf343a2d53b1036c531b3b3a2656884bc9f
Opcode Fuzzy Hash: 80fdf592cfe35f6ca0a49e156fc06359dfcc477da488757324292bdf2a3d88f1
Instruction Fuzzy Hash:

Function 00412480 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction ID: f7c307c9948f0502eef9bcc932476d7ce99f20ff48e31f419bd1d6f291c9dace
Opcode Fuzzy Hash: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction Fuzzy Hash: BD023A72A042114BC71DCE18C6902B9BBE2FBD5350F110A3FE496D7A84D7B8D8E5CB99

Function 00416076 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction ID: 6f6e9ae2f3605818a2c8e7767e34e4a9399a597c595f09bc79f2493b2d2310b3
Opcode Fuzzy Hash: fc60ecf50bd115ca0c6ea2745a91e2bccda0b72c85d336beea95e2ba67d1c3a9
Instruction Fuzzy Hash: 3EB17C7590120ADFDB15CF04C5D0AE9BBA1FF58318F25C1AEC85A4B382C735EA86CB94

Function 004039C8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1b8b3e4e9aa519cc0883e8f2e9399227ae21cf5f78173f93e12a8e0ced7762
Instruction ID: 7f21fa5966f3e8744179bfb474c2758024c7c669c00a9d4920a80f5d7b425c19
Opcode Fuzzy Hash: 8b1b8b3e4e9aa519cc0883e8f2e9399227ae21cf5f78173f93e12a8e0ced7762
Instruction Fuzzy Hash: D621427E370D0607A71C8B6AAD336B921D1E38430A7C8A03DE64BC53C1EE6DD595C60D

Function 00418CC1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction ID: 99a347de7b16eca0cbeab8721e5afb4e5ad46217b84f2e64c48f172e38bf97ef
Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction Fuzzy Hash: 2B21C83290062547C702DE6DF4845A7F391FBD4369F134727ED8467291C629A854D6E0

Function 00418D9B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction ID: 71e75c779d64757812c6fa0593de5e91038406040dd0a6985e9d44633d38c26d
Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
Instruction Fuzzy Hash: BC2137725105258BC701DF2DF4886B7B3E1FFD4319F638A3BD8818B1C1CA29D881D694

Function 004185ED Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0041BE00,00000001,00000000,00000000,7591E860,004256E4,?,?,?,0041848E,?,?,?,00000000), ref: 0041862F
LCMapStringA.KERNEL32(00000000,00000100,0041BDFC,00000001,00000000,00000000,?,?,0041848E,?,?,?,00000000,00000001), ref: 0041864B
LCMapStringA.KERNEL32(?,?,?,0041848E,?,?,7591E860,004256E4,?,?,?,0041848E,?,?,?,00000000), ref: 00418694
MultiByteToWideChar.KERNEL32(?,VB,?,0041848E,00000000,00000000,7591E860,004256E4,?,?,?,0041848E,?,?,?,00000000), ref: 004186CC
MultiByteToWideChar.KERNEL32(00000000,00000001,?,0041848E,?,00000000,?,?,0041848E,?), ref: 00418724
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0041848E,?), ref: 0041873A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,0041848E,?), ref: 0041876D
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,0041848E,?), ref: 004187D5

Strings

VB, xrefs: 004186BD, 004186C8

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: VB
API String ID: 352835431-2416070386
Opcode ID: 003663a998c404720e509784b904756e9dc21287fecc91c3ae78f0538cf30181
Instruction ID: 75fdc42d4ca3b2d5695a32d80f34dcfea13c9c9e1b2be43f5f9a41df7731755a
Opcode Fuzzy Hash: 003663a998c404720e509784b904756e9dc21287fecc91c3ae78f0538cf30181
Instruction Fuzzy Hash: A6515F31900609EFCF218F65CC45EEF7FB5FB48754F20412AF925A12A0D7398991DBA9

Function 004172DF Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 004172FA
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 0041730E
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 0041733A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0041496A), ref: 00417372
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,0041496A), ref: 00417394
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,0041496A), ref: 004173AD
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,0041496A), ref: 004173C0
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004173FE

Strings

jIA, xrefs: 004173A8, 0041739A

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: jIA
API String ID: 1823725401-2590053038
Opcode ID: dcd9eacb03994a91aa73d6441958e3731b9086dbddb026e1bfa459d91ea586b1
Instruction ID: 8edd1d2af646b02ed721f394ba4169bf36ee68eca66066dd640126c456dfff16
Opcode Fuzzy Hash: dcd9eacb03994a91aa73d6441958e3731b9086dbddb026e1bfa459d91ea586b1
Instruction Fuzzy Hash: 7631D47250C219AFD7317F689C888FB7ABCE649354715053BFD66C3201E6288CC1E2AD

Function 00417606 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00417673
GetStdHandle.KERNEL32(000000F4,0041BD34,00000000,00000000,00000000,?), ref: 00417749
WriteFile.KERNEL32(00000000), ref: 00417750

Strings

<program name unknown>, xrefs: 00417683
..., xrefs: 004176C5
Microsoft Visual C++ Runtime Library, xrefs: 0041771F
Runtime Error!Program: , xrefs: 004176D9
x*B, xrefs: 00417614

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $x*B
API String ID: 3784150691-2083536112
Opcode ID: 9f3ee68eedca8c04870b7c4ba6519361572a149120d3a6d5458ca0bba870cf42
Instruction ID: d3223577c50248063a34d8f4d7298abe086d5d3d0ee639c6b3bd3f24b9ad2996
Opcode Fuzzy Hash: 9f3ee68eedca8c04870b7c4ba6519361572a149120d3a6d5458ca0bba870cf42
Instruction Fuzzy Hash: 5931D2726002186FDF20DA60DD46FDA377DEF89304F5005ABF544D6181EB78AAC48B5D

Function 0041883C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0041BE00,00000001,?,7591E860,004256E4,?,?,0041848E,?,?,?,00000000,00000001), ref: 0041887B
GetStringTypeA.KERNEL32(00000000,00000001,0041BDFC,00000001,?,?,0041848E,?,?,?,00000000,00000001), ref: 00418895
GetStringTypeA.KERNEL32(?,?,?,?,0041848E,7591E860,004256E4,?,?,0041848E,?,?,?,00000000,00000001), ref: 004188C9
MultiByteToWideChar.KERNEL32(?,VB,?,?,00000000,00000000,7591E860,004256E4,?,?,0041848E,?,?,?,00000000,00000001), ref: 00418901
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,0041848E,?), ref: 00418957
GetStringTypeW.KERNEL32(?,?,00000000,0041848E,?,?,?,?,?,?,0041848E,?), ref: 00418969

Strings

VB, xrefs: 004188F2, 004188FD

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: VB
API String ID: 3852931651-2416070386
Opcode ID: f366ae1a1c4feb3856e7e49d67d86268e533ee02966d98845c911f14f75699a6
Instruction ID: 0deb4df31157d4fbbd2276260d368b45192e758527c12e7bc8b96f729eb23429
Opcode Fuzzy Hash: f366ae1a1c4feb3856e7e49d67d86268e533ee02966d98845c911f14f75699a6
Instruction Fuzzy Hash: 85418FB2A00209BFCF209F94DC86EEF7F79EB08754F10452AF915D2250C7389991DB99

Function 00417411 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0041746F
GetFileType.KERNEL32(?,?,00000000), ref: 0041751A
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 0041757D
GetFileType.KERNEL32(00000000,?,00000000), ref: 0041758B
SetHandleCount.KERNEL32 ref: 004175C2

Strings

$YB, xrefs: 004174A9

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID: $YB
API String ID: 1710529072-867103119
Opcode ID: 0f20f78b1d243ceb825b791af9b59c2038ed572102f9f62c4ccf998fd163e942
Instruction ID: 9157860cf2e7af3a35f89051d0ae9de0bf945cd889ae2d4a6076f2c4651d7c80
Opcode Fuzzy Hash: 0f20f78b1d243ceb825b791af9b59c2038ed572102f9f62c4ccf998fd163e942
Instruction Fuzzy Hash: B75135716086019FC720CF28D8897B63BB1EB05338F64466EC566CB6E0DB38C986C75D

Function 00415680 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0041569F
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 004156D4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00415734

Strings

__MSVCRT_HEAP_SELECT, xrefs: 004156CF
__GLOBAL_HEAP_SELECTED, xrefs: 0041570E

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 352f7edc9f3896d13c070371f2d33d0b51665e116eb32c5a0d287e401f1eefe3
Instruction ID: 6eb182bd46f731c3af8b1d07a07b8df2d0194a1b299ff80343aa6f034c3c884c
Opcode Fuzzy Hash: 352f7edc9f3896d13c070371f2d33d0b51665e116eb32c5a0d287e401f1eefe3
Instruction Fuzzy Hash: 56312671945648EDEB3186706C87BDF3B788B46704F6400DBD199D52C2E6398ECA8B2D

Function 00403A90 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

CharUpperW.USER32(00000000,00000000,?,00000000,00000000,?,00403B58), ref: 00403AAB
GetLastError.KERNEL32(?,00000000,00000000,?,00403B58), ref: 00403AB7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000,?,00000000,00000000,?,00403B58), ref: 00403AD2
CharUpperA.USER32(?,?,00000000,00000000,?,00403B58), ref: 00403AEB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,00000000,00000000,?,00403B58), ref: 00403AFE

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 7c2300f256f82e2aee6372cd28c35fbf20af8ddddc15953858da8d33bcd8cfd2
Instruction ID: dd72d820dddc2be4d64e736f5eaa813d5c8cd4bb6d440344005d5656a272e87c
Opcode Fuzzy Hash: 7c2300f256f82e2aee6372cd28c35fbf20af8ddddc15953858da8d33bcd8cfd2
Instruction Fuzzy Hash: D60144B64002187ADB10ABE49C89DEBBE7CEB04259F014472F952E2281E2796E4487A8

Function 004152F3 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,00416CBF,0041798E,00000000,?,?,00000000,00000001), ref: 004152F5
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00415303
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0041534F

Part of subcall function 00416CCC: RtlAllocateHeap.NTDLL(00000008,?,00000000,00000000,00000001,00415318,00000001,00000074,?,?,00000000,00000001), ref: 00416DC2

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00415327
GetCurrentThreadId.KERNEL32 ref: 00415338

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: ErrorLastValue$AllocateCurrentHeapThread
String ID:
API String ID: 2047054392-0
Opcode ID: 4dc752e0f5d35fe25e0c0c3fb4faf8e8dc38f4a107c909f5117a03603e640e11
Instruction ID: c348f308811c55cc6791f5f2c72cac7d5a6c02788d8c3db17f30136ca92006f7
Opcode Fuzzy Hash: 4dc752e0f5d35fe25e0c0c3fb4faf8e8dc38f4a107c909f5117a03603e640e11
Instruction Fuzzy Hash: B4F09632600615ABC6312B70AC096DB3A51EB857E1B15413AF951972A0DB78888197DD

Function 0041843D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(004256E4), ref: 00418463
InterlockedDecrement.KERNEL32(004256E4), ref: 00418478

Strings

VB, xrefs: 0041845C

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: VB
API String ID: 2172605799-2416070386
Opcode ID: 3f0e7dfc381ab69d5717ddb5ba06b4fa70db5411652d110c580bb33579a080f3
Instruction ID: b2465ecea32c92352f716010131fb348419f683e9d2febfe3e70f5b1b578e6df
Opcode Fuzzy Hash: 3f0e7dfc381ab69d5717ddb5ba06b4fa70db5411652d110c580bb33579a080f3
Instruction Fuzzy Hash: 35F0C232201612EBD720AF56ECC19CF6755EB81326F50843FF00989190DF7899C2995E

Function 0041435F Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56ffb8a6685455f091880630799685eddd8ac587d3428563be9e88dd716d36c
Instruction ID: 1ac5c9ddcf095474d6e2a383ff06e8771fc838f6ee07df02b13506851481717d
Opcode Fuzzy Hash: d56ffb8a6685455f091880630799685eddd8ac587d3428563be9e88dd716d36c
Instruction Fuzzy Hash: C891F671D01618ABCF21AB69CC41ADE7BB9EB857A4F240127F814B6290D73D8DC18A6C

Function 0041636C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,00420838,00420838,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000), ref: 0041638D
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000), ref: 004163B1
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000), ref: 004163CB
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000,?), ref: 0041648C
HeapFree.KERNEL32(00000000,00000000,?,?,00416838,00000000,00000010,00000000,00000009,00000009,?,00413D1F,00000010,00000000,?,00000000), ref: 004164A3

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 61edb7c5b2a57b73fa0373c8b0061bfd64d3e4def081ef99dbe098b98f3bc666
Instruction ID: 1d273cd761051d77879f543994291e2c1f364a84a1ace75b4c6a1ba38ea4645d
Opcode Fuzzy Hash: 61edb7c5b2a57b73fa0373c8b0061bfd64d3e4def081ef99dbe098b98f3bc666
Instruction Fuzzy Hash: 1D310370640711EFD3309F24DC85BA6B7E4EB84764F12823AE56997791E778E881CB8C

Function 00409504 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409509

Part of subcall function 0040935A: EnterCriticalSection.KERNEL32(?,?,?,00409680), ref: 0040935F
Part of subcall function 0040935A: LeaveCriticalSection.KERNEL32(?,?,?,00409680), ref: 00409369

EnterCriticalSection.KERNEL32(?), ref: 00409536
LeaveCriticalSection.KERNEL32(?), ref: 00409552
__aulldiv.LIBCMT ref: 004095A1

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$H_prolog__aulldiv
String ID:
API String ID: 3848147900-0
Opcode ID: a31f7f313dfc0da48c948196a335c5e8fea939b4dae7cffcd2385e59b1d35c73
Instruction ID: 81a485ad15cb22f282f6c018201ee4179c2b1d1cd2674c5f201a60282c37c453
Opcode Fuzzy Hash: a31f7f313dfc0da48c948196a335c5e8fea939b4dae7cffcd2385e59b1d35c73
Instruction Fuzzy Hash: C6315076A00215AFCB11EF65C8819EFBBB5FF88704F00442AE51673692D779AD41CB64

Function 004047A8 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004047AD
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,00000000), ref: 004047D1
FormatMessageW.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,00000000), ref: 00404814
LocalFree.KERNEL32(?,?,?,00000000,?,00000000,00000000,?,00000000), ref: 0040482F

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: FormatMessage$FreeH_prologLocal
String ID:
API String ID: 3392428314-0
Opcode ID: d8114c00c851820dfd69355ab4a5a7d10c3f97c7ff5c1a94d174072509a20bce
Instruction ID: b23ee79e455563f0a2b187c1bc8aea4849c6785c5b1f5abfa42b55bee9ed31b8
Opcode Fuzzy Hash: d8114c00c851820dfd69355ab4a5a7d10c3f97c7ff5c1a94d174072509a20bce
Instruction Fuzzy Hash: 451170B5A00159AFDF01BFA59C419FFBB7DEF44349F00847AE112721E2DB391A01DA68

Function 00409374 Relevance: 6.0, APIs: 4, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00413030: SetEvent.KERNEL32(00000000,0040756D), ref: 00413033

GetDlgItem.USER32(?,000003E8), ref: 00409397
LoadIconA.USER32(00000000), ref: 004093B1
SendMessageA.USER32(?,00000080,00000001,00000000), ref: 004093C2
SetTimer.USER32(?,00000003,00000064,00000000), ref: 004093D1

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: EventIconItemLoadMessageSendTimer
String ID:
API String ID: 2758541657-0
Opcode ID: 426d8240eb7a06a459b3f470407d996c0274358d2b71b1374ad8138c79f04d47
Instruction ID: 34d2fc59b34559bed7d893ef409eb69d6d7528a9cba69d030baf66432b50efa3
Opcode Fuzzy Hash: 426d8240eb7a06a459b3f470407d996c0274358d2b71b1374ad8138c79f04d47
Instruction Fuzzy Hash: 4D015A30100B00AFD3319F21DD5AB66BBA1FB04721F008A2DF5A7959F0CB75B942CB48

Function 0040D5A3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D5A8

Strings

, xrefs: 0040D75F
, xrefs: 0040D787

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: 74feb26567ea79c8fd9d5f3f589634721b0a9a4a518abdc39c0b6b7ccedab932
Instruction ID: 116f94ee193b6a60a58d4aec76a07daa8eefdeb27c95ac76265691768f75313a
Opcode Fuzzy Hash: 74feb26567ea79c8fd9d5f3f589634721b0a9a4a518abdc39c0b6b7ccedab932
Instruction Fuzzy Hash: CB712431D0020A9FCB24DF99D981AAEB7B1FF48314F20467ED416B7691D734AA8ACF54

Function 00417E5D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00417E71

Strings

, xrefs: 00417EBA
, xrefs: 00417E96

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: be8999de8ad5c30073bbd0379d60ad0f54c653f5d04d814f41e486670cb2e0db
Instruction ID: 669041dcfce0968cbe3c51124f50cac4b21f3f9a56807733dc4743f672ff05a2
Opcode Fuzzy Hash: be8999de8ad5c30073bbd0379d60ad0f54c653f5d04d814f41e486670cb2e0db
Instruction Fuzzy Hash: 65417C312482585AEB219714CC49FFB7FF9DB02714F5404E6D149C7153C2794AC6C7BA

Function 00415ECA Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,00415C92,00000000,00000000,00000000,00413CC1,00000000,00000000,?,00000000,00000000,00000000), ref: 00415EF2
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00415C92,00000000,00000000,00000000,00413CC1,00000000,00000000,?,00000000,00000000,00000000), ref: 00415F26
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00415F40
HeapFree.KERNEL32(00000000,?), ref: 00415F57

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 712f9e2f9eec85a92a3a672498402ffd9fd7e765c5a6c8233a1a124cbc29739c
Instruction ID: 8f6381cf99308f7e34b2c2e49534b1224184cafd179dea44f4322364d011a6a4
Opcode Fuzzy Hash: 712f9e2f9eec85a92a3a672498402ffd9fd7e765c5a6c8233a1a124cbc29739c
Instruction Fuzzy Hash: A6114C31300A01EFC7308F59EC86DA6BBB5FB85760791462AF156D69B0D3719887CF58

Function 004154B1 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154BE
InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154C6
InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154CE
InitializeCriticalSection.KERNEL32(?,00415292,?,00414944), ref: 004154D6

Memory Dump Source

Source File: 00000000.00000002.3900765930.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3900738883.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900805571.000000000041B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900827459.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900853492.0000000000422000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900880704.0000000000423000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3900907994.0000000000427000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: ec7037d00a0fc94f488d53f3a91d2e26ae03bdd42e29aafad6c46e686e3ec5a2
Instruction ID: a8e831e61b8b61633fe4a4176da74b0e9d16ee726bcd83620c475df078586321
Opcode Fuzzy Hash: ec7037d00a0fc94f488d53f3a91d2e26ae03bdd42e29aafad6c46e686e3ec5a2
Instruction Fuzzy Hash: 0AC00231A11138ABCF312B55FC048463FA6EB852A03518072A1045203186612C12EFD8

Analysis Process: WebCompanion-Installer.exePID: 5988, Parent PID: 2108COMMON

Executed Functions

Function 06B7A848 Relevance: 8.8, Strings: 6, Instructions: 1305COMMON

Download Yara Rule

Strings

(aq, xrefs: 06B7B103
(aq, xrefs: 06B7BA53
(aq, xrefs: 06B7B99E
(aq, xrefs: 06B7BAD2
(aq, xrefs: 06B7AF7C
(aq, xrefs: 06B7B03B

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq$(aq$(aq$(aq
API String ID: 0-2219660067
Opcode ID: f5cb1b1d18c5452303f7de7489d3a4484a40fc18aed02b1fff2942608ecd9284
Instruction ID: a4766a4bfed7c451509f06bdf9579f1a1914503a0734c645b122f89f4501997c
Opcode Fuzzy Hash: f5cb1b1d18c5452303f7de7489d3a4484a40fc18aed02b1fff2942608ecd9284
Instruction Fuzzy Hash: 5FB27F74A002158FDB94DF69C894A6EB7F2FF88300F1085A9E916DB365DB30ED86CB51

Function 06B77120 Relevance: 1.7, Strings: 1, Instructions: 436COMMON

Download Yara Rule

Strings

\;]q, xrefs: 06B77167

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \;]q
API String ID: 0-2696284100
Opcode ID: 206a1f78d17b97770943e723b11321bf7c406f9ccdccaa1d2cd8dca98a0e81ed
Instruction ID: 1b7ce0b4b00d8df20a017bd18461b7a67c173523bbc3bb926cf7e443b583fab6
Opcode Fuzzy Hash: 206a1f78d17b97770943e723b11321bf7c406f9ccdccaa1d2cd8dca98a0e81ed
Instruction Fuzzy Hash: C3122670D1071ACFDB60DF64C844798B7B2FF55300F1196AAE9197B250EB74AA89CF90

Function 06C19E60 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\VBi, xrefs: 06C1A117

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \VBi
API String ID: 0-1049610623
Opcode ID: edea1123b0433756807ca211f9cb8921809161db7ce326f7270567593ecf2c6a
Instruction ID: 4734c0461865b1c3f093871d3201e126586baa183610cf328c65654cf7c41d66
Opcode Fuzzy Hash: edea1123b0433756807ca211f9cb8921809161db7ce326f7270567593ecf2c6a
Instruction Fuzzy Hash: E5B15B70E00209DFDF54CFA9C9857AEBBF2BF89304F148129E419EB254EB749941DB81

Function 012AF0D0 Relevance: .8, Instructions: 756COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a5b74fc7e7b8fb9390fc7d76633d9d2070b650cef42467bcf8522d77c5f0934
Instruction ID: 021d520fe0bdce06429337d240b8fc6825ed0c8c60cb0e83c894c21f0f48aed3
Opcode Fuzzy Hash: 5a5b74fc7e7b8fb9390fc7d76633d9d2070b650cef42467bcf8522d77c5f0934
Instruction Fuzzy Hash: 0D624E74B402198FCB14DF65D998BADBBB2FF88301F5084A9E90AA7395DB349D81CF50

Function 062505A8 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2638a203d07d1816f7742a62467248a592ea97d2148fe4c339d672180c1e00ab
Instruction ID: 068a9805b97c063c3b386f267c6cd872039061d2e1456fcaa7082c4e6fd520c1
Opcode Fuzzy Hash: 2638a203d07d1816f7742a62467248a592ea97d2148fe4c339d672180c1e00ab
Instruction Fuzzy Hash: F5426B70F106159FDB64DF68D8987AEBBB2FF88314F148159D806AB390EB389905CF91

Function 012A0DE0 Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca84dd1c2fc50e6e080833bae4a5057d65da79913fee21542e56f244597ba5e3
Instruction ID: b744c49a24bf2c4a206bbd6d2ed686ca287e914e6e09357a49dca37c7d659671
Opcode Fuzzy Hash: ca84dd1c2fc50e6e080833bae4a5057d65da79913fee21542e56f244597ba5e3
Instruction Fuzzy Hash: 9E426934A012158FCB59EF75D848A6E7BB6BF88300F148669E50AD7368EF30AD45CF51

Function 06C1B1B0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea83db25fee0fc969540980e60678ac606285b845adc082d4f6f47f86eec421
Instruction ID: c8c6bcbb9242e42cd55904b0d76157a9852255cb66bdf5722b0bb2dffb71a195
Opcode Fuzzy Hash: eea83db25fee0fc969540980e60678ac606285b845adc082d4f6f47f86eec421
Instruction Fuzzy Hash: F2B1C270B002098FDB48DB7A995477EB6EBAFC9340F18C429E5069B3A4DE34DC46DB64

Function 06C1A730 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8ba4b4202b2c931d45dc5bfde18c4e6931799b47083c6d5f1c967acb746c97
Instruction ID: d19ffe50780ded0869fbdcdc29bf1839d5704ff215cb753e1c1475c8b04fed95
Opcode Fuzzy Hash: ae8ba4b4202b2c931d45dc5bfde18c4e6931799b47083c6d5f1c967acb746c97
Instruction Fuzzy Hash: B0B16C70E01209CFDB50CFE9C9817ADBBF2BF89314F14852AD415EB294EB749986DB81

Function 06B70438 Relevance: 21.0, Strings: 16, Instructions: 1008COMMON

Download Yara Rule

Strings

(_]q, xrefs: 06B70AEF
@b]q, xrefs: 06B70C0C
4']q, xrefs: 06B70CA5
c]q, xrefs: 06B7146D
4']q, xrefs: 06B70D27
$&^q, xrefs: 06B70984
_q, xrefs: 06B70588
4c]q, xrefs: 06B70951
$]q, xrefs: 06B70B9A
_q, xrefs: 06B70654
c]q, xrefs: 06B70A1D
|-^q, xrefs: 06B704BC
4']q, xrefs: 06B70DAC
4']q, xrefs: 06B71577
$]q, xrefs: 06B715F9
4c]q, xrefs: 06B714F2

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: _q$$&^q$(_]q$4']q$4']q$4']q$4']q$4c]q$4c]q$@b]q$|-^q$$]q$$]q$c]q$c]q$_q
API String ID: 0-4224596466
Opcode ID: 2290a4dba4b1a60936f480b01a269dbf242a54c51afde30b69cea51a41a69895
Instruction ID: 8fc2c850b777ae046f2fcb3b43b525c5d917ce9c6e1aefceafbe603fb58b57fe
Opcode Fuzzy Hash: 2290a4dba4b1a60936f480b01a269dbf242a54c51afde30b69cea51a41a69895
Instruction Fuzzy Hash: 7CB2D674A41218CFCB659F65C994ADDBBB2FF89300F1045E9E50AAB290DF399E81CF41

Function 06B70448 Relevance: 21.0, Strings: 16, Instructions: 1000COMMON

Download Yara Rule

Strings

(_]q, xrefs: 06B70AEF
@b]q, xrefs: 06B70C0C
4']q, xrefs: 06B70CA5
c]q, xrefs: 06B7146D
4']q, xrefs: 06B70D27
$&^q, xrefs: 06B70984
_q, xrefs: 06B70588
4c]q, xrefs: 06B70951
$]q, xrefs: 06B70B9A
_q, xrefs: 06B70654
c]q, xrefs: 06B70A1D
|-^q, xrefs: 06B704BC
4']q, xrefs: 06B70DAC
4']q, xrefs: 06B71577
$]q, xrefs: 06B715F9
4c]q, xrefs: 06B714F2

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: _q$$&^q$(_]q$4']q$4']q$4']q$4']q$4c]q$4c]q$@b]q$|-^q$$]q$$]q$c]q$c]q$_q
API String ID: 0-4224596466
Opcode ID: 17c8e16ff66c1ffbf9e93c7a5d929aee997d5883e284970c38b39f10c959928c
Instruction ID: 2d070252e95dc81189d100566b55c1d5074273976dbebe6a80d444963c8a816b
Opcode Fuzzy Hash: 17c8e16ff66c1ffbf9e93c7a5d929aee997d5883e284970c38b39f10c959928c
Instruction Fuzzy Hash: F7B2D674A41218CFCB659F65C994ADDBBB2FF89300F1045E9E50AAB290DF399E81CF41

Function 06B79E20 Relevance: 7.7, Strings: 6, Instructions: 223COMMON

Download Yara Rule

Strings

$]q, xrefs: 06B79F04
$]q, xrefs: 06B79FEE
4']q, xrefs: 06B79F13
$]q, xrefs: 06B79EDB
$]q, xrefs: 06B79ECF
$]q, xrefs: 06B79FFA

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2227620914
Opcode ID: 1242dd5395e02ae9e890ba3bc82ffa838466eb8c8a6137501800c913c9bd08dd
Instruction ID: ba2f55ea8e08fb8ca210d32282fd931fa0f0dbef184ee1600227ab7137feb51c
Opcode Fuzzy Hash: 1242dd5395e02ae9e890ba3bc82ffa838466eb8c8a6137501800c913c9bd08dd
Instruction Fuzzy Hash: 2C71BDB17401199FDB99AF28C8A496E3BBBFF88610B104499F516CB3A0CFB5DC01CB90

Function 06B73220 Relevance: 6.6, Strings: 5, Instructions: 324COMMON

Download Yara Rule

Strings

\;]q, xrefs: 06B7334C
(aq, xrefs: 06B735A2
\;]q, xrefs: 06B73358
\;]q, xrefs: 06B7331E
(aq, xrefs: 06B73501

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$(aq$\;]q$\;]q$\;]q
API String ID: 0-1958034480
Opcode ID: f2d415a9247360b3019c51aa296eded322f356e2ddebd784e072c947e77fd425
Instruction ID: 7588a5cdec31d63cf5e04f48b3d10b0fadfa85b2439d229b80170c67fd34bcac
Opcode Fuzzy Hash: f2d415a9247360b3019c51aa296eded322f356e2ddebd784e072c947e77fd425
Instruction Fuzzy Hash: 61B1E570B402198FDB68DB6CC454A6EFBEAEFC8310B1484AAD816DB3A4DE35DC01D791

Function 06B765D0 Relevance: 5.3, Strings: 4, Instructions: 291COMMON

Download Yara Rule

Strings

,aq, xrefs: 06B76719
,aq, xrefs: 06B76725
(aq, xrefs: 06B7663E
(aq, xrefs: 06B76763

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$(aq$,aq$,aq
API String ID: 0-2320876408
Opcode ID: 321732471e461eac0217512d7de92f9e1fbc30224f5b346298176dbeade6edea
Instruction ID: 997759944eb2935a7714dc2b2421e5fe7d32924e65726ea77b2fc71f5b243796
Opcode Fuzzy Hash: 321732471e461eac0217512d7de92f9e1fbc30224f5b346298176dbeade6edea
Instruction Fuzzy Hash: 6DA1BF71B006048FC755DF69D8949AE7BB2FF85310B1081AAE41ADB391EF35EC02CB91

Function 05A0A038 Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

$]q, xrefs: 05A0A0F8
$]q, xrefs: 05A0A125
$]q, xrefs: 05A0A0EC
$]q, xrefs: 05A0A131

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 2f22ebcd70e1c8b7d8b4d0a6d603cf26b6019fc6397eb7d6a0c5c4283e0e9c8c
Instruction ID: abe71ea144b306a2b0236ca0a5d59fcb7e2bdfbac9e6ee76240758606dab79ed
Opcode Fuzzy Hash: 2f22ebcd70e1c8b7d8b4d0a6d603cf26b6019fc6397eb7d6a0c5c4283e0e9c8c
Instruction Fuzzy Hash: CE416D30A20319CFDB14DFA5E954EEEBBF2BF88300FA09529C412B7295DB755842CB61

Function 06B7C558 Relevance: 4.2, Strings: 3, Instructions: 424COMMON

Download Yara Rule

Strings

(aq, xrefs: 06B7C944
(aq, xrefs: 06B7C877
(aq, xrefs: 06B7C8A3

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$(aq$(aq
API String ID: 0-2593664646
Opcode ID: 990efa56d1704a29a89934da3d1925555d49e646752be878d4e19b574aad3e02
Instruction ID: dfb4398106815d74af4f1c87f5a00894996dcb3f5a0d2489ec5fd59b0de3c4a8
Opcode Fuzzy Hash: 990efa56d1704a29a89934da3d1925555d49e646752be878d4e19b574aad3e02
Instruction Fuzzy Hash: 16026D75A002099FCB44DF68D894AAEBBF2FF88310F149569E916AB365CB30DC01DF91

Function 012AB098 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

PH]q, xrefs: 012AB18C
PH]q, xrefs: 012AB11A
Haq, xrefs: 012AB404

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: Haq$PH]q$PH]q
API String ID: 0-511712173
Opcode ID: 551841df1386acb362c3e411ef73c059b34e7d2a90a9e2264f6bd7f82ddf3893
Instruction ID: 1e49a10a3af04a7fa65f5906480e3670d1ad3180dc0494330ce7928265445cc4
Opcode Fuzzy Hash: 551841df1386acb362c3e411ef73c059b34e7d2a90a9e2264f6bd7f82ddf3893
Instruction Fuzzy Hash: CFC17C30B402068FCB05DB79D994AAEBBB6BF89300F548569D905DB356DB349C42CBA1

Function 06B75DF0 Relevance: 4.0, Strings: 3, Instructions: 205COMMON

Download Yara Rule

Strings

(Abq, xrefs: 06B75F6B
C", xrefs: 06B75E56
##, xrefs: 06B75EEA

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (Abq$##$C"
API String ID: 0-2715590360
Opcode ID: 2c427dbe7ae4bd1e77751d703a506d755a5365a60686bd62ae18ada223667e8d
Instruction ID: 1f3f3854f1b4ce00fb69020d7dfd6b922d71c4ea902a3f967ef64c1b1dc6cd70
Opcode Fuzzy Hash: 2c427dbe7ae4bd1e77751d703a506d755a5365a60686bd62ae18ada223667e8d
Instruction Fuzzy Hash: 5A719971F103098FCB94DFA5C95069EBBF6BF88300F208569D45AAB384EF709906CB81

Function 06B75D60 Relevance: 3.9, Strings: 3, Instructions: 191COMMON

Download Yara Rule

Strings

(Abq, xrefs: 06B75F6B
C", xrefs: 06B75E56
##, xrefs: 06B75EEA

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (Abq$##$C"
API String ID: 0-2715590360
Opcode ID: 3c7d6f7791e05d2dcbfb186636e25974b30dde35ded58f69728a65dc57d7658c
Instruction ID: 0de9463a033fbdf87a1b5d45512360edc7833c5f3161e35efb06d78162d15118
Opcode Fuzzy Hash: 3c7d6f7791e05d2dcbfb186636e25974b30dde35ded58f69728a65dc57d7658c
Instruction Fuzzy Hash: 61611272E153549FDB15EF78D860A9E7FF6BF85304F2481AAD0419F251DA74980ACBC0

Function 06C1BF10 Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

Haq, xrefs: 06C1C04D
(aq, xrefs: 06C1BFC9
Haq, xrefs: 06C1BFF5

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$Haq$Haq
API String ID: 0-2627730306
Opcode ID: 3c0177f49d3b39487c6d29f6a2b9579d6f388ff862850629856af1c797d76862
Instruction ID: 29f2a5cdf50911d368cab6603939819c8260dea410efb9f9e95c7b6c3799512c
Opcode Fuzzy Hash: 3c0177f49d3b39487c6d29f6a2b9579d6f388ff862850629856af1c797d76862
Instruction Fuzzy Hash: 1E51DF79B001199FCB94DF69D8509BFBBA6EF85350B108069E9069B350DB30DE42DFE1

Function 06C10040 Relevance: 3.0, Strings: 2, Instructions: 483COMMON

Download Yara Rule

Strings

, xrefs: 06C1013F
Haq, xrefs: 06C10A33

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $Haq
API String ID: 0-226296719
Opcode ID: 01390335fc3dcf62c95de1b19a6f2daa0db43f8e0f50b415eacad194772ee440
Instruction ID: 0bfbf2118f85bfba6a9392da6b3cae10f53159b3b4ffe45f835cb6d194f775f5
Opcode Fuzzy Hash: 01390335fc3dcf62c95de1b19a6f2daa0db43f8e0f50b415eacad194772ee440
Instruction Fuzzy Hash: 31329374E01204CFD754CF84C688EA9BBF2BB06345F16C09AD0166F2A2D776DA99DF90

Function 06C12570 Relevance: 2.9, Strings: 2, Instructions: 439COMMON

Download Yara Rule

Strings

(aq, xrefs: 06C129D0
(aq, xrefs: 06C12888

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: eb1730b82f8469dc5de33ceca43550ec23b8005f0c3e3faa8f9494809b259593
Instruction ID: 9ba68158bd3d017673e47153faccf7b6e2ff9627783ed9d175e02f9fbac647bf
Opcode Fuzzy Hash: eb1730b82f8469dc5de33ceca43550ec23b8005f0c3e3faa8f9494809b259593
Instruction Fuzzy Hash: D8F1B234B002099FCB54DF69D854AAEBBB6FF89310F14846EE806DB351CB35EA45DB90

Function 012A178E Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

,5=p, xrefs: 012A1856
fbq, xrefs: 012A17B6

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: fbq$,5=p
API String ID: 0-1757625122
Opcode ID: d03d362bc6d689d0e70e2d0ec1a520084d30a4a1434964113764cad592a6e10c
Instruction ID: 1e4f950ff348f1ab8a75d5399c9e2d74cc63c020efe424d3775f4ff343ffb926
Opcode Fuzzy Hash: d03d362bc6d689d0e70e2d0ec1a520084d30a4a1434964113764cad592a6e10c
Instruction Fuzzy Hash: B7A10330B052529FDB159F34845462EBBF2BF85318F1888ABC4899B396DB35DC86C792

Function 012AAFA0 Relevance: 2.8, Strings: 2, Instructions: 257COMMON

Download Yara Rule

Strings

PH]q, xrefs: 012AB18C
PH]q, xrefs: 012AB11A

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: fe888816749d65e05bf3cf47a4fd3a3b640dc226d3c0e8c06c13db60baad5abc
Instruction ID: f9b1726789d199995e8944b5bc8454f6d7b231b3707069d131458c1585de9228
Opcode Fuzzy Hash: fe888816749d65e05bf3cf47a4fd3a3b640dc226d3c0e8c06c13db60baad5abc
Instruction Fuzzy Hash: 96A1C631A442458FDB06CF78C894AAEBBF2FF85300F5981AAC505DB366DB749C46CB61

Function 012AB06A Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

PH]q, xrefs: 012AB18C
PH]q, xrefs: 012AB11A

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 2aa6063f0750c4f8984d13773277d01a44246238942ffb44cdaa94dfefc383fb
Instruction ID: b49f47d73a87c8d5ae823733e28c480d8a65ce644f60055b8f1e8ac5d323d233
Opcode Fuzzy Hash: 2aa6063f0750c4f8984d13773277d01a44246238942ffb44cdaa94dfefc383fb
Instruction Fuzzy Hash: 94816F34B4024A8FDB05DF68C994AAEBBF2FF89301F5481A6D505EB366DB349C41CB61

Function 06C1A49C Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

\VBi, xrefs: 06C1A517
\VBi, xrefs: 06C1A66A

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \VBi$\VBi
API String ID: 0-918813160
Opcode ID: 7afa8a38c71326a28544a60b5c279d54efe2b54ee0971a4928be110f72818384
Instruction ID: d35fb91a0ff3138f417cd9de5e387cd33e96dfb04a6b897519540bbd577ef0cc
Opcode Fuzzy Hash: 7afa8a38c71326a28544a60b5c279d54efe2b54ee0971a4928be110f72818384
Instruction Fuzzy Hash: 067167B0E052099FDB50CFE9C88179EBBF2BF89314F148129E419EB254EB749942DF91

Function 012AB047 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

PH]q, xrefs: 012AB18C
PH]q, xrefs: 012AB11A

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: e077e6a38a921c011b17887fe8b3dd8a6520cbcffd530c379688155aaf06f55a
Instruction ID: 9261bda69bdb294038a33bc58541e67621be4ad344bd98e850049e61e65d2823
Opcode Fuzzy Hash: e077e6a38a921c011b17887fe8b3dd8a6520cbcffd530c379688155aaf06f55a
Instruction Fuzzy Hash: E1710D34B4020A8FDB05DF68C994AAEB7F2FF89301F5485A9D505AB365DB349C42CB61

Function 06C1A4A8 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

\VBi, xrefs: 06C1A517
\VBi, xrefs: 06C1A66A

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \VBi$\VBi
API String ID: 0-918813160
Opcode ID: 6cd651d7b827245d00dde269b2a18ea806d2a9d1df8ca947e1c7760566fc1ba5
Instruction ID: d04c7b913a7eae1f3a47b93b3975ec94b2408185ce710a30d1c020288c317971
Opcode Fuzzy Hash: 6cd651d7b827245d00dde269b2a18ea806d2a9d1df8ca947e1c7760566fc1ba5
Instruction Fuzzy Hash: D47156B0E056099FDB50CFE9C88479EBBF2BF89304F148129E419EB254EB749942DB91

Function 06C12AD1 Relevance: 2.7, Strings: 2, Instructions: 174COMMON

Download Yara Rule

Strings

,aq, xrefs: 06C12AF8
4']q, xrefs: 06C12C34

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: ,aq$4']q
API String ID: 0-1214544875
Opcode ID: 23b5e11ca0a65115046a1e8c1b3ddf65da9e0f5587ff613fc933b9f12af47fc8
Instruction ID: 96a7fc6957394fd1685703f7b5a91c2613c9d4c3911d383ed418c00500a8f6c2
Opcode Fuzzy Hash: 23b5e11ca0a65115046a1e8c1b3ddf65da9e0f5587ff613fc933b9f12af47fc8
Instruction Fuzzy Hash: B0518E75F001158FCB54DF69C8509AFBBE6AFC9210B11806AE906EB359DE34DE42C7A1

Function 012AA180 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

(aq, xrefs: 012AA28D
Haq, xrefs: 012AA1F4

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: 9557e5b7a9a5fca68ee618ce5d5196c2157f2ea8976d76f32c78f4969e636722
Instruction ID: cbcccefbe5cbf0b4adac4047b744ef8da527c1543538f7aca6e03f6d25db3420
Opcode Fuzzy Hash: 9557e5b7a9a5fca68ee618ce5d5196c2157f2ea8976d76f32c78f4969e636722
Instruction Fuzzy Hash: 81510031B442458FCB259B79D454AAE7BB6AFC8310F44447AEA02DB382DE759C82C790

Function 06B73D60 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

(aq, xrefs: 06B73D88
(aq, xrefs: 06B73EEF

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: cee4f7bd100f897edeccf788f059eacf083a0fa9da66337c4827ac9844d2d371
Instruction ID: 0b17443b670c846136b440dde373221316916847b8b3011042a32027d4ac82a0
Opcode Fuzzy Hash: cee4f7bd100f897edeccf788f059eacf083a0fa9da66337c4827ac9844d2d371
Instruction Fuzzy Hash: F65126313087448FC355DB39D854A6ABBF6FFC5200B0885EDE04ACB3A2CA25ED06D7A1

Function 06B73D4F Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

(aq, xrefs: 06B73D88
Xaq, xrefs: 06B73D36

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$Xaq
API String ID: 0-3796444030
Opcode ID: f464f3adddb04c5f9af1c838b844c14054a8eadc08134a825297be77c2376a88
Instruction ID: 32ef6da39e0d6835eee1249775e8c8d9702e9aeb1465ea21cc020b107d36e7fc
Opcode Fuzzy Hash: f464f3adddb04c5f9af1c838b844c14054a8eadc08134a825297be77c2376a88
Instruction Fuzzy Hash: 335118313087448FC356DB39D85496ABFF6FF8621070585EEE05ACB366CA25EC06D7A1

Function 06B76338 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

T;=p, xrefs: 06B76374
(aq, xrefs: 06B76383

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$T;=p
API String ID: 0-3294494287
Opcode ID: cae35cb3f95c7a1103090ddb1695982034989f4a804ce0a0c727bbef4fa609da
Instruction ID: 91e8356ff58c85855c1be74327aeb75c75114b2a018fe01f4c512ecde7ecc49a
Opcode Fuzzy Hash: cae35cb3f95c7a1103090ddb1695982034989f4a804ce0a0c727bbef4fa609da
Instruction Fuzzy Hash: 7D3104727002015FD7589A2EE855A6FBBEBEFC521072485BAE006CB351DE35DC06C7E0

Function 06C1B760 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

(aq, xrefs: 06C1B826
(aq, xrefs: 06C1B7FA

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$(aq
API String ID: 0-3916115647
Opcode ID: 9bf2d97c071555f3c8675584afb5b64d4f082360e8bdf769f174bbd1d04c22e7
Instruction ID: ad9ee58281c94fbad264483ed3aaec14a9a197eb3fccc0e5f9f98d23c839fd72
Opcode Fuzzy Hash: 9bf2d97c071555f3c8675584afb5b64d4f082360e8bdf769f174bbd1d04c22e7
Instruction Fuzzy Hash: 79314431B042045FD395AB69E855BAF7BF6EF86310F0440AEE106AB382CE759D05CBE1

Function 06B72120 Relevance: 2.6, Strings: 2, Instructions: 109COMMON

Download Yara Rule

Strings

(aq, xrefs: 06B72190
4']q, xrefs: 06B72139

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$4']q
API String ID: 0-4173138025
Opcode ID: fb367799d06085bc8e8aae685516c62d031cb6c4fa1f4e7a39db1df719a96ad6
Instruction ID: 9ca65007447acc1eece218ac72c18fad189154dfc648ee544f8d5d4c8498d8ba
Opcode Fuzzy Hash: fb367799d06085bc8e8aae685516c62d031cb6c4fa1f4e7a39db1df719a96ad6
Instruction Fuzzy Hash: DD3140327003014FC319AB38E854A9E7BAAFFC5320B15846DE54A8B355DF38DD068391

Function 05A0D158 Relevance: 2.6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

4']q, xrefs: 05A0D161
(aq, xrefs: 05A0D1B8

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$4']q
API String ID: 0-4173138025
Opcode ID: 3d965423118cb1bea7cdb337cf6749ba61fe05e45a26fd6b0281cc9a3da5e415
Instruction ID: 1e3e275589ec864d5c0017fed85a35478f2bcd15a57d8925d7d1f05cb62c66e0
Opcode Fuzzy Hash: 3d965423118cb1bea7cdb337cf6749ba61fe05e45a26fd6b0281cc9a3da5e415
Instruction Fuzzy Hash: 8F31F4323403014FC318AB69E895EAE7BAAFFC5320B15852DE5068B395DF38DD06C795

Function 05A0F957 Relevance: 2.6, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

4']q, xrefs: 05A0F971
(aq, xrefs: 05A0F9C7

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$4']q
API String ID: 0-4173138025
Opcode ID: 61c87d38dbf499dd8077dd91060b0af4801b11d177829bb38267e40d833391fd
Instruction ID: 325ec6db17958223fb46d6449a3f2d3ada139001f6e901a8401eb6c93bedddf7
Opcode Fuzzy Hash: 61c87d38dbf499dd8077dd91060b0af4801b11d177829bb38267e40d833391fd
Instruction Fuzzy Hash: 0B210B313043404FC719AB39F850E6E7BA7EFC635071980AAD55ADB3A2DE20CD06C791

Function 062526C8 Relevance: 2.6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

$]q, xrefs: 0625273F
$]q, xrefs: 06252733

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: bac11476f9f6018826704b1ece3a075fd25370c91655261fe1207dc819d14b84
Instruction ID: 07f55f782e1ce8967dcc758edf9bc96bcb4fb44931d417e3cccf5dbcb421c97f
Opcode Fuzzy Hash: bac11476f9f6018826704b1ece3a075fd25370c91655261fe1207dc819d14b84
Instruction Fuzzy Hash: 4C218730E21209DFD728DF66C9546AEBBF6EF8C310F154529DC01BB294EB745941CB91

Function 05A0FC40 Relevance: 2.6, Strings: 2, Instructions: 57COMMON

Download Yara Rule

Strings

,aq, xrefs: 05A0FC64
(aq, xrefs: 05A0FC7E

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$,aq
API String ID: 0-1929014441
Opcode ID: 9c51b1a0880e76fa125b46febb7492104ed47a4dc0d0d36b9dda01f3b1084704
Instruction ID: 06b760592c43cc37f742653f4661686e067ee272afbe0bd47ae640b0638dab7d
Opcode Fuzzy Hash: 9c51b1a0880e76fa125b46febb7492104ed47a4dc0d0d36b9dda01f3b1084704
Instruction Fuzzy Hash: 5D0128327241254FCB249F7C98147ED37E5BF453A0B0900E6EC0AE73A2DE29DC4087A1

Function 06C14144 Relevance: 2.5, Strings: 2, Instructions: 21COMMON

Download Yara Rule

Strings

$]q, xrefs: 06C14154
$]q, xrefs: 06C14148

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 5c6b7937e0bbb6a63a7c98368165fe1e9ac1f0fa0bf398b5bd66c36ea8c5db2e
Instruction ID: 72a2a3280e0b61998964455c03b7e67ed18d030e0e28686510a8d1d09c4d2cf8
Opcode Fuzzy Hash: 5c6b7937e0bbb6a63a7c98368165fe1e9ac1f0fa0bf398b5bd66c36ea8c5db2e
Instruction Fuzzy Hash: ADE08C32F100188F976C8A1EE8404AABBF5EBA6B10330806BD9018F310C670CC2697C0

Function 012A4A58 Relevance: 2.0, Instructions: 1980COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d88ed7cc509ba06312863958e7bf3b0d5b4ceaa1f397bafa12a6dd07b9b3d2
Instruction ID: e1a6c2afc7d93339b2081323574e4777b41a263f96111579c352621d99fcd697
Opcode Fuzzy Hash: 75d88ed7cc509ba06312863958e7bf3b0d5b4ceaa1f397bafa12a6dd07b9b3d2
Instruction Fuzzy Hash: E9234139902204DFCB666FA1C91865DB732FF4A346B20857ADD0253BB5CB7A8D52DF40

Function 012A4A68 Relevance: 2.0, Instructions: 1978COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca27ba64a7a99b4070e315548dba374a1bdd98bf7483eb506572436bbf33cdf
Instruction ID: 5ff4b53e52f4fab611ecfa1b766aef4dc14f0f5f6fe9c5344619c8d48fb830f9
Opcode Fuzzy Hash: aca27ba64a7a99b4070e315548dba374a1bdd98bf7483eb506572436bbf33cdf
Instruction Fuzzy Hash: D6234139902204DFCB666FA1C91865DB732FF4A34AB20857ADD0253BB5CB7A8D52DF40

Function 06C10007 Relevance: 1.7, Strings: 1, Instructions: 418COMMON

Download Yara Rule

Strings

, xrefs: 06C1013F

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID: 0-1485758832
Opcode ID: eb050f1a05bb1732c12c4255990db19359489bf220d4514dc210e4342aaa0d3c
Instruction ID: 3c4b8aaf8ce93b2862c2acc0f46d8b151383a8f951551d0d1bf03042ce8743ed
Opcode Fuzzy Hash: eb050f1a05bb1732c12c4255990db19359489bf220d4514dc210e4342aaa0d3c
Instruction Fuzzy Hash: 582283B4E01214CFD750CF44C688EA9BBF1BB06349F16C09AD0166F2A2D776DA99DF90

Function 06C112C8 Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

(aq, xrefs: 06C1171C

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: a46f2c4cbc1c8b5e8a59c8bad7f2a29fe31d3fe727ba13181003d01a80db8eb1
Instruction ID: 6bac50ce505d780ad72157b52296f9ae37a46f88fa545fa2d6237e4908127b21
Opcode Fuzzy Hash: a46f2c4cbc1c8b5e8a59c8bad7f2a29fe31d3fe727ba13181003d01a80db8eb1
Instruction Fuzzy Hash: 83F15834E003598FDB55CF68C488B9DBBF2AF46300F188199D505AF2A5DB78EE85CB90

Function 06B790DE Relevance: 1.6, Strings: 1, Instructions: 354COMMON

Download Yara Rule

Strings

(aq, xrefs: 06B794A7

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: c828e64e0dfc685355fe07c5b095f004fa4e97f9351ed70184ee9ea7263d375a
Instruction ID: 218ff4acfb76c6643dd46f7733bb01a59ebfdecf38d669e190ddc2ebd14352cb
Opcode Fuzzy Hash: c828e64e0dfc685355fe07c5b095f004fa4e97f9351ed70184ee9ea7263d375a
Instruction Fuzzy Hash: 96D19EB07046108FEBA4AB28D49477EB7E2FB88701F10549AE563C7795DB74DC829B81

Function 05A0E4A0 Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

(aq, xrefs: 05A0E833

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 96e5326283c4849279aaa70f5e2b264fe9a1ba67e5a759ce3be6dee80e032b99
Instruction ID: e1517e632224c74b6035937622b0b0b169b47990025f7d066249072dce89afaa
Opcode Fuzzy Hash: 96e5326283c4849279aaa70f5e2b264fe9a1ba67e5a759ce3be6dee80e032b99
Instruction Fuzzy Hash: ABD1BE34E002598FDB15CFA8D880AADBBF6FF49300F148499E841AB3A5EB70ED45CB50

Function 05A0ED08 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

(aq, xrefs: 05A0EEFA

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 94299a2d1bb2d7ecd3d419230d3aab6ffccdad668f9775425b68f1e35e2e6b08
Instruction ID: 0e800558d4b7651333c4944cdc3867c01c0dec53139251db15025b4da91e1443
Opcode Fuzzy Hash: 94299a2d1bb2d7ecd3d419230d3aab6ffccdad668f9775425b68f1e35e2e6b08
Instruction Fuzzy Hash: 6AA1B231B10214AFDB14DF69E854FAE7BB6FF88710F149429E506AB3A0DB719C41DBA0

Function 06C19E54 Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

\VBi, xrefs: 06C1A117

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \VBi
API String ID: 0-1049610623
Opcode ID: 157568e8d7aff3dd0964bcfda0543966ab2b5140fdfe37df9c1cdfd8f150312b
Instruction ID: 2c985a00328219e7f1e4f63cb2708bb09adf40bcf31e0857b83ad2509986d75f
Opcode Fuzzy Hash: 157568e8d7aff3dd0964bcfda0543966ab2b5140fdfe37df9c1cdfd8f150312b
Instruction Fuzzy Hash: 8EB16C70E00209DFDB50CFE9C9857DEBBF2BF89304F148129E819AB254EB749981DB81

Function 06C16FF0 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

4c]q, xrefs: 06C172E8

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4c]q
API String ID: 0-1015785248
Opcode ID: 086e55ccd72eaf63a5cb187e9406c228a2f57dc5b1ebb053e45724bc1abaed2c
Instruction ID: b1fa4b12ba0b19c829946b1298c0bb427a9dae3226213e3f4f464934255a06d4
Opcode Fuzzy Hash: 086e55ccd72eaf63a5cb187e9406c228a2f57dc5b1ebb053e45724bc1abaed2c
Instruction Fuzzy Hash: C8816831B083608FD7648769D8947BAB7E5EB43304F1448ABF449CF681D629D9C2D3E1

Function 06B7D8E0 Relevance: 1.5, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

(aq, xrefs: 06B7DAED

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: e9e3a73530f3891507bad7477f25e7d88433b0e9893726a4937e3826e0ee2cb7
Instruction ID: b95572919a2520939bcd88d346f5ded7e6f8ee6aaea56cf8e1a23b928b7b0627
Opcode Fuzzy Hash: e9e3a73530f3891507bad7477f25e7d88433b0e9893726a4937e3826e0ee2cb7
Instruction Fuzzy Hash: F491BDB1A002099FCB55CF69D890AEFBBF6FF88350F14806AE915D7351DB30A945CBA1

Function 012A9F30 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

(aq, xrefs: 012AA0B8

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: ff695f39d8d20fcf49c31f7ec7c4822ee7fac8733229b9f7256d69145420989e
Instruction ID: 34d6737124ac6d28cc3f7201bf02f47f138df124c1d195bc4539c4c81a1dc348
Opcode Fuzzy Hash: ff695f39d8d20fcf49c31f7ec7c4822ee7fac8733229b9f7256d69145420989e
Instruction Fuzzy Hash: 0A517B30B502059FDB15CF6DC494AAEBBF6AF88314F9980AAE505EB391DB71EC41CB50

Function 012ACD58 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

4']q, xrefs: 012ACEB7

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 64d248c73323a60df2f72e78407251a6c3d469235caac6b7093e84d500bfd8b1
Instruction ID: 8680d09ec6369e9d469e7c0148177b96f44c736096e9299cc0d15294379a7f50
Opcode Fuzzy Hash: 64d248c73323a60df2f72e78407251a6c3d469235caac6b7093e84d500bfd8b1
Instruction Fuzzy Hash: 07411131B442014FD719AB39A865A7BBB9AEFC6310F5485B9DA05CB391EE35CC42C391

Function 06B7F918 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

(aq, xrefs: 06B7F968

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: dc6bbc66289ebf326402ef327523f24d24eb172ffeaffaf50c1a8eed5886e9bf
Instruction ID: 179bb0e89616507151e4cf3d5a08b4a771960cbb75d2fe332073b89b074d2ad0
Opcode Fuzzy Hash: dc6bbc66289ebf326402ef327523f24d24eb172ffeaffaf50c1a8eed5886e9bf
Instruction Fuzzy Hash: 97510371B002418FCB1AAB78D81856E7BF6AF85705B1448BDD546CB3A2EF34EC06C792

Function 06B7F509 Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

(aq, xrefs: 06B7F5E9

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 04e8b798d967055aa97c2fb42240dff6844aec35b873fcf25ac20b5894fd47c1
Instruction ID: 8864b55e302c3f4f723662a9f215978d6ee7b670718f68fc43d918e8f3a74c28
Opcode Fuzzy Hash: 04e8b798d967055aa97c2fb42240dff6844aec35b873fcf25ac20b5894fd47c1
Instruction Fuzzy Hash: 1251F375E0020A9FCB15CF64D850AAEBBB6FF88300F14816AE915AB351CB71ED46CB90

Function 012A87A0 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

(aq, xrefs: 012A87FE

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 62dfbae73258348d436ec33fc310cedf37ab90d118c21c60007df63a9f98096f
Instruction ID: c1f1f841833de67f3ef5059abd8f829ba885d3921cec380e75a8e65a34984ec1
Opcode Fuzzy Hash: 62dfbae73258348d436ec33fc310cedf37ab90d118c21c60007df63a9f98096f
Instruction Fuzzy Hash: 23418B317483818FC3169B7DA81596A3FE6AFCA31079445BAE605CB356EE34CC06C351

Function 06B76128 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

L<=p, xrefs: 06B76281

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: L<=p
API String ID: 0-3877248495
Opcode ID: 959464c35d55e7437ea1d7c2f465d7d3f2019bd4b40b56b2178b3a1c6898dcb5
Instruction ID: c6ab199cfe2fa1d3acc2503042d9f6f48268c599effdf953a62ac8a047758121
Opcode Fuzzy Hash: 959464c35d55e7437ea1d7c2f465d7d3f2019bd4b40b56b2178b3a1c6898dcb5
Instruction Fuzzy Hash: 23519271B001089FDB89AFA5E95466EBBA7FFC8200F24C16DE406AB354DF759C068B91

Function 06C1D810 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4c]q, xrefs: 06C1D86B

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4c]q
API String ID: 0-1015785248
Opcode ID: ae6fbaa5792624463c50a4c0d82fe3924a03972b9bd08ad14ab2b02dae824180
Instruction ID: bbfb559a2859dd4a45756896ca455613616e2441cbb76ab741777ecc74fe861d
Opcode Fuzzy Hash: ae6fbaa5792624463c50a4c0d82fe3924a03972b9bd08ad14ab2b02dae824180
Instruction Fuzzy Hash: 8541E570B002149FEB45DF26D921B7E7BE6AF89300F14402AE506DB395DE79E901EBA1

Function 06C11F00 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

(aq, xrefs: 06C11FBD

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 62749f7747a7c6a04632797b1854a5b3e5e9032ea45d426bbaacba915f0152c1
Instruction ID: fb35ab250c5c106c21573737843252a4290f463f3abe47aa8f6eec94bb9c2ad7
Opcode Fuzzy Hash: 62749f7747a7c6a04632797b1854a5b3e5e9032ea45d426bbaacba915f0152c1
Instruction Fuzzy Hash: 7B411635B002599FCB14DF64D854AAEBBB2FF89300F148129E906EB361CF359D51DB90

Function 012A96F8 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

4']q, xrefs: 012A97D4

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: f71b4d7614b1fb0b8fe809915ce114d69ad74877e5797e1992630c49d1aad3c2
Instruction ID: 351644e2f5ba7efcb9abf257dd16d30ff40d9cc6d9d52788d3098737eec2b890
Opcode Fuzzy Hash: f71b4d7614b1fb0b8fe809915ce114d69ad74877e5797e1992630c49d1aad3c2
Instruction Fuzzy Hash: AD412330A442118FCB19CF6ED88499E7FF6BF89300B5581AAE505DB362DB30DC42CBA0

Function 05A0EF38 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

(aq, xrefs: 05A0F05E

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: b7e0fbde5a6351aaf2d08613b032a00d9e64d4dace9c8ca5a64aa96d952616d6
Instruction ID: de3c2da95beabcb4fb780dd684049c2c5d8338e42fc978bd053e58a838122560
Opcode Fuzzy Hash: b7e0fbde5a6351aaf2d08613b032a00d9e64d4dace9c8ca5a64aa96d952616d6
Instruction Fuzzy Hash: DB41EF31B142058FDB29DF69E864FAEBBF6FF84300F14946AE056A7290DB759C06CB50

Function 012A3CD0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

(aq, xrefs: 012A3DE8

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 0d00c3b8009a3b964c6d6021a3f32056dd723c260c46fa8b8506c5a915c4958d
Instruction ID: b0f4e775e73b911fc64ca773e4a0a19e8f597dc9ca325bca6a20b3004b6997a4
Opcode Fuzzy Hash: 0d00c3b8009a3b964c6d6021a3f32056dd723c260c46fa8b8506c5a915c4958d
Instruction Fuzzy Hash: AD31A030B842058FD7089F7AD8597AEBAB6BFC8700F548879E506D7396DE748C41CB91

Function 06C1179A Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

(aq, xrefs: 06C118B2

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 33b2ddf90867e4dfe21175f92d5367ce0e7a645e30d979dd6ee0b837b1059ab4
Instruction ID: 6a45e65ff946c1330d1b4aad6af5873d2240fbf8c5d5f8bc1978d68d23bb8ad0
Opcode Fuzzy Hash: 33b2ddf90867e4dfe21175f92d5367ce0e7a645e30d979dd6ee0b837b1059ab4
Instruction Fuzzy Hash: 1531A270E002099FEB54DF69D884AAFBBF6EF89310F158069E505AB350DB34AD41CBE0

Function 06B769FF Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

(, xrefs: 06B769F9

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: c74c2034aae703df8e7db9f673e1f8c38bbdb9f9cef00e84d2adb27482008cd5
Instruction ID: 4e54043ca714bbbd852d7f25847d60d4e9cc41b6fdad39a24fc6022503b72ef8
Opcode Fuzzy Hash: c74c2034aae703df8e7db9f673e1f8c38bbdb9f9cef00e84d2adb27482008cd5
Instruction Fuzzy Hash: D93113717041518FC785DF69D8989AEBFFBAF86210B0481A9E146CB372CA349D0ADB50

Function 05A0D14A Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

4']q, xrefs: 05A0D161

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 2e34aa4fd401ac899362c0d7d24dff98141e5922f170b4a536d88279540c5a43
Instruction ID: 158b416f86d7d8f40a88c7979d5e7f5f3666cd056064a896f566ff0035d93063
Opcode Fuzzy Hash: 2e34aa4fd401ac899362c0d7d24dff98141e5922f170b4a536d88279540c5a43
Instruction Fuzzy Hash: 303134323003414FC3159B79E844EAA7FAAFFC5320B04892DE5068B295DF38DD0AC7A1

Function 012A4381 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4']q, xrefs: 012A43C2

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 4fed6ca98405495dce43fa569130e35060af55727cc3dc29ed3bef69198c443f
Instruction ID: b6beaad7297476e5d24c83de9e0e7e6e1e0bbffca557112c5d73585c98889ec1
Opcode Fuzzy Hash: 4fed6ca98405495dce43fa569130e35060af55727cc3dc29ed3bef69198c443f
Instruction Fuzzy Hash: AE31AE316806028FC309AF2AE95596EBBA6FFC4340754CA3DD04687769DF74A94ACB81

Function 06B7F820 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06B7F84E

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: aaff0f9544a966c7a0e5ef62065d2523592543cf7999537808c0012b294c833a
Instruction ID: d497da96a205ebf033fcffdfbada01c8e69037e32503b576185c53b9d4472a1d
Opcode Fuzzy Hash: aaff0f9544a966c7a0e5ef62065d2523592543cf7999537808c0012b294c833a
Instruction Fuzzy Hash: 4021B070F00109DFDB549F6AD855AAEBBFAEF88750F208059E802A7361EE705D01CBA5

Function 06C1BA68 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06C1BAFE

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 89abf153e00e39b94b24a0b4c9cb6f31cc4347f79480099f520b338e0b9fba45
Instruction ID: 56641463ad6795736b947a1855a31e2817a28c475b38afbded490dcb6de6ec0e
Opcode Fuzzy Hash: 89abf153e00e39b94b24a0b4c9cb6f31cc4347f79480099f520b338e0b9fba45
Instruction Fuzzy Hash: 7B21B631B000488BCB54DB6AD994AAEB7FAFF89310F108029E502DB264DE349D00DFA0

Function 05A0CA68 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

(aq, xrefs: 05A0CB31

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 1a1aa7bd8f5dd00b0e36955bbbbaaab1e29fdd91ef94ef6dbf1af1e9346e607f
Instruction ID: 39f5213b3010b118d442f51f1039e3e429bfe95815e6d0f0ab249847aa655262
Opcode Fuzzy Hash: 1a1aa7bd8f5dd00b0e36955bbbbaaab1e29fdd91ef94ef6dbf1af1e9346e607f
Instruction Fuzzy Hash: BA21AC30B001189FDB15AB68D468BAEBEF3BF8D310F1451A9D906EB392CE759C45CB91

Function 06B72A68 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

\;]q, xrefs: 06B72AB0

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: \;]q
API String ID: 0-2696284100
Opcode ID: ce5582be37e7cd4d3839d717dc89770dcccaba18531bb1864ccb644dfbe30ee5
Instruction ID: c4fca6b7aee8b20b169927eb0ec2d8af500a79dd23042c204e05cb8319313fc2
Opcode Fuzzy Hash: ce5582be37e7cd4d3839d717dc89770dcccaba18531bb1864ccb644dfbe30ee5
Instruction Fuzzy Hash: D311C6B27042014F97689AAEA884AABF7DEEFC4264314847FE50EC3759EE71DC014350

Function 06C1B989 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

(aq, xrefs: 06C1B9CE

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 02d47d585239ed213135170daf855404e636e30584bed2bf481348d8ae0b45d0
Instruction ID: 8cb2adee1ef9d5a0d7b2cba7a6365c74bd3e694b2377b56ecb9668afab1e93fb
Opcode Fuzzy Hash: 02d47d585239ed213135170daf855404e636e30584bed2bf481348d8ae0b45d0
Instruction Fuzzy Hash: 98112B327052901FC3169738B915D9E3FBAEFC631075940AEE506CB3B2DE249D46C3A1

Function 06B7F830 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06B7F84E

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 797d7e18f8ca423d414a52425d7ed94350f02b9e722649717a4da58b804a2329
Instruction ID: 43d8936e06b620af13562ac997781d524b1a1f95e5e7a0d8dd8d3c7bdd61a649
Opcode Fuzzy Hash: 797d7e18f8ca423d414a52425d7ed94350f02b9e722649717a4da58b804a2329
Instruction Fuzzy Hash: EA219070F10105DFDB589F6AC855ABEBBF6EF88710F208059E902AB3A1DE709D00CB95

Function 062526B7 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

$]q, xrefs: 06252733

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: $]q
API String ID: 0-1007455737
Opcode ID: 01cde9d8aca228ef35ce8628fcb204c559eb1142f5425bfdbe3b3bd08af618a3
Instruction ID: 495baa8b34fcf957e58a771680ed128d534628f8869ee04cacea9e5283f89564
Opcode Fuzzy Hash: 01cde9d8aca228ef35ce8628fcb204c559eb1142f5425bfdbe3b3bd08af618a3
Instruction Fuzzy Hash: 9F21B731E31205CFDB68DB66C9946EEB7B2EF8C310F158529D801BB2A4EB345942CB50

Function 06C172D0 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

4c]q, xrefs: 06C172E8

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4c]q
API String ID: 0-1015785248
Opcode ID: 01503d211950b6970fd229f675c31ddb936a040b6d70d139f0f24c5b230a8400
Instruction ID: 06bf61157d02c5e0e7c7b5ca82d74156c0f16914792b3b8cd4b4afa616bd1078
Opcode Fuzzy Hash: 01503d211950b6970fd229f675c31ddb936a040b6d70d139f0f24c5b230a8400
Instruction Fuzzy Hash: A511B271B00215AFDB54EF7AA815B7F7BEAAB88700F00402AF505DB290EE74D901DBA1

Function 012A8D30 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

4']q, xrefs: 012A8D39

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 721e7421b3fb23be945c9c3aa7ee289c081b7ee05f87c6a8483ba4e4edc22ce7
Instruction ID: 1fbddcecc266989a9eeedf45cd09e50a6a76efaea536e23b79878fb9f5f8c32f
Opcode Fuzzy Hash: 721e7421b3fb23be945c9c3aa7ee289c081b7ee05f87c6a8483ba4e4edc22ce7
Instruction Fuzzy Hash: 4B112B31B843508FC3299F7AA01945E7FA6EF853017544E79D949CB745EE34C896CF81

Function 05A0DE6E Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

(aq, xrefs: 05A0DEAF

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: 30f90654693ddb7245c89e99b8d203b1553f22a8f58df930ba774503f977d508
Instruction ID: b18440970ecbf8db061747cb3f497667bb50cb642d0fd527e194fcc831950aac
Opcode Fuzzy Hash: 30f90654693ddb7245c89e99b8d203b1553f22a8f58df930ba774503f977d508
Instruction Fuzzy Hash: 91019C322042200FD3155B79A810EEB7FDAEFD1750F11816DE4068B695EE3A9C0783A0

Function 06B76324 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

T;=p, xrefs: 06B76374

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: T;=p
API String ID: 0-2012771354
Opcode ID: fe59ebda81b7625976e1543750d175f47f5063eeca120328ea474ad5cb327e40
Instruction ID: 575b675002fc46924c0fd16a3193402857593986eff36c2983afd263f6dbd21d
Opcode Fuzzy Hash: fe59ebda81b7625976e1543750d175f47f5063eeca120328ea474ad5cb327e40
Instruction Fuzzy Hash: 8EF02B767042411FC386566EAC649AE7FFFAFCA56033A01BBE105CB352DC268C4683B1

Function 05A0CCE8 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

k>m^, xrefs: 05A0CD18

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: k>m^
API String ID: 0-3770348103
Opcode ID: 7dddfb87494151457b85dc026c34f47569dc634188b7658db6c4e2fc52a64337
Instruction ID: c52d1a916a3a47444781403e647a05fe24f668ff5c4c55122cc5954197e31639
Opcode Fuzzy Hash: 7dddfb87494151457b85dc026c34f47569dc634188b7658db6c4e2fc52a64337
Instruction Fuzzy Hash: 53F04C336052006B83625629FC53CE7BFA9ED853A0300D65BF00ACB299DA148D0AC7F1

Function 012A8D20 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

4']q, xrefs: 012A8D39

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: baf0dfc942a91e45f25ef7bc504365543c2fddb29e151e725f19adb8f795376b
Instruction ID: 2fad745a288f6263c1e5c1e26be43e0033f7c0c0daf6b2db7f6224200472dd4d
Opcode Fuzzy Hash: baf0dfc942a91e45f25ef7bc504365543c2fddb29e151e725f19adb8f795376b
Instruction Fuzzy Hash: 1AF0AC31284A404FC32AAB3DA41559B7F75DFC6301B004B78E9848B355DB749C4AC7C3

Function 05A0CD44 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

k>m^, xrefs: 05A0CD18

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: k>m^
API String ID: 0-3770348103
Opcode ID: 6b4bb1df84bf67ff8fcb72c410737a04241c99dc5987180425c15315bd3c004f
Instruction ID: ee16e8222ac8900cdc7b9a1fa59d8185cb2ca08c417889afa774cac425912ed5
Opcode Fuzzy Hash: 6b4bb1df84bf67ff8fcb72c410737a04241c99dc5987180425c15315bd3c004f
Instruction Fuzzy Hash: 02F0E9735052008FC7529B3CB8A7999BFE5ED95390344DA9EE0468F2A9DB28DD0BC790

Function 012A7240 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

k9Y!0, xrefs: 012A725F

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: k9Y!0
API String ID: 0-1825060378
Opcode ID: 4a94354c70e9bc46c7a292fbef2a9242fc017c615e1f7720277c1eadd5ec91a9
Instruction ID: cf3281c087d0ace1fcd09038506f11cbdc2ab0498c6063de0d9f54b6a018e914
Opcode Fuzzy Hash: 4a94354c70e9bc46c7a292fbef2a9242fc017c615e1f7720277c1eadd5ec91a9
Instruction Fuzzy Hash: 42E07D3254C3840FC3128A7C18104DF7F9A8C82220B1141FFE14CC7262EC710E4987EA

Function 012A7250 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

k9Y!0, xrefs: 012A725F

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: k9Y!0
API String ID: 0-1825060378
Opcode ID: 619e347b9f7cc777fad1b1cc2b962e39995e041fc14b4ce9795122b1e8ba4e3c
Instruction ID: f1298d7c170775948fba9e030f4cbee8d03d48084b674b73b9c268c45f517ef0
Opcode Fuzzy Hash: 619e347b9f7cc777fad1b1cc2b962e39995e041fc14b4ce9795122b1e8ba4e3c
Instruction Fuzzy Hash: 50D01232A842186B4B04DAAD54114DFBF9ECA84170B11447BD50DD7255ED715A4082DE

Function 05A0D288 Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

[, xrefs: 05A0D294

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: [
API String ID: 0-784033777
Opcode ID: 09d7e44855c9fe5a23a6c95d86671759934fb519bc52de7587e5195112b7fbf4
Instruction ID: 4e99f5b94cf891b10a0b56477ed3d481cce507ec47853e876de2eb13b4db3d5f
Opcode Fuzzy Hash: 09d7e44855c9fe5a23a6c95d86671759934fb519bc52de7587e5195112b7fbf4
Instruction Fuzzy Hash: 59D0C90840A3912BCB0396219CA55E33F254B8329870949C3E0406A8A7D729955987E1

Function 06C15B58 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b8c3d6eaa4576af3649d86c7a7379ee37530058a09c0589c6938185387a083
Instruction ID: b4ea2d13ad8ae3b49abd0031fe42b4a46275ebf28409f2a075b8f7c47c116443
Opcode Fuzzy Hash: 47b8c3d6eaa4576af3649d86c7a7379ee37530058a09c0589c6938185387a083
Instruction Fuzzy Hash: 4832CF34B002489FDB54DF69D858BAE7BB2FF89310F148469E9029B3A4DB30DD45DBA1

Function 06250598 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2a24712846b5f8e528cdc03f95c2ff337532ecee85488b20bbe811e943dd1d
Instruction ID: 6ff7ba8168e95bec797006df7097d77a8bfb3bd61e094c2d7e39189e5f72f410
Opcode Fuzzy Hash: 4d2a24712846b5f8e528cdc03f95c2ff337532ecee85488b20bbe811e943dd1d
Instruction Fuzzy Hash: C6123770F106459FDB64DF68D8987ADBBB2FF88314F148129D806AB390EB789845CF91

Function 012AE7F8 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5a7ecf18f51943b19bec9ea01e8fbf22d7bd5c86aef4a7b8e9ffbe8965c8ff
Instruction ID: 631f916b1f297b9c1e20bedb34119f8eece9cd4457b000b21c3a3b6fe93d53ac
Opcode Fuzzy Hash: 2c5a7ecf18f51943b19bec9ea01e8fbf22d7bd5c86aef4a7b8e9ffbe8965c8ff
Instruction Fuzzy Hash: 87E19C707402068FD705DF79C898A6A7BB6FF88300F5584A9E906CB3A6DB34DC46CB91

Function 012AD9E0 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4bed4b1e101b443f6f0086e9f33b8c3c09ebecd2f8c74552373a05a2db6884
Instruction ID: 2bcef315e5ab9e433443c175284ce7fba5db731e595e0c884b09cf3518e210f2
Opcode Fuzzy Hash: 8d4bed4b1e101b443f6f0086e9f33b8c3c09ebecd2f8c74552373a05a2db6884
Instruction Fuzzy Hash: 5FF19534A4020ADFCB15DFA9D998A9DBBB2FF88310F548568E5069B765DB30EC41CF90

Function 06C112B8 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deaf4ad059b92db3910f68007f95eb3e0506f828d00f9cf2a755d5a0e909f436
Instruction ID: 0c7f88be86984437c9677d731801973f3ca6a54cf2297b8fedf8678e2da21abe
Opcode Fuzzy Hash: deaf4ad059b92db3910f68007f95eb3e0506f828d00f9cf2a755d5a0e909f436
Instruction Fuzzy Hash: EBE12734E003598FDB55CFA8C488B9DBBF2AF4A300F198199D505AF265D778EE85CB50

Function 06B7F9A8 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a14e6049659e1c7c5416b0b4f8601a41541ff4b1ced25f2e5f66b60e96a0c1
Instruction ID: 50401cd69e1f779f4a9ba7dad8db7972b0a9724063be9df5ab80ce7c9e3f5473
Opcode Fuzzy Hash: 04a14e6049659e1c7c5416b0b4f8601a41541ff4b1ced25f2e5f66b60e96a0c1
Instruction Fuzzy Hash: 16B1E1717002119FDB5AAF34D81863E3BE7AF85605B1488ADD606CB395EF34EC06CB96

Function 012AF6F9 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c80575b09d9dcf7353cd6e6e4c38f97ca74b3314b07d4942285ace7799b20271
Instruction ID: b606625f688b7b3cd76b46b3dac07777d1541f2a08088ba5a04435758135828e
Opcode Fuzzy Hash: c80575b09d9dcf7353cd6e6e4c38f97ca74b3314b07d4942285ace7799b20271
Instruction Fuzzy Hash: 08D13934A80219CFCB15DF75D958B9DBBB2BF88301F5088A9E90AA7391DB359D81CF50

Function 05A0DE2F Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3369049fe48714c6adc964f6360ab7e289eb164a31d95e847d96d2e13120f2af
Instruction ID: 81a57cbf86cbb942f5329ac01e5ad4b1a8810575e4377669d38e3f36053734dc
Opcode Fuzzy Hash: 3369049fe48714c6adc964f6360ab7e289eb164a31d95e847d96d2e13120f2af
Instruction Fuzzy Hash: A9D1AD34E002598FCB15CFA8D880EADBBF6BF49300F148995E851AB3A5EB70ED45DB50

Function 05A0E490 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186dc6cea4d43182ecbfece9c185186a911f832fe1e06a23a633bde14e7ffbaa
Instruction ID: f472b9de835504053792321fbdd2c93b4d81540169cd9153e6c9110ed47fda5c
Opcode Fuzzy Hash: 186dc6cea4d43182ecbfece9c185186a911f832fe1e06a23a633bde14e7ffbaa
Instruction Fuzzy Hash: CAD19C34E002598FCB15CFA9D880EADBBF6BF49300F148599E851AB3A5EB70ED45DB50

Function 06B74FD9 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88cfbed0fd2372fdaf4cca797575cb6f945573b8b5b3dac9310b11b42d2c6db
Instruction ID: b4b7f43e3956ea30118aa47419c259c0eb3f14a0e9e2f13f016aa370235f7a27
Opcode Fuzzy Hash: a88cfbed0fd2372fdaf4cca797575cb6f945573b8b5b3dac9310b11b42d2c6db
Instruction Fuzzy Hash: 09B13D75B0060A8FCB54CFA9C59099DBBF6FF89304B108469E51AEB364DB34AD05CF51

Function 06B74FE8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5786e8cd758d314e0497f036f6587c3dd5310cdffa81716741ed11c1a195ef8a
Instruction ID: cb05e8280d3a1026ee65c8de2bf800eb22f71530a565c32e618a131d53f899a8
Opcode Fuzzy Hash: 5786e8cd758d314e0497f036f6587c3dd5310cdffa81716741ed11c1a195ef8a
Instruction Fuzzy Hash: FEB13B75B0060A8FCB54CFA9C59099EBBF6FF89304B108469E90AEB364DB30AD05CF51

Function 06C1A724 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab772a71f7c0d10f04839242d68fff5da93a20871bd4078cd5557cad0aabca36
Instruction ID: bb7203c2d975c9b52a3ed83b1cde7e138c25e6876bed4d9362fb1004da084095
Opcode Fuzzy Hash: ab772a71f7c0d10f04839242d68fff5da93a20871bd4078cd5557cad0aabca36
Instruction Fuzzy Hash: 1CA16A70E01209CFDB50CFE9D98179DBBF1BF89314F14812AD819EB294EB349986DB81

Function 06251618 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8abc7814edfc0325cead19b852beef3ddea4216c8002de6f326792e5f90818b3
Instruction ID: 3c2c0738db44749ee3268f42e3fa6fe03fe098af3c87a82113eb99f63b28730d
Opcode Fuzzy Hash: 8abc7814edfc0325cead19b852beef3ddea4216c8002de6f326792e5f90818b3
Instruction Fuzzy Hash: 7D41C770A41300AFCB06DB24D519B9F7BA6FF85304F104A69D4099B295DB759D09CBD1

Function 05A0B2D0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bdac3edc38c383497fdbced3b9bf4b41abe1eb780f771e4fa1d4d68e6aa9db1
Instruction ID: e417a678834f0a087a7d7fbec80eb0ecfc7283c8829420ccb5121ba76c4055c3
Opcode Fuzzy Hash: 1bdac3edc38c383497fdbced3b9bf4b41abe1eb780f771e4fa1d4d68e6aa9db1
Instruction Fuzzy Hash: 9D918E30B102568FCB05DF39E640A9E7BF2AF44308B148969D4068B396E735ED46CBA1

Function 06C118F0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a71268ff2f4e11a98f11dfee863060c99e26ff971f262044edb8456ec8657e
Instruction ID: b4a6043e8071d5492c16e918e830b45be6aa00bf340f0f7bef7c26b43d169991
Opcode Fuzzy Hash: 99a71268ff2f4e11a98f11dfee863060c99e26ff971f262044edb8456ec8657e
Instruction Fuzzy Hash: 5C81AF74B1020ADFDB948F65C8548BE7BFAFF8A250B184429EA169F710DB34DD05EB90

Function 06C11BC9 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579674f1d19144f647ea13fb0b7b3460918f6590cdf0c95ade2b401d318a865e
Instruction ID: 2dcbf87ec0bd15b22e0386d0c4d933fa3fdc5c45172b74246e7ba59f3028f569
Opcode Fuzzy Hash: 579674f1d19144f647ea13fb0b7b3460918f6590cdf0c95ade2b401d318a865e
Instruction Fuzzy Hash: FCA1D635A11109DFDB55DFA4D994DAEBBB2FF89300F148059E901AB360CB31ED52EB50

Function 06C1DEDE Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003b316ec51d86dc2915b63cbfcea4f8fec61ae8f32cb95b442a192d3458a759
Instruction ID: 9967a61bed090bbcf9b722d901bd6e10415c8bd5fa276a46aa83bd50eef53f47
Opcode Fuzzy Hash: 003b316ec51d86dc2915b63cbfcea4f8fec61ae8f32cb95b442a192d3458a759
Instruction Fuzzy Hash: FE81AF30B052528FCB05EF35D98049EBBB6BF86204714897AC845DB36AEB35ED47CB91

Function 012A98A0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 220c7d08f3516f45c2a818f8c9c60fbbe8fa36614bcb940ae41ece8b2a0f086b
Instruction ID: c80617ca22e51b60234ec296928aaeea7027452bba89b6a554a2a25603dab923
Opcode Fuzzy Hash: 220c7d08f3516f45c2a818f8c9c60fbbe8fa36614bcb940ae41ece8b2a0f086b
Instruction Fuzzy Hash: 6261C530B453128FDF155F7B942826E7ADAAFC9345B844479E906C7396EE38CC82C791

Function 06C1E298 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e131832726040dcdbf949fee14c78a36773dbeb49b1e5d208b7f6cc293a962
Instruction ID: 1a27d19bdfc3da107a9e65f1b7917cb6d34bdaf8f6b782390e99358ba0085f9c
Opcode Fuzzy Hash: 86e131832726040dcdbf949fee14c78a36773dbeb49b1e5d208b7f6cc293a962
Instruction Fuzzy Hash: 4D718C30B102059FDB54DF79D954A6EB7F6AF88300F14852DE80ADB3A4EB34E946DB90

Function 06C1FC08 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0faffac8c8684a12e1698cfafa56f72183c15040bde10809c785d11ee0b6ac8
Instruction ID: 91c5c19cfaf641d1e6eccf710ccea98d257d643fcd740b0077bb5864d9411fdb
Opcode Fuzzy Hash: e0faffac8c8684a12e1698cfafa56f72183c15040bde10809c785d11ee0b6ac8
Instruction Fuzzy Hash: 77818D34A002088FDB54DF68D560BADBBF2BF89300F24815DE815AB365DB31EE42DB90

Function 06C1E288 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcccda775b543fbdab0aae96ba5e1a0564e5007179e7cbf41bbecad699051ea6
Instruction ID: 8131d913e79dd2cbbba75924b1548ddad57704bdcfbf0f0b65e4f45ef2f21f50
Opcode Fuzzy Hash: bcccda775b543fbdab0aae96ba5e1a0564e5007179e7cbf41bbecad699051ea6
Instruction Fuzzy Hash: 8161DF70B002059FDB54DFB5D954A6EB7F6AF89300F14852DE80AEB260EB34E946DB90

Function 012AD9D0 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d12fa3789c7acda4f706e75818f68022b15e5d31a11793100e71c76a02c783
Instruction ID: b968e4d84bce24c2ceb43a548d5743b51981458b892361de5fdfac05128ffc22
Opcode Fuzzy Hash: a3d12fa3789c7acda4f706e75818f68022b15e5d31a11793100e71c76a02c783
Instruction Fuzzy Hash: 59815E34A40209DFCB04DF69E598A9DBBB2FF88311F548568E9069B361DB70EC85CF90

Function 06B7C553 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cfc7ed2f9d644fb28495b703f04aa88aaa5ca01cea4d28deaaa219c7495eacf
Instruction ID: d31ea8ca19421ac5965b37d4ae388d5934b6ae1ef2d2029d05d30d280c4f1733
Opcode Fuzzy Hash: 1cfc7ed2f9d644fb28495b703f04aa88aaa5ca01cea4d28deaaa219c7495eacf
Instruction Fuzzy Hash: A77107B4A00209DFCB44DF68E994AAEBBB2FF48310F149169E915A7360DB30EC51DF60

Function 06C1FBF1 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3693a1021862620dd91f06e4b4c3c1a4dc7f5f337bda7d120243219f12996e
Instruction ID: f2bd7b265512999a399b654adec34d3d3cbe90234c70a03873f04b3b3f30edc6
Opcode Fuzzy Hash: 8b3693a1021862620dd91f06e4b4c3c1a4dc7f5f337bda7d120243219f12996e
Instruction Fuzzy Hash: 50619C74A002088FDB95DF68D150BADBBF2BF8A300F24819DE815AB3A5D730DE45DB90

Function 05A0FA08 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed97dc55533adc68af87f3e83fb4daaa0c41edb52784936fdac71e3ba0f6ffc0
Instruction ID: 254ec68cac55d7eeead363b32c10d579a877b2202f0d9e0eb5dfbdab0cfda5d7
Opcode Fuzzy Hash: ed97dc55533adc68af87f3e83fb4daaa0c41edb52784936fdac71e3ba0f6ffc0
Instruction Fuzzy Hash: B451F6347241118FC768AF29E4A4D2A77F7BFCA701329A4AAE106DB3B5DA71DC05CB40

Function 06C121E0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a50ccdf994a32147ad6afc5650b91b670bf2cca0dc26b2da42acf3b7d2daf7
Instruction ID: 32148f2df33ddd67b8984f95a009f59dde5d6ace1c3379291ff3f6e6b6336d59
Opcode Fuzzy Hash: 69a50ccdf994a32147ad6afc5650b91b670bf2cca0dc26b2da42acf3b7d2daf7
Instruction Fuzzy Hash: 4651D235A142008FCB69DF68C49896DBBF6FF8B32071541AEE5069B272C734AE81CB40

Function 012AD320 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5da63f786e305ea720f780258cc9451a0e177b999a2ef01d0737f5ba930094
Instruction ID: a7f29f51957a1e664b5ce166a51917e93504e53e83781bff3a2c474968407f79
Opcode Fuzzy Hash: fc5da63f786e305ea720f780258cc9451a0e177b999a2ef01d0737f5ba930094
Instruction Fuzzy Hash: 61510B34A5021DEFDF15DFA5E858AEDBBB2FF88311F504429EA01A7760DB30A841CB50

Function 06C1BC88 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e676d008cdf30e1bf41c5e8a11c375d6e5635841b4b15db5addf1d2ed78549
Instruction ID: 09ee379baafde0c0192ae75a8d8f8d9282da0c0f49f8e3f283d70a7b3a4c4e3c
Opcode Fuzzy Hash: 35e676d008cdf30e1bf41c5e8a11c375d6e5635841b4b15db5addf1d2ed78549
Instruction Fuzzy Hash: A7517C307002458FCB44DB29D998AAEBBF6BF89310B1581A9E109CF3B5DB70DE45CB90

Function 012A8FD8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce0ea28b52a4f1568bde3986ca047d285eea6a2c10d7e094acafc43be651572
Instruction ID: 58ab29aeb9eab40a4c85291cee13cfc1c3fdf3f1f8a1d252c829a24f8de68e32
Opcode Fuzzy Hash: 6ce0ea28b52a4f1568bde3986ca047d285eea6a2c10d7e094acafc43be651572
Instruction Fuzzy Hash: 5341E434B842549FCB065FB9982885E7FF2AF8A30074584A9E60ACB366DF34CC51DB81

Function 012A32A8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c878b1368834eca4c1da35cea6746649d7edc8c12befb97d4e050c5943809d
Instruction ID: f60e9885f33b1d9eb2167aa8e885327af42bd07eb5972637999b2df4509c20cc
Opcode Fuzzy Hash: c3c878b1368834eca4c1da35cea6746649d7edc8c12befb97d4e050c5943809d
Instruction Fuzzy Hash: 9841B330A402059FC718DF75E996B6EBAA2FF84300F40883DE6029B3A5DE749D45DB91

Function 05A0B6B8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ecb61a61bdc887d1aec8612f8b789b705d768defcb34c723b6c864f815bef1
Instruction ID: bef9395b82f26cd119c60ac7db5cd42973959ac051260b772448a2bef50ae935
Opcode Fuzzy Hash: 80ecb61a61bdc887d1aec8612f8b789b705d768defcb34c723b6c864f815bef1
Instruction Fuzzy Hash: 91515D30A61209DFCB54DF68E598EAE7BF2BF48300F205469E406EB3A0CB709D45CB61

Function 06B77768 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14e3e0904b6958613633c7aed5ca8719fbbfeca6e950ad3e51873bc4720ff4c
Instruction ID: 70b79eaad884734600e40e4613b7908c5a587de3d458f2f608fde732f4152385
Opcode Fuzzy Hash: f14e3e0904b6958613633c7aed5ca8719fbbfeca6e950ad3e51873bc4720ff4c
Instruction Fuzzy Hash: 45416CB9F102058FCB94DF69D980AAAF7B5EF88210B1581B6D919D7361DB31EC01CBA1

Function 06B738B0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62292ab25115b741b9ac9e5afbd107dda6e51758e8850a94a24e1013acd0583a
Instruction ID: 5230fab51eacabdf616018ed4812120ee77dd11412b4824597296d9b969f403d
Opcode Fuzzy Hash: 62292ab25115b741b9ac9e5afbd107dda6e51758e8850a94a24e1013acd0583a
Instruction Fuzzy Hash: 7B41AD74700B018FCB959F25DA8496ABBF6FF8960070499ADE967873A1DB30ED05DF80

Function 06B7BC08 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c4d980ca0c4b6b78e19c2facae2dbf660e33be7b4dea9a666173f0496c7c0d
Instruction ID: ebdf8dc8608496e4fcbd4253235073a3411c17c50df7106ce0b2a969b7d9fef0
Opcode Fuzzy Hash: f1c4d980ca0c4b6b78e19c2facae2dbf660e33be7b4dea9a666173f0496c7c0d
Instruction Fuzzy Hash: F241E335700204DFDB658F39D858B6ABBE2EF88311F1494AAE9568B3A1CF71EC41CB50

Function 05A0B13F Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cf376b43476f7467d64d7b893cbff9ad9409ad6e51aff975c9e3408bf9776bd
Instruction ID: 94c3571842e7532069efb1036b5f37966a79e54f3b5a74b40e1f95e5b6b23c47
Opcode Fuzzy Hash: 3cf376b43476f7467d64d7b893cbff9ad9409ad6e51aff975c9e3408bf9776bd
Instruction Fuzzy Hash: 1E41B271B002159FCB58EF35E9459AF7BE6FF88214B148629E40AD7249EB30DD06CBD0

Function 06251F58 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae58ef6bcd732960b339587f2493a44ed21e446376759839a67ecec02246e928
Instruction ID: 02cb463a87db9181b5dc8454c0737025b75d9640d353d0187ee5b914e42ba7c3
Opcode Fuzzy Hash: ae58ef6bcd732960b339587f2493a44ed21e446376759839a67ecec02246e928
Instruction Fuzzy Hash: FD41D4313153018FC368DF29D99092AB7E6EFC9314711856DE84ACB3A5DB35EC46CB90

Function 06B74E70 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4c3304474fe2f219175e11cc9f9a85354099ca1fec9914104e282955077eda
Instruction ID: 630a0c3c80b4bf707afc5998ac023a4b44546c9a12bdd3e35e20902c21e741bf
Opcode Fuzzy Hash: 1c4c3304474fe2f219175e11cc9f9a85354099ca1fec9914104e282955077eda
Instruction Fuzzy Hash: 66418372900605DFCB65DB64E949BEF73F6EF80301F048569E11A9B2A0CB78A949CBD1

Function 05A0B150 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64db3da0992d047d50947892a12ac7e5e4c88edf900196db5260aed10fa7f259
Instruction ID: 2538a5f93222d7050b1612f45f8f37d91e4657f6ea46fc05b6fdbc663d060160
Opcode Fuzzy Hash: 64db3da0992d047d50947892a12ac7e5e4c88edf900196db5260aed10fa7f259
Instruction Fuzzy Hash: B7319331B002159FCB48EF79E945A6F77EAFF88214B148629E40AD7349EB34DC06CB90

Function 06C1BC78 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd1a3eaccf4e0da145f9120a83e3791e54c77b13e13d053fe332d35e2507190
Instruction ID: 1a679ec7e63efdbc9f25b04d9046184a7e74cb84a784026dd9bfb65941e872dc
Opcode Fuzzy Hash: dcd1a3eaccf4e0da145f9120a83e3791e54c77b13e13d053fe332d35e2507190
Instruction Fuzzy Hash: D34126347001058FCB44DF29D988AA9BBE6BF89710B258169E50ACF3B5DB70DD45CB90

Function 06B728F0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb44698f7fa5fa3c9970d8ea7c1aa1431e5789db1ccc160a8721e8604b8a320
Instruction ID: 6c772b3d84d92a18edd8674f3c5dd8e29916593c72ce8a248683c5170c85d6ea
Opcode Fuzzy Hash: abb44698f7fa5fa3c9970d8ea7c1aa1431e5789db1ccc160a8721e8604b8a320
Instruction Fuzzy Hash: 42412C70B002059FDB54DBA8C491B9EBBF6AF88310F1880A9E815AB365DB71ED41CB90

Function 012A7060 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3eee387b83885683f4e688885a1b131a5041904b7abf8215612d08bf334c6af
Instruction ID: dbf4455335a544ad2ec2f6f3ab7fc1cae9ee13f72ca9c583587be44ed38837c4
Opcode Fuzzy Hash: f3eee387b83885683f4e688885a1b131a5041904b7abf8215612d08bf334c6af
Instruction Fuzzy Hash: 71310E30B842868FDB05EB79D8157AE3BB2AF81300F5080B6D501EB396DE399D05CB96

Function 06B78F22 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc0103ddf145f45f839cd064dd004ae7e3f86073f283cb8212a14d1f4bfd429
Instruction ID: 2f8b2e92f38a4dae9d64029c4ba973c2040ce8f6bcc0195b21b06984db3ceadf
Opcode Fuzzy Hash: abc0103ddf145f45f839cd064dd004ae7e3f86073f283cb8212a14d1f4bfd429
Instruction Fuzzy Hash: 56416C74B042008FDB959F68D45876EBBB2FB88300F1098A9E556CB395DB34E941CB95

Function 06251740 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 037eac10a6ade6bbacb8d0f168decb29ea0651f9c8c554df9c7b5d021b36460a
Instruction ID: 0bb2502834ebcec678e015b91d7a313149ced6f7324597391861a401a48e583d
Opcode Fuzzy Hash: 037eac10a6ade6bbacb8d0f168decb29ea0651f9c8c554df9c7b5d021b36460a
Instruction Fuzzy Hash: BA41D770A41304AFCB06EF24E50ABAF7BAAFF84304F104669D4098B395DB759D09CBD1

Function 06B78DA0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c3aae333a8275e0af1cefc8505b037b33414cbf35f14983713265a30fc793b
Instruction ID: f47186226832c712c1378db6ef513d6ea784c67055e4f456a1486c34b88e8b24
Opcode Fuzzy Hash: 77c3aae333a8275e0af1cefc8505b037b33414cbf35f14983713265a30fc793b
Instruction Fuzzy Hash: FC313575760024CFCB84DF28D9988A9B7B6FF49A1075181EAE516DB371DB31EE14CB80

Function 05A0B6A8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bba4d08870ffa1691227b80d8fa6f2e79af15ee0ed8e2ab3aa8c00f89c51a47
Instruction ID: 9443456728b392ab34fe7b09946acb5fb9f7631a24873c0cce5b2da33aa66bf8
Opcode Fuzzy Hash: 8bba4d08870ffa1691227b80d8fa6f2e79af15ee0ed8e2ab3aa8c00f89c51a47
Instruction Fuzzy Hash: 06317C34A11119EFCB14DB69EA98EAD7BB6FF44311F105069E4029B7A1CB31DC41CBA0

Function 06C1FE05 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9949dd763ac055628e8a7305d11755c29dd7f2e16cca6104cd086c9c1a953769
Instruction ID: 1b0a4bfb8a39bbf9c62d3fa2917239bb3f34450b7ab713cb63d069266d254e41
Opcode Fuzzy Hash: 9949dd763ac055628e8a7305d11755c29dd7f2e16cca6104cd086c9c1a953769
Instruction Fuzzy Hash: 49317C75B002099FCB08EF64E9509ADBBB7FFC4710B108918E816AB368DF34AD05DB84

Function 06B72BC9 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2467221cc07b8f1b548f845cc5a577e523e524a15639e8d70084d5ba03c9f8c
Instruction ID: dd3f73e95dd45d07cef349cb08391dc2990a3aa894a933571254f13affe7edb4
Opcode Fuzzy Hash: b2467221cc07b8f1b548f845cc5a577e523e524a15639e8d70084d5ba03c9f8c
Instruction Fuzzy Hash: 7131C572B041048FDB60DF7DD880BAAF7E9EFC4251B1480BAD929C7745DB31EA418791

Function 06B75858 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e57a716905ea41eb69f0b53537d36a7a1cb775a745611be69bdd3f92810f611
Instruction ID: 4bce037d65164f64086655a19d009b788ba2aec0d401d2d339a2a849ea59732e
Opcode Fuzzy Hash: 4e57a716905ea41eb69f0b53537d36a7a1cb775a745611be69bdd3f92810f611
Instruction Fuzzy Hash: AA317EB2E102199FCB64DFA9C85099EBBF2FF89240F1084A9E415EB351EE70DD02CB51

Function 012A77D8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fca5c5921a86ff730907ad5cb6101a3cef9489738017f4551d43f9b3ce96c9
Instruction ID: b27f0738edce2332d31b9ab634295e4a6c9bd61b50141f412fca73bf39f9148b
Opcode Fuzzy Hash: a0fca5c5921a86ff730907ad5cb6101a3cef9489738017f4551d43f9b3ce96c9
Instruction Fuzzy Hash: 7231BD32D007578ACB11AFBAD8106C9B770FF89314F248726D14977241EB30B5E5CB91

Function 06C17F75 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2df5f4be5f972b9b8ba0e2433907a2b69d9e2b77a9b4e4f531494777d3698fe
Instruction ID: 1b6a0801ba709fd6f7a383e23bdf096e4f3d30ce081b16b8d35b0ee55e99acfe
Opcode Fuzzy Hash: b2df5f4be5f972b9b8ba0e2433907a2b69d9e2b77a9b4e4f531494777d3698fe
Instruction Fuzzy Hash: FA4101B0D01248DFDB10DF99C984ADEBFF5FF48310F24842AE409AB254DB759A85CB90

Function 06250284 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5620df3074df72c07e7d413efbc50046c87d7d2cdd886a845cbf6969586430f6
Instruction ID: 22803afe56b78d0a77ef8c0156616520d1e0c0781e21641d6f49e49dc9c24456
Opcode Fuzzy Hash: 5620df3074df72c07e7d413efbc50046c87d7d2cdd886a845cbf6969586430f6
Instruction Fuzzy Hash: 81319576F2011A8BDB54DEACDC449AFB7B5EF84320F228926ED21E7291C7719905CBD0

Function 06B738A0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083a1e4a0c4c91c7e731099a6f650537d7100ec9c5299d58f2e8bf4942ee3406
Instruction ID: 5a7e9d44ba224295382fac2020470c3ae56927956ae4c79e65d4c55550bece59
Opcode Fuzzy Hash: 083a1e4a0c4c91c7e731099a6f650537d7100ec9c5299d58f2e8bf4942ee3406
Instruction Fuzzy Hash: 1431A175700B418FC7949F25D98486ABBF6FF8A60031485A9E967C7761DF30ED05DB40

Function 06C1E168 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf436dc9280b77d8712ddc101b29ded1b2c8a6003077184c279bab548900345
Instruction ID: 96d9656ddedd9ac5c428787711771beae85688c41a69d1b8eff2d352d7ba5fa2
Opcode Fuzzy Hash: 1cf436dc9280b77d8712ddc101b29ded1b2c8a6003077184c279bab548900345
Instruction Fuzzy Hash: 6431D130F113629FCF15AB76995442E7BF2AF9B214714487ACA46CB355EA30EC06CB92

Function 06C12561 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c2203c8c470c12fd4a0ea84e0bc1927bd6173e6e616fc04eb6915cccf505fc
Instruction ID: c15f74da0c67398b2f955deb1d37b86a03e787b42a21ba09a0984f879d76e1f2
Opcode Fuzzy Hash: 75c2203c8c470c12fd4a0ea84e0bc1927bd6173e6e616fc04eb6915cccf505fc
Instruction Fuzzy Hash: 693174347002099FDB65CF25D884A5B7BE7FF8A254F048429F846CB261CF74EA95EB90

Function 06C17F80 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d4066ed15e5fe28139fb1bdefe5dcb75d4cfb23644fafa57e75501e3a54519
Instruction ID: 2ae6eb1aa2447874ab25f79ba5e4ac151653714de0e6b4e443f9f7c20860f076
Opcode Fuzzy Hash: 99d4066ed15e5fe28139fb1bdefe5dcb75d4cfb23644fafa57e75501e3a54519
Instruction Fuzzy Hash: 6041E0B0D0124DDFDB10DF99C884ADEBFB5BF49310F148429E409AB254DB75A945CB90

Function 06C1D9DA Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305c01a8d8b2354957e51456d933b5290400de50aa99d5e888184f6881b47204
Instruction ID: 95bcbd03558341c688eefefe77a604358f99d321877b39cb6a6f4b8993566b6e
Opcode Fuzzy Hash: 305c01a8d8b2354957e51456d933b5290400de50aa99d5e888184f6881b47204
Instruction Fuzzy Hash: FE3170716406069FCB55DF69E980D4ABBB9FF443147008B29E0598BA25D774F819CBD0

Function 05A0FCE8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8ec89471d2180158490e88388189ebb88bd1170200d5ac7748d0f36edd1c79
Instruction ID: 0285281e8077833f601c3e904448ffc08749af309c8c81e5604c2d22e5a384a5
Opcode Fuzzy Hash: ac8ec89471d2180158490e88388189ebb88bd1170200d5ac7748d0f36edd1c79
Instruction Fuzzy Hash: 2E317430B102059FDB149B69D459FAE7BF2AF88714F249419D502BB3E1CA749C45CBA0

Function 06B7D0CE Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044e6ec030f8356ea82c9d998f9ee4330045e422861db507fa6174b8c8370146
Instruction ID: b3aa68918175c960208460572ad4a641f3f54dd1957174346fc86ab4fe1deb0e
Opcode Fuzzy Hash: 044e6ec030f8356ea82c9d998f9ee4330045e422861db507fa6174b8c8370146
Instruction Fuzzy Hash: 2F31F572700525DFCB51DF58D884859FBA6FF8436034AC5AAE17A9B651C730FC59CB80

Function 06C1E560 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbedf2c82d6cfa38a4f653304bd31df5e724500b1b7721b0c7cd521d17eb86bf
Instruction ID: 1c2ce64aec7ae7e81ff3b9b76eb9a4176a3ba8b487387f105226cdee3a59e41d
Opcode Fuzzy Hash: cbedf2c82d6cfa38a4f653304bd31df5e724500b1b7721b0c7cd521d17eb86bf
Instruction Fuzzy Hash: C221C431B062629FDF152B35590002E7BE7AFC662936C4C6BC949CB345EE39DC078782

Function 06B76A4F Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb69e27c471efb49751ecd1ba820cfe3f1c436439830ad84e24921ccda811193
Instruction ID: 5c10911a85a003083b0bf5470e22a2e1da3c118012142408191ddaa040931859
Opcode Fuzzy Hash: bb69e27c471efb49751ecd1ba820cfe3f1c436439830ad84e24921ccda811193
Instruction Fuzzy Hash: 7431AE713046158FC7599F29D898D6EBBFEEF8A2013048569F146C7372DA74EC0ADBA0

Function 012AB8B8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b62e2fc4c33fee7e8f46277b74a428d36dfd2b799d199edebca324469fc545
Instruction ID: 2c518a2923b4a0e087d527099be35f6ef062914518a256b96978b59db0c24eae
Opcode Fuzzy Hash: 90b62e2fc4c33fee7e8f46277b74a428d36dfd2b799d199edebca324469fc545
Instruction Fuzzy Hash: DC31C2307802028FDB05DF29D588A6ABBF5FF85315B948568E4068F366DB75EC46CF90

Function 06C1DDC7 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bb32cfebaa13f17d5245f7b039e89cfff9aac54a7e7e45fce7833c06b8befe
Instruction ID: d6f0be3c693afc700c50ec3b0797f4797d88490d5390c13a97380c0860880d60
Opcode Fuzzy Hash: 53bb32cfebaa13f17d5245f7b039e89cfff9aac54a7e7e45fce7833c06b8befe
Instruction Fuzzy Hash: A931C631A0050A9FCB05EF68E98196FBBB6FF85300B14C669D4499B349DB30AD46CBD1

Function 012A77E8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d5f85213ca6e6b4c39b281a79f0240c15f33e1dc020718db61fbd6d524c0c6
Instruction ID: f005bb294089feebec10bbcbc7ea6da0b86f64e607b5642fadeabb99d97e3b59
Opcode Fuzzy Hash: a2d5f85213ca6e6b4c39b281a79f0240c15f33e1dc020718db61fbd6d524c0c6
Instruction Fuzzy Hash: CD317A32D007178ACB11AFBAD8006D9B3B1FF99324F24872AE55977240EB30B5E5CB91

Function 012ABA41 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d9a781f2d50d9b3882aa70d782ba4c7ef4372a3a12672ce1a1bd98f8944bbc
Instruction ID: 03a74afa68ff21b542d22f9cbffd9988049a0d69ff544ab737bd018bb3460554
Opcode Fuzzy Hash: 97d9a781f2d50d9b3882aa70d782ba4c7ef4372a3a12672ce1a1bd98f8944bbc
Instruction Fuzzy Hash: BB21FF317102028BCB15DA398C91ABAB7A6EFC5340B94883EE909DB395EA31CC03C752

Function 012A3CC0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c564d35ba8440acebc1f403f85a9bc13c6689cbd1176a34ce035ca3c867c6de0
Instruction ID: 6bb8b45fb5ef6a49b561f6929d2ff0637cc1f58dbd2016f00002356707dacf58
Opcode Fuzzy Hash: c564d35ba8440acebc1f403f85a9bc13c6689cbd1176a34ce035ca3c867c6de0
Instruction Fuzzy Hash: 73218F31B50205CBD708DF6AD889AAEBBAABFC8710F544438E50697351DF758C46CB90

Function 012A4929 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79680eece60d690bcc0872793d57a10ccbc40e84f2ebcb5100efa538f90f8562
Instruction ID: 9af13e577ef1d4a2f82ddb3ec6cd8e20745b8e31d0b932b50c9bd6aeccb94a8e
Opcode Fuzzy Hash: 79680eece60d690bcc0872793d57a10ccbc40e84f2ebcb5100efa538f90f8562
Instruction Fuzzy Hash: 23310431E007478BCB15AFB9D8102AAF770FF85304B10CB3ED559A3241EB34A995CB91

Function 00FDF184 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901023025.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fdd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc44f63e4de537fe98d07acdb04d4144f068ad439d7ad9471665b119fece9edc
Instruction ID: dc612fa068d20dea4516be681f6478dc659519a4ff02171f06a4a50cd9df7f2f
Opcode Fuzzy Hash: dc44f63e4de537fe98d07acdb04d4144f068ad439d7ad9471665b119fece9edc
Instruction Fuzzy Hash: 9031EB76500240EFCF069F54D9C0F167F66FF98320F2881A9ED0A4A35AC336D855EB61

Function 06B76A60 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3192db8aee6ac2c805725402d038e7380d319d9abb969d72865ebb1dd8bdae74
Instruction ID: e691dc4862adf08c1a3b9ea4cb584ebe56ebb17a416d629dd50e34a41e3e21bb
Opcode Fuzzy Hash: 3192db8aee6ac2c805725402d038e7380d319d9abb969d72865ebb1dd8bdae74
Instruction Fuzzy Hash: 8721BD313046158FC798DF2AD88896EBBFAEF892057048569F146C7772CA74EC0ADB60

Function 06C1DDD8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b6803a1fe21bed8a9b2363db909156b40c5dd5da959aa3e94ad98c08e69ed0
Instruction ID: 3673d30da5651e5839755217c436515cf594daec000fa20548bbca022d012295
Opcode Fuzzy Hash: 53b6803a1fe21bed8a9b2363db909156b40c5dd5da959aa3e94ad98c08e69ed0
Instruction Fuzzy Hash: 17317F31A0050A9BCB04EF69E98196EB7B6FF89310B10C629D4499B349EA30FD46CBD1

Function 06252500 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9160e1050c696e9a5c5cefbc4c2b90e2497f5d34e13a80a1de4d6afd1f92f1
Instruction ID: f5798f2861941f8dda79a217e89bcf0320cf2f45597ae5590c42868c04252a9f
Opcode Fuzzy Hash: be9160e1050c696e9a5c5cefbc4c2b90e2497f5d34e13a80a1de4d6afd1f92f1
Instruction Fuzzy Hash: 8C31CA31240A069FC755EF29EA80E46BBB9FF453147009B69E0458BA3AD774F90ECBD1

Function 06B73DC8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d876a864dbea7fb2cc84887dfd5cd37c2b5a7b98b9500ab134b877dd1a295f
Instruction ID: d6a4a9543eff400391bd75975bfc228c1f435d2f6fa9600224eb66c4d464d32e
Opcode Fuzzy Hash: c6d876a864dbea7fb2cc84887dfd5cd37c2b5a7b98b9500ab134b877dd1a295f
Instruction Fuzzy Hash: 82318F35314605CFC364DF39D484926BBF6FF893007048AA8E15A8B766D731EC06DB90

Function 012A4938 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0f203a67ca18234b0e569f12e8ab8f59fae09f2ce73f3d0c55fd77b64b9cb7
Instruction ID: 4fa7a024bb4ab67c3b19ac000bb971a302a41b61971be3eebae75343196dde8e
Opcode Fuzzy Hash: 0a0f203a67ca18234b0e569f12e8ab8f59fae09f2ce73f3d0c55fd77b64b9cb7
Instruction Fuzzy Hash: EB31E831E4061B8BCB15AFB9D8102AEB3B5FF84304B10CA3ED559A3340EB75A995C791

Function 012A7B81 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f005846c0cd4eeb919c60bec19a5d935736648deae91f909f32820ebb355987a
Instruction ID: 65d7e7d0c53511a6721474ba3884d12d370ccc26455131c30d21aa117fab4bc6
Opcode Fuzzy Hash: f005846c0cd4eeb919c60bec19a5d935736648deae91f909f32820ebb355987a
Instruction Fuzzy Hash: 7121F830FD42908FCB1A5F37701837A3FA29B45701BC04C7DD647CA285DE268991C719

Function 00FDF088 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901023025.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fdd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c55d5717fa890106918026b6d7495a2786815420078f77ab7c0fac4578522af
Instruction ID: 550dad529ed1dd6f0a5410f26eabb2713cf4d500535172be8347d625a0cda841
Opcode Fuzzy Hash: 1c55d5717fa890106918026b6d7495a2786815420078f77ab7c0fac4578522af
Instruction Fuzzy Hash: A921D672500200EFCF059F54D9C4F16BF66FB88324F28C5AAE90A0B356C336D81AEB61

Function 06B75848 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b5f6eb132a21863b5692091822956194295206c1cd7d033e4c44ac353ae62e
Instruction ID: 4d6707c3c3a4190cd946f65341c2be34af0390434b0b8808c973b614a0177935
Opcode Fuzzy Hash: a9b5f6eb132a21863b5692091822956194295206c1cd7d033e4c44ac353ae62e
Instruction Fuzzy Hash: 15316FB1E1021A9FCB54CFA5C89499EBBF2FF88210F108169E415EB350EB709946CB51

Function 012A1272 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bed5030330d18b81a5d870d4f9373c939a49702763301de4738e447b5be20a
Instruction ID: a298d2c73cc898857e1ce2508ddb5cbe20f139f2ee641f9d51241e64c2c76376
Opcode Fuzzy Hash: a4bed5030330d18b81a5d870d4f9373c939a49702763301de4738e447b5be20a
Instruction Fuzzy Hash: 74316934A10215CFCB09EFB8E85895D7BF6FF85304B504AA9D10A9B265EF30AD15CB52

Function 05A0FCD8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53ad2f09c181bc5d18f3d51c31a1b141f1384b2ed17525f59840c1b58ed849d
Instruction ID: 71eb82dacf44ce77f8a40bec9cae555c969c1f8c15df61671a890935430075c6
Opcode Fuzzy Hash: d53ad2f09c181bc5d18f3d51c31a1b141f1384b2ed17525f59840c1b58ed849d
Instruction Fuzzy Hash: 7D21B574B102058FDB149B79D469FAE7BF2BB88714F149429D506BB3D4DE748C06CBA0

Function 06C14EE9 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2e61174bdaa69de134ae0b61569f882991fd8e1107442b66c065f35885e804
Instruction ID: 5e5bca0ff60bd9ba6543e0f6c57a17d14b0f81b8e6608197583230da2ef13969
Opcode Fuzzy Hash: 6b2e61174bdaa69de134ae0b61569f882991fd8e1107442b66c065f35885e804
Instruction Fuzzy Hash: 4531F878A10104DFD754DF69C598E9A7BF5EF49715F1580A9E402AB361CB31EC41CFA0

Function 00FCD7EC Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3900963368.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fcd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c79d66eda48b3f9648f008946e71a75b87a13e5bd3d8dfbedb00894d6a80c7
Instruction ID: d88bee817f49dd2bb5dc7e580153de832efd72f0c83c84b3b90527fa5fe523ba
Opcode Fuzzy Hash: f4c79d66eda48b3f9648f008946e71a75b87a13e5bd3d8dfbedb00894d6a80c7
Instruction Fuzzy Hash: CD210872500245DFCF059F14DAC1F1ABF65FB98324F24857DE9090A296C33AD815EBA1

Function 012ABA50 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d903ce7597b429e45b182ea46a1df7acbc86eec2929cf758ef58766fedbfe6e5
Instruction ID: ac9d509d46bb27f7d1f3cd25ee0c5b181678254f4f42ff86f5a56158fd4d3be6
Opcode Fuzzy Hash: d903ce7597b429e45b182ea46a1df7acbc86eec2929cf758ef58766fedbfe6e5
Instruction Fuzzy Hash: C321CD317102068BCB14DA39C991ABEB3A6EFC4344BA4882ED909DB344EA31DC03C792

Function 06C1E552 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bae8ae41426b0ca51607aa62898cc720f6aadef17b59b3f152995e9ba945d3
Instruction ID: 630beb3382ba044ce86e9b9ea1c5b482afaabe5c11da373807b52f4f9e5f6098
Opcode Fuzzy Hash: 64bae8ae41426b0ca51607aa62898cc720f6aadef17b59b3f152995e9ba945d3
Instruction Fuzzy Hash: 7F219531B062629FDF162B35450001E7BE7AFC661536D4C6AC989CB345EE38DC47C782

Function 012AE880 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806faab0cb2f616c2590b687eca6382402e1f4df9d0fd200d92bc35459211409
Instruction ID: 6b8f17b1e7979071b2e07dea2415dfa77a24e92bf774016583abb219719aae51
Opcode Fuzzy Hash: 806faab0cb2f616c2590b687eca6382402e1f4df9d0fd200d92bc35459211409
Instruction Fuzzy Hash: F821AE34A0024A9FDB11DF68C8989AE7BB1EF89310F558069EE458B361DB31DD42CBA1

Function 05A0CA58 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e109421580a1c5a8d08305f64e3995cd552a366d126c2e1c3165846b0247f9
Instruction ID: 9edb01da38e631939b27d41ea91fdff33756c09433f48b374ee1dbed465b469d
Opcode Fuzzy Hash: 23e109421580a1c5a8d08305f64e3995cd552a366d126c2e1c3165846b0247f9
Instruction Fuzzy Hash: 71210131A10108AFDB10DB69D495EEEBFF6EF8D360F14516AE606AB392CA715C41CBD0

Function 06B74BA1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1be6243a20a6b4bb5da880711c5591588b8045804c23afdb216f4761861f43
Instruction ID: cb78169fbf017bddf494cd97506d54ca8fdc333f115fd831088f2f1be5efee0d
Opcode Fuzzy Hash: fa1be6243a20a6b4bb5da880711c5591588b8045804c23afdb216f4761861f43
Instruction Fuzzy Hash: 1F217C71F002158FCB44DF6DD590AAEBBF6EF88311B1080AAD81A9B365DB34DC01CBA1

Function 06C14EF8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f55e8fc0f7185017b19f3c9161b45772d77c84ef659c3c741eb2861135bf374
Instruction ID: da240c1b15c8e5408ecd9b0f716d076447b8fbf57bfa5013061540cddfedd398
Opcode Fuzzy Hash: 5f55e8fc0f7185017b19f3c9161b45772d77c84ef659c3c741eb2861135bf374
Instruction Fuzzy Hash: 5E31E774A50204DFD754DB69C598E997BF5EF89711F2580A8E412AB3A1CB31EC41CF60

Function 06B74BB0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa949980bdcfc795c7c55a45d6b54c25f366976e4fca3b5b6aa0580ee663e81e
Instruction ID: e1415304b8ba04895b96e4f328a47d6ab2262776e6eb7fa57ca7932f794e5616
Opcode Fuzzy Hash: aa949980bdcfc795c7c55a45d6b54c25f366976e4fca3b5b6aa0580ee663e81e
Instruction Fuzzy Hash: 0A216D71F001158FCB44DB6DC990A6EBBF6EF88311B1080AAD91ADB364DB34EC01CBA1

Function 06252610 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98451aa937f6e74bf3f9b97d22730e3fa27f006cef9c3dbef675370f21ac14f1
Instruction ID: 9d31d27254b7861b2855c21a8f13aecfcb18f99c6c47a2511ce0a2eeeec3fa16
Opcode Fuzzy Hash: 98451aa937f6e74bf3f9b97d22730e3fa27f006cef9c3dbef675370f21ac14f1
Instruction Fuzzy Hash: 8F1104323022056EEB609615EC81B9BB7AA9FD5360F114123FE449B2E0C6B1DD41D7A0

Function 06251048 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23aa3d97ec0651fed302cc77c5e32ab5c82f680799c4ff1f57b6c03aaa773597
Instruction ID: dd88637c8a020780fb69b561f69e071d4fd3c32f8cb58e7b45780d6beec3963a
Opcode Fuzzy Hash: 23aa3d97ec0651fed302cc77c5e32ab5c82f680799c4ff1f57b6c03aaa773597
Instruction Fuzzy Hash: C01134363046A10FC785AB3D881892E3BD39FCA61035A40BEED09CB7A1CE29DC16C3D1

Function 012ABB21 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc35b080f8585b16275e7fac1068428213aeb13b052f85821eea1b4e236ad179
Instruction ID: 17e1b893bfeb7377f165af08bcb118f78b21c9e9d5f12a7f1efd28f839e3030c
Opcode Fuzzy Hash: cc35b080f8585b16275e7fac1068428213aeb13b052f85821eea1b4e236ad179
Instruction Fuzzy Hash: 0421F371E043499FCB11CFB998415BFBFF9EB4A310B50816AD909D7351E6358D42CB90

Function 00FDD610 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901023025.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fdd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33107ddf633c878edea6dfb29db7ed9f38751ff8fcdb02094ad9eac9d83ce22
Instruction ID: f93bbb94c9dd643fe0b20659ea154b2bbdd6ef485eb8aad458bac6afe1490078
Opcode Fuzzy Hash: e33107ddf633c878edea6dfb29db7ed9f38751ff8fcdb02094ad9eac9d83ce22
Instruction Fuzzy Hash: D121F275A04204EFCB14DF14D980B26BF66FB84324F28C56AE80D4B356C33AD806EAA1

Function 06252510 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4f8d81c5cdfd69dd622f6765ab8dc57fecf1a45e1462daa69d5d44f15258a8
Instruction ID: a05d2b10361b72625e4d6e017f13ae18561534708f6471cb71fb1df76fc54f1d
Opcode Fuzzy Hash: 1e4f8d81c5cdfd69dd622f6765ab8dc57fecf1a45e1462daa69d5d44f15258a8
Instruction Fuzzy Hash: C531BA31240A069FC755EF29EA80E46BBB9FF453147009B28E0458BA39D774F919CBD0

Function 06B7F6D8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944e06eb70c3d2056d49bf9c87ebd61347ab2ad446843373eec486a0b1223ef7
Instruction ID: 4e4204f52803749905431a3f96e5eb33be71bcf49b47faacf40f26c9b0e88046
Opcode Fuzzy Hash: 944e06eb70c3d2056d49bf9c87ebd61347ab2ad446843373eec486a0b1223ef7
Instruction Fuzzy Hash: E11159B37082615BD720D97DAC80BE7BF9CEBC0220F0402B6E21487202C552E811C2E4

Function 06C121D0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b39ecfc38c9f024334eccb30a001b18cfa496513902d99cf8df826d1931b46f
Instruction ID: f1d76c3798ca0f3a606491f8a9f576a16725ab41d6785e7d2737efb3e70c9c12
Opcode Fuzzy Hash: 1b39ecfc38c9f024334eccb30a001b18cfa496513902d99cf8df826d1931b46f
Instruction Fuzzy Hash: 5F218939A242008FCBBDCB1DC4EC82D77A5EF4B22075A419EE5474FA61C725AEC1DB41

Function 06C11EF0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12425f09c52515d2fc8a0d3524a501f65da96bfe9ab900e86084a614cff8da87
Instruction ID: 581c127d72897003e64bc027503db790787643c4c15fe86e95a024e9e6a8ad6c
Opcode Fuzzy Hash: 12425f09c52515d2fc8a0d3524a501f65da96bfe9ab900e86084a614cff8da87
Instruction Fuzzy Hash: 2521DE35A002099FCB04DF64D894EAEBBB6FB88310F148529EA159B364CB35DD42DB90

Function 062528B9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e586c5d25dfa8e78a54ba4c2df08e2e9366988062d45b27cebe8fd7dd17750
Instruction ID: c9559dce435e1a1c33ff19c415a2b88dd51ca9907259f28378cd305751dee595
Opcode Fuzzy Hash: 50e586c5d25dfa8e78a54ba4c2df08e2e9366988062d45b27cebe8fd7dd17750
Instruction Fuzzy Hash: 4621CDB17007519FC71AAB38D404A6E7BA2EFC9214714446EC58A8B321DF38ED43CB82

Function 06C14FCF Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6aef6031c76edec7fa292bc9c5dd4c5b963df964db608597b01c73ca1edce2
Instruction ID: fb9f3ffd38b90486ca7ef48f3d52e2161f48ee10c550c25269ebb9376a40efc8
Opcode Fuzzy Hash: 9d6aef6031c76edec7fa292bc9c5dd4c5b963df964db608597b01c73ca1edce2
Instruction Fuzzy Hash: 2E118836B101008FCB88EB6DD59886DB7E2EFC961436680AAE10ADB371CE31DD01DB80

Function 06250294 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eabe4bc4a7b9435d139b33dc70c4f5db856cff43191ab94356b6ba936abb5dbb
Instruction ID: 9ddba4a3a1e3b74d85f8d598e254395fe948fb71aceffd215b37ce40fe24d81f
Opcode Fuzzy Hash: eabe4bc4a7b9435d139b33dc70c4f5db856cff43191ab94356b6ba936abb5dbb
Instruction Fuzzy Hash: 9D11C1363187508FC3559B39D8588197BB2BFCA71031604E9E919CB372CE21EC0ACB96

Function 00FDF17F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901023025.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fdd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3f4ac0631ff22dd56ccf4d2f47cf00efda065eea4add5a65fc2f6b0320be09
Instruction ID: ab55a300d931fa57ac43098c16dcf3fca443305b7cab1be618ab249122d98a71
Opcode Fuzzy Hash: fd3f4ac0631ff22dd56ccf4d2f47cf00efda065eea4add5a65fc2f6b0320be09
Instruction Fuzzy Hash: CA217176404240DFCF068F54D9C4F56BF72FB88324F2881A9ED094A26AC336D866EB91

Function 062528C8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde83a9d845d70a069e7138a5101d9e4e2daef56adf59ce84e35e40945fa6f4c
Instruction ID: 6e03951bccd42fd92389beb274cd7b7ac2560a0036c3956d2c1920582e4932cb
Opcode Fuzzy Hash: cde83a9d845d70a069e7138a5101d9e4e2daef56adf59ce84e35e40945fa6f4c
Instruction Fuzzy Hash: C811BEB13006119FC71AAB38D00496EB7A6EFC9214714442DC54E8B320DF38EC43CBC2

Function 06C17560 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522fee7fdf2958cf8b68a581ff8f31a50f7e03c4245b9c9dcb7825885ee960ba
Instruction ID: fcaf7dc906cdeb0d1de2eac9f7a521b6162a96ab6613feb88e2931dd774fa0bf
Opcode Fuzzy Hash: 522fee7fdf2958cf8b68a581ff8f31a50f7e03c4245b9c9dcb7825885ee960ba
Instruction Fuzzy Hash: 2911D0B1B102149FCB84EF29E455A6E7BE6EF85210B5085A9D10ACF368EE30DD07CBD0

Function 05A0F898 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0436e59155c528ab504688b94d07339ba5fb2b672538c4647e0163d9e5d67f7e
Instruction ID: bf793fe9c0583ba590a6d2a2495a361f9f27cc056fbb938e13d529f9a27f6ab9
Opcode Fuzzy Hash: 0436e59155c528ab504688b94d07339ba5fb2b672538c4647e0163d9e5d67f7e
Instruction Fuzzy Hash: 2F214C74E042099FCB44EFA8D551AAEBFB2FF48310F104099D846A7365D7309A45CB92

Function 00FDF083 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901023025.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fdd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac706478ed8e0b975fac9fbf98c0c10b3f55379ed33725949e2df8455e538a30
Instruction ID: 6bedfb1a42380d5f1fa23f4fdc61a11289100d049ecabefa3a70427bd40f478b
Opcode Fuzzy Hash: ac706478ed8e0b975fac9fbf98c0c10b3f55379ed33725949e2df8455e538a30
Instruction Fuzzy Hash: 2F219276404240DFCF06CF50D9C4B56BF72FB88324F28C6AADD090A256C336D45ADB51

Function 06C13348 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2452f8fe7c1e819844f54784f75f537d65ad38dd34aae6515d4c088b1dc7288
Instruction ID: b425ad9769149f96de13406f0696a69e8f0dc06fd9fe94bd0430b5e89f0f2b01
Opcode Fuzzy Hash: a2452f8fe7c1e819844f54784f75f537d65ad38dd34aae6515d4c088b1dc7288
Instruction Fuzzy Hash: 00113D767001149FCB049F59E884D5A7BA6FF8D761B114166FA058B371CB72DC12DBA0

Function 00FCD7E7 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3900963368.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fcd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: 763be313913f80a15b3380c97bf4bc4cd3a97fd56494bc31066bcb0beaff7d7d
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: 4B219376904245DFCF06CF14D5C4B1ABF72FB98324F2486A9D9490A256C33AD416DB91

Function 06C1E652 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457462ee06b04c9e3697c9d6544693a485b64510c9d3efcccd8a2c7cc99352d9
Instruction ID: 127f5e0bbee6da0e4ba8c570085bf7623a859ae87fb18bb2a52a2cb63793c70d
Opcode Fuzzy Hash: 457462ee06b04c9e3697c9d6544693a485b64510c9d3efcccd8a2c7cc99352d9
Instruction Fuzzy Hash: A9118E70A00218DBD728DF69C954BAEB7F2AF8D300F60456DD802F7285DB719D41CBA1

Function 012AB9C0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7418e91b9c037a57b2213174c330f483f12c44924c4b7b0bacb0a0bae41f9e02
Instruction ID: 2d30e2059cba71451ece2638c74efece9b7beae8450ac8c0562fe25acbcfade6
Opcode Fuzzy Hash: 7418e91b9c037a57b2213174c330f483f12c44924c4b7b0bacb0a0bae41f9e02
Instruction Fuzzy Hash: EE01F5367542059FC754CB2ED854866BBAAFFC9360394C167E905C7322DA30DC02CBA0

Function 06250F5F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc58d77ddd422ee9abf8c770c10d9cf64195e8169dc6d1ca45816016805cc9c
Instruction ID: 82eb7c4f45e2c215077573c9fa798ad339da80643a771471cbf37b55b2c34811
Opcode Fuzzy Hash: edc58d77ddd422ee9abf8c770c10d9cf64195e8169dc6d1ca45816016805cc9c
Instruction Fuzzy Hash: 91118236B106458FC794DB69EC84C99B7B5EFC931031244A5ED25CB732DA31EC06CB20

Function 06C1B750 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae6d73f345a11e8d072805f275f9e236aaf5fe48cd62ddab0dc8ac28c41ae93
Instruction ID: 820f799c50f7c0c7a21409a73e1213028fedc8fa14ee06ba0d30372f6e7733fa
Opcode Fuzzy Hash: cae6d73f345a11e8d072805f275f9e236aaf5fe48cd62ddab0dc8ac28c41ae93
Instruction Fuzzy Hash: 3811E531A002049BD764AB5AC589BEF7AF5AB4A750F14006EE502AB341CAB15D44DFE1

Function 06C1546A Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3c2298f67fb25b2e6234b1695acaa3c82fe22593b8092b92b3b02f7bb143d1
Instruction ID: db8fe428471c008744c696c8971fd9c704e207d132b719496d5dcac2cdaa04bd
Opcode Fuzzy Hash: fa3c2298f67fb25b2e6234b1695acaa3c82fe22593b8092b92b3b02f7bb143d1
Instruction Fuzzy Hash: 0501F9A3B0C3501BD301563D9C557867FD6AF993A0F2A50BED089CB291DA594C0783A7

Function 06C1CD92 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3285a297fec678439b94ae481362b6149e5e5356863a40669b74a5dd833e53a
Instruction ID: d509464323272082e7352ede9227335ad16d7cfaae6457eda30ee69cdab9b88e
Opcode Fuzzy Hash: c3285a297fec678439b94ae481362b6149e5e5356863a40669b74a5dd833e53a
Instruction Fuzzy Hash: 1011BC74A401189FCB14DF69C555AAEBBF6EF8C310F10406AE402EB3A1CA749E41CFA0

Function 05A0F8A8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d18384af0558ffd0d3aa8756012d0666e83d6aa422e559b68bc955c2c80326
Instruction ID: a241a92f72cb885183a5faf2f03173b32bf9a1ef70f1d9f41304d14d33bbb133
Opcode Fuzzy Hash: 32d18384af0558ffd0d3aa8756012d0666e83d6aa422e559b68bc955c2c80326
Instruction Fuzzy Hash: 7E21E774E0020DDFCB44EFA8D585AAEBBF2FF88310F104499D946A7364DB30AA45CB91

Function 06C1CEB7 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad16739399c0f14bbbe8c4df707ab7d97583df41a96cd716a0e9722b3c169de0
Instruction ID: 13aea29439192e7da4371e5639ddd951ba4882ec33885167b732e791441add7a
Opcode Fuzzy Hash: ad16739399c0f14bbbe8c4df707ab7d97583df41a96cd716a0e9722b3c169de0
Instruction Fuzzy Hash: DD118B367011509FC7499B29E994C59BBB2FF8A62132180AAF945CF332CA31DD15DB90

Function 06C17428 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37a9b7060cb1be1ce18434c6f05258df1862d211973858494b43f9a6d296ac6
Instruction ID: ae3f6f29ea10995b04c91aad9cf5ec062556cddc5568f92db447135f81af5991
Opcode Fuzzy Hash: e37a9b7060cb1be1ce18434c6f05258df1862d211973858494b43f9a6d296ac6
Instruction Fuzzy Hash: EE11C331240A4A9FCA15DF29EA80D46BBB9FF803147009B29D0458BA39E764F95ECBD1

Function 06C17550 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbb237a0b7f8d54079e1e007742964d4a59c36bce832edc47b8ef8b1b4c084c6
Instruction ID: 74e99421955a8e8ec6f0526738481db3bcee742ef039806d67c1220d26b5ca13
Opcode Fuzzy Hash: cbb237a0b7f8d54079e1e007742964d4a59c36bce832edc47b8ef8b1b4c084c6
Instruction Fuzzy Hash: C61106B2F102148FCB85EB25E411A6E7BD1AF81210B5085AED50ACF358EA318D07CBD1

Function 00FDD60B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901023025.0000000000FDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fdd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 2bd2301bf8c7281beb4ecd7c63631c20512af4738c97f905cc3a95a118b591a3
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: DA11BB75904280DFCB02CF14D5C4B15BFA2FB84324F28C6AAD84D4B356C33AD80ADBA2

Function 06B73A98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a719a4344d3f5ddb6d9f9cbce95dfbc1940b364cb899bd042ab013dd6ed718f
Instruction ID: ac20f57fca205ddf403f99db77871e25da66ac8139df0f6942ef47255074497e
Opcode Fuzzy Hash: 5a719a4344d3f5ddb6d9f9cbce95dfbc1940b364cb899bd042ab013dd6ed718f
Instruction Fuzzy Hash: 5E11C271609B928FC316CF25D490462FFB6BEC621030D8BE9D8594B702DA75E589CFE1

Function 012ADE38 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ac2e646da84ef52b877f25e883f85c70bc409d8aa2cdfc783346caa5392b6e
Instruction ID: 880b82cfdfa542a4a9621ff4045f158a78a83d7fd7ff534f6ae480a030f00fc2
Opcode Fuzzy Hash: d1ac2e646da84ef52b877f25e883f85c70bc409d8aa2cdfc783346caa5392b6e
Instruction Fuzzy Hash: 0D119635A50109EFDB04DFA4E994ADDBBB2FF88310F548454EA01AB264DB31E952DF50

Function 06252040 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd8ec65e293cf65a76107f8da0232cf03e0ee5c7f9f5cea1897e4258e9e1423
Instruction ID: 91e2702eff4442bd9087f3be9fffe28dda76c7d74d1fd047d6136999b3c92038
Opcode Fuzzy Hash: efd8ec65e293cf65a76107f8da0232cf03e0ee5c7f9f5cea1897e4258e9e1423
Instruction Fuzzy Hash: 27110430722200DFC729DB28D490E2A77B6EF99314B15456EE806CB3A4DB71FC46CB90

Function 05A0FE46 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9604498a30db0f2d7aeb39d03d4f8afe5b9c6b2527944daed6fd4b414d5a3b06
Instruction ID: 00f1a94bfaf4ab869f36ff65a1501eb6ef42fa53b92174147da3a55d0c502550
Opcode Fuzzy Hash: 9604498a30db0f2d7aeb39d03d4f8afe5b9c6b2527944daed6fd4b414d5a3b06
Instruction Fuzzy Hash: 0D01F231F241654BEB2467696810AFE7BA7ABC5B10F449026DC06E73C1DE20880747D3

Function 06C1CDA0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c5a9bcf871bd73b3adcce5fe5513d3c762538248d659320ca0554d4d4d1d4f
Instruction ID: 5e762d0380c684f34246d44a323edb26991be72a36242f9398fece7a92b29631
Opcode Fuzzy Hash: 16c5a9bcf871bd73b3adcce5fe5513d3c762538248d659320ca0554d4d4d1d4f
Instruction Fuzzy Hash: 97117C74B001089FCB44DF69C555AAEBBF6AF8C310F104069E402EB3A0DB759E41CFA1

Function 012A97F1 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728629baf257962a94d9425845f8d9da2187e48ad2f2ccb63a3a3a2ae47006a0
Instruction ID: 704b06a133357a54da2a033393c9b79045fc4fcc8805ef0add5527704dfa4074
Opcode Fuzzy Hash: 728629baf257962a94d9425845f8d9da2187e48ad2f2ccb63a3a3a2ae47006a0
Instruction Fuzzy Hash: BE119A34A14119CFDB14CBAAC889ADEBFF5AF4D314F1580A9D501BB361DB319C40CBA0

Function 06B72D98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3875b48380645c38a13daa7f8e7c9a7495ececc65b6544093ae22a0eeb12488
Instruction ID: ad50f019e6866aaeb3f4d324ceba17dc0bd9a4f17a091af809193a2684a36352
Opcode Fuzzy Hash: e3875b48380645c38a13daa7f8e7c9a7495ececc65b6544093ae22a0eeb12488
Instruction Fuzzy Hash: 55F0C8B77542154F5754DA5DE845D6BB7DEDFC8270315802BF909C7350EA31EC018369

Function 06C1CF10 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52cae3c184a125fa60f8e47e5fc782848dc469eb205094feebb17362d716ddae
Instruction ID: fe1f0edbc472e1468d3d3a09f1dcbed7c4c6cacbc02138cd7b4cf76877d26f9b
Opcode Fuzzy Hash: 52cae3c184a125fa60f8e47e5fc782848dc469eb205094feebb17362d716ddae
Instruction Fuzzy Hash: C901217A3401504FC385A728E8108AF77AACFCE661B2580AAF509CFB20CA75DD02A790

Function 06B73AA8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3e03c99ecd137e47dc3598d36855dea42bf82ef697c6dd1d015449a98daea1
Instruction ID: cda0a5d876c0d3a3b78d950b970072ee8d5000679f3a29dfb4ebcbb535d9080e
Opcode Fuzzy Hash: 8a3e03c99ecd137e47dc3598d36855dea42bf82ef697c6dd1d015449a98daea1
Instruction Fuzzy Hash: 7E11AD716097928FC306CF2AD090462FFB6BEC6214309CBA9D4694B706DA71E589CFE0

Function 06B7A1A4 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9167f784075a99d393fae731b8eaf8855b71a7e3581863b9726da1af520148bf
Instruction ID: 01f906a9073744889c144ff77c9d5d1f95fc665e43caed53e5e912171bdea89a
Opcode Fuzzy Hash: 9167f784075a99d393fae731b8eaf8855b71a7e3581863b9726da1af520148bf
Instruction Fuzzy Hash: 6C016970B0011EDFEF998E44D8859EF7BB6FB84381F049051FA2296690D73189A1EBE1

Function 012AB9D0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a41da0a5e910ebc6df28f2bc27e20399c3b024fecd3b38ab3b87e32ad5bb3d8
Instruction ID: 16c1e81494b626b72a74f10536a91a982badc656361f6bf1691a9d3fc215ebaa
Opcode Fuzzy Hash: 2a41da0a5e910ebc6df28f2bc27e20399c3b024fecd3b38ab3b87e32ad5bb3d8
Instruction Fuzzy Hash: 7501A2357002059F9704CA2ED84486ABBAAFFC8360354C126E909C7325DB70DC02CB90

Function 00FCDC11 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3900963368.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fcd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdae7bbd55703861db18da7b1e4a7087730742d4579f35b26f71a8d6ded764ba
Instruction ID: 25f42aa0a45d694f6d80dac5a9d086fbaf62bbb62a885c9906a3e206f47e5cbd
Opcode Fuzzy Hash: bdae7bbd55703861db18da7b1e4a7087730742d4579f35b26f71a8d6ded764ba
Instruction Fuzzy Hash: B601A7714047459AE710CA19CE85F6ABF98EF95334F18C43EED090A296C2B99845E6B1

Function 06252050 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c36ec02c5a01a3bcb8f19a41a63b23f48b8c5f86be0cca85973b8bdd0d7507
Instruction ID: 70418763d9d4c820186bc12e8b5ebf521da8a6c1732111a9d6577fcb4e4b9dbf
Opcode Fuzzy Hash: 10c36ec02c5a01a3bcb8f19a41a63b23f48b8c5f86be0cca85973b8bdd0d7507
Instruction Fuzzy Hash: 31015E30321204DFC768DB29D455E2A77BAEB98314B11456EE8068B364DB75EC46CB90

Function 06B74020 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29d9451b77838ade402504c8169f07ea3f41cbcf12f8daf340e04cb1bf7b1b9
Instruction ID: e8d3070e5fdcffcead36e34c1e105be5c7ec40a2a3bd877c87ea8c3fa1e57054
Opcode Fuzzy Hash: a29d9451b77838ade402504c8169f07ea3f41cbcf12f8daf340e04cb1bf7b1b9
Instruction Fuzzy Hash: 80F090727042288F57548AAEBC8492FB7EAFBC4562324027BE819C7360DFA1DC0187D1

Function 06250E20 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ec4174183ec29b074f882eb91841cafda1ef7f8c268df4c9cb6907edd3d878
Instruction ID: c903b71f144ba24d4d07a6f33ba2c35c0351e9fd207c3c0d678ecd8713797121
Opcode Fuzzy Hash: 44ec4174183ec29b074f882eb91841cafda1ef7f8c268df4c9cb6907edd3d878
Instruction Fuzzy Hash: 160121329253898FCB628F60CC047DDBFB1AF0A300F268097DC11EA162C3794949CF51

Function 06251958 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5617bc23e74c12167bdf39ec8c388ae9d8fde85f655323d927b1701abb309368
Instruction ID: 0e6e7a20113ceddfd684fddeddfab872c6604ecb7b2f1bf4af84d5003f202992
Opcode Fuzzy Hash: 5617bc23e74c12167bdf39ec8c388ae9d8fde85f655323d927b1701abb309368
Instruction Fuzzy Hash: 680149722107524FC766AB78A44868E7B76FFD1314702892EC8468B712CB78DA0AC381

Function 06B72CD0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1344691366d5b440b56b61a59564359a313c6b8c5374ee94a518fc53c12ef3fc
Instruction ID: 3d5e8a12446dd60837ac65026480d7b23fdbf1a91d9f859426f11b439f5a7044
Opcode Fuzzy Hash: 1344691366d5b440b56b61a59564359a313c6b8c5374ee94a518fc53c12ef3fc
Instruction Fuzzy Hash: 19F02B72B901158FD79467B9F41856D37EAEFC826530084F6F90AC7391EE75DD004790

Function 012A0DD0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5247f07c63d4aaa1ffb7d2e01c14e294f8fafdeebaa6ff1e70298007ac961003
Instruction ID: 3df482b67c86b66efa5cdd3b9987c0091dc37fbf8988d69185a811dc28610912
Opcode Fuzzy Hash: 5247f07c63d4aaa1ffb7d2e01c14e294f8fafdeebaa6ff1e70298007ac961003
Instruction Fuzzy Hash: 96F07832F042145BCB509BB9E849ADC7BA6EFC8360F40407FE20AD3381CF3149059B92

Function 012A9800 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9dc602d0c12eec5d6bbf9a8eef1cb2d41c6e430f0ff41bd316a51b6fa523065
Instruction ID: b31474e1dff317a8d6ce787035bfa81e1185287648186affb8842aa576bd9d8b
Opcode Fuzzy Hash: e9dc602d0c12eec5d6bbf9a8eef1cb2d41c6e430f0ff41bd316a51b6fa523065
Instruction Fuzzy Hash: 33016935A10119CFDB04CF9AC994ADEBBF5AF4C310F1580A9D505BB361CB71AC40CBA0

Function 06252020 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c2f35741dc52af429aaad7572daaf56364bbe6cd52642a69dab90f748c7b2a
Instruction ID: 1944ac5779a644bcac594efd426a5ccbb57b34ce98f52e765b9a8c0cbb497822
Opcode Fuzzy Hash: 50c2f35741dc52af429aaad7572daaf56364bbe6cd52642a69dab90f748c7b2a
Instruction Fuzzy Hash: C401D430226340DFC769DB35E49193A7BB5EFA5200715855EE8068B295DB31BD46CB90

Function 012A8F58 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bbaa5d0f719cf384cf6c728f6d1b99dcc42761a21fd2da47a5c7ff76b1fbdc8
Instruction ID: 5504714f856111a7d138e9637f948c36634d43e0213ab009b2a6cf0aa8417f32
Opcode Fuzzy Hash: 1bbaa5d0f719cf384cf6c728f6d1b99dcc42761a21fd2da47a5c7ff76b1fbdc8
Instruction Fuzzy Hash: E4018B317405408FC72A9B2AA0584A93FBAEB8931270506A9F446C7362CB349C52C791

Function 012A9891 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660be8d6f1daf35d533f30defa975d05941858126a3fe2f2b54373ea0d0cd0ad
Instruction ID: 9166ed43425ec924e45e8a7e567dc3ed440943abbbf871b663cb80bf52b09a23
Opcode Fuzzy Hash: 660be8d6f1daf35d533f30defa975d05941858126a3fe2f2b54373ea0d0cd0ad
Instruction Fuzzy Hash: 98F090327843905FC7161B3AB8544EABFAAEFCA66530840BBE54AC3202DA358847C760

Function 06C1E738 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd14b1c70f8d414428665448fd0e589def3d826b73a3ba41b8b6ec13b5155f8e
Instruction ID: 3edfa6a6eb6568977616b0ad4d68e69918c25286b08578a60c2ac2c4edcaabc0
Opcode Fuzzy Hash: dd14b1c70f8d414428665448fd0e589def3d826b73a3ba41b8b6ec13b5155f8e
Instruction Fuzzy Hash: 34F046327005115BD616637DB41976D7ACBFFC6220B14402EE449CB741CFA8AD0687D5

Function 05A0C5FA Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78752e893021a185a14485908aafd7cad22d17e1693b6633c408d38c48a56ac
Instruction ID: 9464535f7c5c6ca5b0678950108754c3dd3d164bd0daa64c670a1d0dfb5db40a
Opcode Fuzzy Hash: d78752e893021a185a14485908aafd7cad22d17e1693b6633c408d38c48a56ac
Instruction Fuzzy Hash: 3AF096317051405FD318C61DE854FBAFBA9EB89330B14606AE90997390DA72DC41C7A4

Function 06B76488 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ce4781ef757defa22516bb9e7e019af3354f090e41474459d127975a86538d
Instruction ID: af945a806e310798377b92b302845064ccdef89b295109d8c3f5450ba23ee7c0
Opcode Fuzzy Hash: f4ce4781ef757defa22516bb9e7e019af3354f090e41474459d127975a86538d
Instruction Fuzzy Hash: 46F0247A3441410FC788A679B8586AE37D6DFC11213205166E142CB3B0FA26D8028A90

Function 012ADE60 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d79ae348607e69fda39b499f1f79a574adc399c5c40af5af79076f3e36dd424
Instruction ID: ff8e686a50a06b992bca0f60d61474179a0464452b03129b6817525b2536f29b
Opcode Fuzzy Hash: 4d79ae348607e69fda39b499f1f79a574adc399c5c40af5af79076f3e36dd424
Instruction Fuzzy Hash: E2F0F6326407064BC314AA5EE984A5B77ABFFC4365B80C83CD71A87711DF30AC45C7A1

Function 06C1CE60 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d2ccc1324b8ab9c7ede77c5f6dae11b7c4bd5a910ad2a48324118e298db8f68
Instruction ID: 13af49cedcc3330c827ba1b75fc23a3985204da5a612e4b8fa1f19749fd5de94
Opcode Fuzzy Hash: 2d2ccc1324b8ab9c7ede77c5f6dae11b7c4bd5a910ad2a48324118e298db8f68
Instruction Fuzzy Hash: 3FF0B2363505109FC348DB2AD988C59BBE5FF8D62135180A9E50ACB371CA31EC55DA94

Function 012A8791 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11c527eb953907a88c5aed63d2e68b505cb8a8bad903ff1f8106cbb322450b7
Instruction ID: 15860fdb923743ebf27f7c273e9e6966b352ad2608ad4b068a18e7ede224ec71
Opcode Fuzzy Hash: c11c527eb953907a88c5aed63d2e68b505cb8a8bad903ff1f8106cbb322450b7
Instruction Fuzzy Hash: F2F090353043414BC325966DE886D5A7FDD9FC631474484A9E249CF222DA65DC06C791

Function 00FCDC10 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3900963368.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fcd000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8acdb3b99a2eaa2648e4f1e1471a6af0e50c69a870c431edba6c8564829513fd
Instruction ID: 31cc8e158ec07c7a3d402c589701a516ab6c824065ec9b826820042b5cf45478
Opcode Fuzzy Hash: 8acdb3b99a2eaa2648e4f1e1471a6af0e50c69a870c431edba6c8564829513fd
Instruction Fuzzy Hash: C5F062714043449AE710CA1ACD84B66FFD8EF55734F18C46AED484B296C2799C44DAB1

Function 06B72A58 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093f1556e7dc1b3a6fce299e23c5d33a86db2706b07a9f71b7c48f86b6bf1f62
Instruction ID: 01dd50aefb7d10c5ce1a814ea516a4f08c982fe8c6a9d313597c3aa169f48efc
Opcode Fuzzy Hash: 093f1556e7dc1b3a6fce299e23c5d33a86db2706b07a9f71b7c48f86b6bf1f62
Instruction Fuzzy Hash: 64F027B6B082451F836446AE5C9199BBFEEDFC5160300807BE54AC7356FD30CC018360

Function 06B74880 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d331768b925e53c70bf8c2693292f30071d597d24227d48ea0efa71b4ecf58
Instruction ID: 5eaa33ae5e818b91ae916c97e7dc270fc9652a2524ee7cadb2e6a11ffa455507
Opcode Fuzzy Hash: d9d331768b925e53c70bf8c2693292f30071d597d24227d48ea0efa71b4ecf58
Instruction Fuzzy Hash: 2BF0DC71A402188FC798EE25E845B9EBB95EB80324F1086B8D40A8F324DA75DC4ACBD0

Function 012ABB30 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104efd36df0f5ac7f2e042c9fc12405557a953e040ce29733111dc7d70f425cf
Instruction ID: b42ec99865f7e2d53b7e89d88705275689ef97aeb0c8b7773e57ca8b22d47243
Opcode Fuzzy Hash: 104efd36df0f5ac7f2e042c9fc12405557a953e040ce29733111dc7d70f425cf
Instruction Fuzzy Hash: ACF0E2327406269BC3145AAD984492BF7EEFBC8361B10453AEA09C7354EA71CC42C7E4

Function 012A7F18 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8c2f0d3426a0c0914f11551d3da5cfee8b6a6e21824d84c831de82d9d1260b
Instruction ID: 6b14067cd6f9481b667bed3557b0700179a637d31b3363645f8bbf4c256cd405
Opcode Fuzzy Hash: ca8c2f0d3426a0c0914f11551d3da5cfee8b6a6e21824d84c831de82d9d1260b
Instruction Fuzzy Hash: A301A930E502188FCB51DF69E809ADEBFF4EF88314B04462AD849D7201E730AA25CBC9

Function 012A7EB8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b1a2d2c397d6fa046d7ab47c85b6ff0c6fe305ebdb877d40f0b4ccf07ad104
Instruction ID: 7147423937bd3b7b222ff57ecb6d974fa60c9daefdd3d08bfe4613f7b9a08e10
Opcode Fuzzy Hash: f8b1a2d2c397d6fa046d7ab47c85b6ff0c6fe305ebdb877d40f0b4ccf07ad104
Instruction Fuzzy Hash: 3DF097362841904FC302672A7C95CEBBF68EBC930034085BBF50AC3212D9268C028262

Function 06B7DFC6 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4014d29c82b28825a9679c169c5d2fbe57c07eab98fbebb3ded0481ee41e44
Instruction ID: af5a1d0e2aa686024097e8fc7663c547d4dc92c6a0be4e541ca9cbc0d1f3c533
Opcode Fuzzy Hash: bb4014d29c82b28825a9679c169c5d2fbe57c07eab98fbebb3ded0481ee41e44
Instruction Fuzzy Hash: 73014B70D00208DFCB44DFA4D441A9EBBB1FF48310F10C969E569AB250D775AA12CF90

Function 06252258 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df4d793c2c30d3d21a04f3f6b11a500291e1f737eec9ce5bbbf3fb71c5300dd
Instruction ID: fda96b7d875871cd06c5f465426324a3a83d08b70450df1d0e055b7c9c25c176
Opcode Fuzzy Hash: 4df4d793c2c30d3d21a04f3f6b11a500291e1f737eec9ce5bbbf3fb71c5300dd
Instruction Fuzzy Hash: 32F04475E14205DFCBA4DFB8D4058AEFBF1EB48210B1089AAD929D7351DB31DA02CF91

Function 06B7A698 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0a88f36f57d40763426e2f20ccbe8c39254ec23755c651c50a12d25ecee288
Instruction ID: d25e26fcb4ce55b52f35328ae5787cb39b6976258d2a97995aff6193349dae59
Opcode Fuzzy Hash: 7e0a88f36f57d40763426e2f20ccbe8c39254ec23755c651c50a12d25ecee288
Instruction Fuzzy Hash: C0F0A02270D3904FC38A5B389C246AA3FEAAF43210B0A54D7D589CF7A2ED14CD05C7A2

Function 06B73A32 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70326926280d219893ccacce995e66a588772a5d7a40a373353f9d984214d68d
Instruction ID: b863a102fe131efc8b6b7a8090a03c87d047f77d3bd58f9293a83b06e5b3a75f
Opcode Fuzzy Hash: 70326926280d219893ccacce995e66a588772a5d7a40a373353f9d984214d68d
Instruction Fuzzy Hash: 7FF0F6B63002410FC265AB34B95966EBFA6EFC5325704465EE542873D1CA78AD0AC772

Function 05A0C654 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0203074e7c81decc63f7b888d379804913e8810d13918d86165e1ba6f38aadb7
Instruction ID: d25fb1365c201fa3c8846101920afdde47ab4006e67fabb8d4eca76f2e68275b
Opcode Fuzzy Hash: 0203074e7c81decc63f7b888d379804913e8810d13918d86165e1ba6f38aadb7
Instruction Fuzzy Hash: 84F02E72B4D1804BD32A4318B874779EB51EF89321F0871EEC5468F2E5EB16DC42D314

Function 06252808 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c0773544eb21a35033ef2358f1130c899a86eeedcd76cb5f0b130a2caa1c07
Instruction ID: df4013cf0fd0b40d62007fd9219d72b995ddbcacd6d4be4221fe933110c7cd54
Opcode Fuzzy Hash: f7c0773544eb21a35033ef2358f1130c899a86eeedcd76cb5f0b130a2caa1c07
Instruction Fuzzy Hash: A4F05472210164ABDA52A7A9B00DABA77DDD794375F058126E60982644CB345C82CBE7

Function 06C1CEC8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64df3ed307fef14a5694fc49b2031b9233bab85e2026b26808bd609aa189c82d
Instruction ID: 2d6b784708773b2e63ea0c544e382b79789b730fff6b1905e0b394a87549262a
Opcode Fuzzy Hash: 64df3ed307fef14a5694fc49b2031b9233bab85e2026b26808bd609aa189c82d
Instruction Fuzzy Hash: 91F08C363404148F8748DB2EE444C5AB7EAEFD962131540BAF605CB731CA31EC01DB90

Function 06C14308 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e74d4c1664d4d261fa6d13b56a5fa7d51a5927b7252317f906a1911c0df2731
Instruction ID: fb80e650cefd1c81d54f6db1c666115d22ee18d5d1c414974ebf346b78b31b7e
Opcode Fuzzy Hash: 4e74d4c1664d4d261fa6d13b56a5fa7d51a5927b7252317f906a1911c0df2731
Instruction Fuzzy Hash: ADF024B2504610AFC3208A299C80EA3BBEAEFC5311F14C42EE58643A00CA39A842D360

Function 05A0CC6A Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce955888f5bc166ded05bdb7f4fad1161645b190c8e756fa688fec2a6ecb244f
Instruction ID: 800311f5aa3aec39c8b51426d8a296cafdd1b151d0d2b9133669fdf6b22df1de
Opcode Fuzzy Hash: ce955888f5bc166ded05bdb7f4fad1161645b190c8e756fa688fec2a6ecb244f
Instruction Fuzzy Hash: C8E0683334810427061015A97C01CBAB78FDAC7A75309026AF50EC3740DD120C0253E2

Function 06B7DFD0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218e09155010d2dfd8e3170411cb3ea9b0755b7f8ff8d9690da8ca96b184bbe2
Instruction ID: cd53b560bfb4228b6824bb149032724ebf979a1ce4546523b79a4604167a741c
Opcode Fuzzy Hash: 218e09155010d2dfd8e3170411cb3ea9b0755b7f8ff8d9690da8ca96b184bbe2
Instruction Fuzzy Hash: 1C011470D00219DFCB44DFA9D881AAEBBB5FF48310F10C969E569A7250D775AA12CF90

Function 06C1BC20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d371603415a941418ed1955b5507032b6b994e53e4d1ff400800a2a42b34752d
Instruction ID: 96f374afe9becba314528e14fba772bc97eb0374dbcc442bd81c79addff1350c
Opcode Fuzzy Hash: d371603415a941418ed1955b5507032b6b994e53e4d1ff400800a2a42b34752d
Instruction Fuzzy Hash: 1BE092333400545F4714AA4FE8C4CAAFBADFBE9232354403BF208CB220CA21DD45D7A0

Function 06C142B8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67372f8beea413465e2f2eb3067b45d8afdd6163faa1c8e00b1672902de83303
Instruction ID: c5e8d6e1adb714d5e3825f9db094b5075943c234a22cc72e808b323a7c283db2
Opcode Fuzzy Hash: 67372f8beea413465e2f2eb3067b45d8afdd6163faa1c8e00b1672902de83303
Instruction Fuzzy Hash: A3F0A7353002108FC355D759E448AAA77EAEBCA321F55816ADA49C7761CB71EC42D790

Function 06B73F92 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cccdd561bd29a5842d055ee2ced62780f8080c30177d79da14b4a7a71d9af67
Instruction ID: 4612a10540e3b83993c4ad2e418b16447f4c469be7e57b0aefaa794e22827dda
Opcode Fuzzy Hash: 4cccdd561bd29a5842d055ee2ced62780f8080c30177d79da14b4a7a71d9af67
Instruction Fuzzy Hash: 1AE026B37083025E9FC623352C101BA27AB9AC119531400E7E52ECE142EA26CC07B262

Function 06B728A0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db2b720a773cc963473c6330015f6d902f9bca8961be4091598b7c1057697a9
Instruction ID: 2a6b2917380cf0a9a9725630d9ae447a02e417ddf45f06f83b912d5cdcbba90b
Opcode Fuzzy Hash: 5db2b720a773cc963473c6330015f6d902f9bca8961be4091598b7c1057697a9
Instruction Fuzzy Hash: 3BE04833F04219AB4754DAAEF8009DFB7EEEBC817571480BBE51DD3210EA35D9069750

Function 012AD4F5 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117385a60f00eb933bf3194293b3491d69a3ae1cbbc6ff51f5c3353380d4e17f
Instruction ID: 6a941ca9b52c605f61feffec5c9debfc239105cf1eda30d19bc830b8649b466b
Opcode Fuzzy Hash: 117385a60f00eb933bf3194293b3491d69a3ae1cbbc6ff51f5c3353380d4e17f
Instruction Fuzzy Hash: 2501F234A6525DAFEF14CB94E855FEDBB72BF48304F604006E942BB6A0C771A980DF60

Function 06C14318 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d6775bdb8ec2f219e6084eb29c590ffb783e1949109a7aa3f6e1dbc7076162
Instruction ID: f44077f6703c353ddd5bc4e1fbef914badba8b6f242f6a9f0e6cb07800d8ee27
Opcode Fuzzy Hash: a2d6775bdb8ec2f219e6084eb29c590ffb783e1949109a7aa3f6e1dbc7076162
Instruction Fuzzy Hash: DCF08271100620AFD2245A5ADC40DA7BBEEFBC5711B50C529E68643600CA75A841D7A0

Function 06C1B92F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad68875b9298f55c571df6359a8f6aeec6ef281b277e0d2981d916302832c3c
Instruction ID: f3a4f4ed9cb95af05f80c79f710f73a6b00c794acb90e0246b0c7ef8356e7ca5
Opcode Fuzzy Hash: aad68875b9298f55c571df6359a8f6aeec6ef281b277e0d2981d916302832c3c
Instruction Fuzzy Hash: B2E0DF73B001112BD254276DBC51A9BBB8FDFD92A0B19807BFA0ADB350DC669C0793E5

Function 05A0B640 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ddbd6cc6867cd8666a24c82ddebb9be303f706e21cce52774ca2b623cea567
Instruction ID: ec438a907ad392d7726470f38dbf4b337e54248e4c0813d06117795e4c12af62
Opcode Fuzzy Hash: 55ddbd6cc6867cd8666a24c82ddebb9be303f706e21cce52774ca2b623cea567
Instruction Fuzzy Hash: D6F024303047024FCB08DB24F965C69BBAABF40204708D47DD01E8F256CA35D8068B50

Function 06B749D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac9bc74dca830f7c17094d9e9593f73b6373de60f0275c6f5ccf2902bc25a2f
Instruction ID: 697d4a305eb81d2f2e728df2b732bed516ac19cebe94abf74e888a2be786eb9b
Opcode Fuzzy Hash: aac9bc74dca830f7c17094d9e9593f73b6373de60f0275c6f5ccf2902bc25a2f
Instruction Fuzzy Hash: 4DF0547161120CEFCB00DF64EE41A9DB7B9EF85209B1046E9F40997251DA355F04D791

Function 012A1EAD Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba58e0c1558c4db279b0ed2aaf254494fc3b9b405da58ab37076e0c80649e82
Instruction ID: 4dae2781d68a8f919bb062e91983504b0079a51705a87097693f946403b58069
Opcode Fuzzy Hash: fba58e0c1558c4db279b0ed2aaf254494fc3b9b405da58ab37076e0c80649e82
Instruction Fuzzy Hash: C9F0A72591D3C49FDB0287B4C8153EE7FB59F86310F6441BAC142A72D2CA75091DC772

Function 06252999 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0724e093d887a92771e9c40a2f10dd9bd6914daacf3e378da4385e3e50add829
Instruction ID: 7939be998602ceb65355dda287ab47a25bd498494ff4d9be3c8fcc013dd9d73d
Opcode Fuzzy Hash: 0724e093d887a92771e9c40a2f10dd9bd6914daacf3e378da4385e3e50add829
Instruction Fuzzy Hash: A6E0EC2235435215C3269339B006FBF3F958BC1234F14006EE44947283DAA5584593E1

Function 05A0A727 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5793d2d5380cb305df490dc9402e0f1cd78ab65e6dd544ba532e354af3bf2501
Instruction ID: fb7ddce688662cd9fff7676a231208aacf4e5793c4bf7166bd7db5f7bec32549
Opcode Fuzzy Hash: 5793d2d5380cb305df490dc9402e0f1cd78ab65e6dd544ba532e354af3bf2501
Instruction Fuzzy Hash: DDE0D82235A1A01FC31297B9A8619BE3FE59FC715135840EED08ACB396CA549C0B9752

Function 06252268 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f563857892b5e965928cce8d33f363ab45f4fcc2d8d2c8ed73ae0096c7d5076
Instruction ID: f5e2848f589a496a141855a1d8f6a3ab4cb84ff65aafdee188d9330a673e4e18
Opcode Fuzzy Hash: 3f563857892b5e965928cce8d33f363ab45f4fcc2d8d2c8ed73ae0096c7d5076
Instruction Fuzzy Hash: 4EF0F874E00209DFCB54DFB8D5455AEBBF5EF48200B1485AAD919E7311EB359A02CFD0

Function 012A34B4 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad765edbdb28f60af70e99328b2ddaecea93756f6c9e0e8c74c164e61ec6c1f9
Instruction ID: 76f7f8ad14acbaafb9bd149d7573a20649a19821f0448e107417b82e523a1fa4
Opcode Fuzzy Hash: ad765edbdb28f60af70e99328b2ddaecea93756f6c9e0e8c74c164e61ec6c1f9
Instruction Fuzzy Hash: BFE0D877D69240CFD722CB6DB8664F47F30FE673507C581D7D2859B421E215445AC711

Function 012A1ECD Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c9e6bec2cd7f5fc3d2abe483e066132872d1aec953750dfe24335e75a6cead
Instruction ID: cf1d7132d5a743bd9a838ca33b36c960dd886acd9a78693239108f97c050c6cc
Opcode Fuzzy Hash: 35c9e6bec2cd7f5fc3d2abe483e066132872d1aec953750dfe24335e75a6cead
Instruction Fuzzy Hash: FDE0E553A1D3C28FD713837484662CC7F759F73260F8802EAC085C769BE6984619C323

Function 06B74C89 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348fc9fa3c9b6946fb79a78fb3e35bdd787406ccd8e7d2ff5dad3551383baaf6
Instruction ID: 9f95c57afd8e1eec3990d35bb13e079e1bd00e83b1b0ce9b76cef6716dc29e4d
Opcode Fuzzy Hash: 348fc9fa3c9b6946fb79a78fb3e35bdd787406ccd8e7d2ff5dad3551383baaf6
Instruction Fuzzy Hash: 43E0DFB2F400408FCF98A6B896202EFEB87DFC4203B0084BB85668B358DD34880583E2

Function 012AA361 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd34438451f1b37d6a7c432c08ec913f0d7dd6b58b6c6ceb866e1f4ac2f9f10
Instruction ID: e9381fbcbb611cf614ebaed397b87a40a7d8163e8da593b1097aab4c6301b847
Opcode Fuzzy Hash: dbd34438451f1b37d6a7c432c08ec913f0d7dd6b58b6c6ceb866e1f4ac2f9f10
Instruction Fuzzy Hash: 37F09D38A401088FCB49CF99D980DCCBBF1FF88314B2181A5E505AB325D776AE05CFA0

Function 012A7EC8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e36ecdd37a27615c64541eb20377cf3a9bd666ccbc56a3aeee2a5a5452934f
Instruction ID: 3310b17c730d6b9fc60202b7e41b6d5a85f55d421a0a6c1e304162805a2b2250
Opcode Fuzzy Hash: 59e36ecdd37a27615c64541eb20377cf3a9bd666ccbc56a3aeee2a5a5452934f
Instruction Fuzzy Hash: 05E0D8353801545BC3057A6BB855D5BBA5DEBC4350750943AF50AC3345CD768C108261

Function 06C1B940 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f6dadeeee786120074dd9c2b5d015a2c0e4f660697419f3a22c8766c85cc56
Instruction ID: e52c2b36fe042afabab1823411414b64e1a399cdc4ac891e31e459546cbae178
Opcode Fuzzy Hash: 93f6dadeeee786120074dd9c2b5d015a2c0e4f660697419f3a22c8766c85cc56
Instruction Fuzzy Hash: 46E08C333002112B8648376EAC519AFBA9FDFC96A0724843BE70ACB355DCA59C0663E5

Function 06250EEB Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9cc5b291c3cfff420e07a85b971e1b7a6913a04e4c76d8bb5ddac155bba2754
Instruction ID: 8bfd89b6ce93113f901b457159512fd8102659872ae014cebf2f0e40fa5a494e
Opcode Fuzzy Hash: d9cc5b291c3cfff420e07a85b971e1b7a6913a04e4c76d8bb5ddac155bba2754
Instruction Fuzzy Hash: 1EF01C35F10105CFDB84DFA8D890CADB3B1FF8831472188A6D921DB262DA30A802CB10

Function 06B72D41 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57de8cdc785785024272c5a9559177b2ffaf3290bf25ab1e55fdb1c9dcaf3918
Instruction ID: 63d479307ebba02456bd2aa720ae633a35b7c72f61e312a1c9f11ed5efe3f461
Opcode Fuzzy Hash: 57de8cdc785785024272c5a9559177b2ffaf3290bf25ab1e55fdb1c9dcaf3918
Instruction Fuzzy Hash: DCE0DF32995348CEE345E235E9006E537E8EB00310B0952A3C06886566D6348D46C2DA

Function 012A1F1A Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240b839720677a01d4aef9b8392e6ea96ec5f136cf17f5c8e3d0e58582802f78
Instruction ID: e7655afffbfcd944aa332d5d69e7524ec36891bfc1a1e2b095d7e777f21d5cee
Opcode Fuzzy Hash: 240b839720677a01d4aef9b8392e6ea96ec5f136cf17f5c8e3d0e58582802f78
Instruction Fuzzy Hash: 0AF0E530904349DFDF01DBB8C5483DE7BF5AF8A310F600168C105AB288DBB64659CB62

Function 012A7E71 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1df6966b92e4fbd542d4a3ebbed1db2afdbe95cc4e7a39da784a9d959bbc2e4d
Instruction ID: efaafe6655d335faf9a4ca85eb3ac0139f572d10462b4c5832d4c4816eb3de82
Opcode Fuzzy Hash: 1df6966b92e4fbd542d4a3ebbed1db2afdbe95cc4e7a39da784a9d959bbc2e4d
Instruction Fuzzy Hash: B0F0E571A48094CFC707DF39D4563823FB1EBC6300F40859AD5434B69AD6359882CB40

Function 06250F30 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a609b94e7b2412fb1f99d818dcbf1830c4fbe4d1e7554251b9973b9360afa9
Instruction ID: 1f312012c8bf9325d6f83b1651d59bab04d81aad71ba75109a3c1d21fa317e6e
Opcode Fuzzy Hash: 81a609b94e7b2412fb1f99d818dcbf1830c4fbe4d1e7554251b9973b9360afa9
Instruction Fuzzy Hash: 62E086732592557FC7469A99CC02CC67FADEF4A2203158097F544CF273C235D822D7A1

Function 012A1EBD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be066604449358cbc68cb09d491d4fbd251c272c5cc721a589f159903892bf0
Instruction ID: d5042acefd9ad9dbb258cbc1f496db9496cf4d30975a30ee0b54a4d1379f6847
Opcode Fuzzy Hash: 7be066604449358cbc68cb09d491d4fbd251c272c5cc721a589f159903892bf0
Instruction Fuzzy Hash: 9AE09A21A1D3C59FDB038B74C8243AD7FB99F86224F6600EBC144DB192CB790A288372

Function 06C154C8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0aaa05e55f1d147c38c85e41f49b59f473d50e46bef226e2712bfa697f19c12
Instruction ID: d4c357ab2194f9e97c071ac30e980db687d599e3de37245154e4483be227300f
Opcode Fuzzy Hash: f0aaa05e55f1d147c38c85e41f49b59f473d50e46bef226e2712bfa697f19c12
Instruction Fuzzy Hash: E6D05E2230002027024821AE7C468AEAACEEAC95A13584039E20DC3341CD155C0613AA

Function 062524C0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37b23e8680110b97ac28e6a5eb518fbed5e8c8de67bc677285b0d24a5d808de
Instruction ID: 7d8526995e0657bbf9530e9b23d69834e451341714e12c9e9b4cba02cbcd1363
Opcode Fuzzy Hash: f37b23e8680110b97ac28e6a5eb518fbed5e8c8de67bc677285b0d24a5d808de
Instruction Fuzzy Hash: FEE08C3A1093549FC726EBA8F855882BFFCAB0E61030500AAF184C3322CA75E800CBA1

Function 06B72CC0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bfc2ab128297d1a5d5387472448d9034bed1104ace6a460b303d57b5e4ad8d
Instruction ID: 720f23b98231ff0347811702952da53ec67888b35396764a7da8c4d9e0d737eb
Opcode Fuzzy Hash: e0bfc2ab128297d1a5d5387472448d9034bed1104ace6a460b303d57b5e4ad8d
Instruction Fuzzy Hash: 6AD0A736A593551F939522796C221D33FAD994211034684A3D540C3246E855CC0942E2

Function 06C1B8E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58bc09c561bfdf78b14030dfdcfc8eccb6000a44d44b4e451035e62486b3e4a7
Instruction ID: c732f3620135f0acf9f8cd2a6d658af24c86fdfac58f02da40005b6c55341802
Opcode Fuzzy Hash: 58bc09c561bfdf78b14030dfdcfc8eccb6000a44d44b4e451035e62486b3e4a7
Instruction Fuzzy Hash: BAE0C2322003158BD728962AE400C6AB7BEFEC1361B10843EE1068B624DA72FD46CB80

Function 06C15076 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7ac5378863e34470e4db05158f3e99c254a318f5e04453ced65702a55213fa
Instruction ID: 6097e9faa5671fa4b86b7f151e7132631ff1879819f86b8f1b2d50eb957c8841
Opcode Fuzzy Hash: fa7ac5378863e34470e4db05158f3e99c254a318f5e04453ced65702a55213fa
Instruction Fuzzy Hash: E8D05E33B10124AFDF18E7BAAC118BFB39EDBC8220701C63AB50AD7044E975981282E0

Function 05A0B5EA Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3caab4d6dfc5134b5f1cbd0d9913b105eb27b76023be145da5090c35bf4e0d
Instruction ID: ff194eb32fc0225e5077b6bab3ec70a9a461263fbd92d0d432eea797e2fae4e1
Opcode Fuzzy Hash: 7a3caab4d6dfc5134b5f1cbd0d9913b105eb27b76023be145da5090c35bf4e0d
Instruction Fuzzy Hash: DEE0EC70D0520CAF8B50DFB9A9459AEBFF8EB04740F0151A6E809D7241E731DA418BA1

Function 05A0A738 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d9d788efd1b31c31d4a1e657c0061649343e108e09e19cd12408369a65b72f
Instruction ID: a1a1e6d8d4eacf6aeae2784676097fffd803574a7fd44d901da4dd51582cecad
Opcode Fuzzy Hash: f0d9d788efd1b31c31d4a1e657c0061649343e108e09e19cd12408369a65b72f
Instruction Fuzzy Hash: E2D05E333000155F8240A6AEF845D6E37DAEFCAA647A400A9E109DB365CE25DC0663D6

Function 05A0CB6A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c4c2f9c0732ffbb453b170c3396c49ccbddaef788c91e942ab5420b84a892e
Instruction ID: 8bb1acebfcb173e04a876c9f8ef4eed60f67f5077b739d2184533cb6d3cab815
Opcode Fuzzy Hash: 32c4c2f9c0732ffbb453b170c3396c49ccbddaef788c91e942ab5420b84a892e
Instruction Fuzzy Hash: 91D0A73E7127242381202A3EB80689BBB9EDFC56B6305103BFA05C3700DE61DC0582F1

Function 06B73FB2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44096404760e7f9c3535b63aee5b9d24593603e5b67e52e7471d754871c97f06
Instruction ID: d1b421f1124097f5c1a47e78d67038d32eba73dec8fc2f464b675813239b3152
Opcode Fuzzy Hash: 44096404760e7f9c3535b63aee5b9d24593603e5b67e52e7471d754871c97f06
Instruction Fuzzy Hash: 5CD02E726083048FD78A2230A8201DB3BAE9A0238432180A6E120CB291DE36CC02C7A7

Function 06B74978 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c84ae4ce94ee7222ccfdb5439a36d287754084739c7a963d92e3a5fd4b4c22
Instruction ID: a43ad2bd4176779d06fc59b086ba84b556ecf8fce79d5397b407abb060a9a27c
Opcode Fuzzy Hash: d2c84ae4ce94ee7222ccfdb5439a36d287754084739c7a963d92e3a5fd4b4c22
Instruction Fuzzy Hash: 6DE0DF71915248AFCB11DF75ED00B8EBBF9EB81208F0045ACE80A93281DA326F00DB80

Function 06C1B8D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a3609768f00bd823c3248d8a01d019eab5c5a4755395ceac3562bd6aac16699
Instruction ID: cf500fa1c774d2ba2aa139dc3465a8d3ee2a4917ecd4f83fa8f7c3ab492b7cd8
Opcode Fuzzy Hash: 9a3609768f00bd823c3248d8a01d019eab5c5a4755395ceac3562bd6aac16699
Instruction Fuzzy Hash: 73D0C27350462047E729C51AE940A5AAB7AEEC5361B09447FE44A87A2096B5AE49C680

Function 05A0B5F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7720c350a9af8c3564c78ac3ca1aa49d958105e33421ee325ad6b1723af9fc25
Instruction ID: 1579661a375bca8fc08673f60411a0ebab7e4ff5bc431298e028874a942f6c80
Opcode Fuzzy Hash: 7720c350a9af8c3564c78ac3ca1aa49d958105e33421ee325ad6b1723af9fc25
Instruction Fuzzy Hash: 77E0B670E1420C9F8B50EFB9A645A6DBBF4EB04200F0452A9D84DD3241F731DA118B91

Function 05A0A259 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259ace7be4d213379a2a5d8b4abd6566f7e3996028ed16614c0331f87fb39d98
Instruction ID: 8b060a9e15724b8abc871494a025ac0fe4631c27940db2f757cfc7e32d6c11c5
Opcode Fuzzy Hash: 259ace7be4d213379a2a5d8b4abd6566f7e3996028ed16614c0331f87fb39d98
Instruction Fuzzy Hash: 23E017382493909FCB15DBB8D895CAD7FB0BF4615431501DAF546CBEB3CA22CA05CB62

Function 05A0CC70 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e9cedffaf5b75c0d8f738af0b197262e82c85015942e1ac1c76291e09252a5
Instruction ID: 69d9a66537ac6081c0804f1a3e70518e8840f49499f87124e357427469d6e2a8
Opcode Fuzzy Hash: 47e9cedffaf5b75c0d8f738af0b197262e82c85015942e1ac1c76291e09252a5
Instruction Fuzzy Hash: 39D0A736300120170644269E741897E77DFEBC9AB2319102EF60EC3340CE665C0653D5

Function 06252220 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1020557e006199cb9833ddb79dabce2b14f508c6ded3686357f9d073ccfa2a
Instruction ID: a0c33116e9df4132635397a5b806a06686738fe8ff1f0bbf329b842eb3d281f6
Opcode Fuzzy Hash: 4a1020557e006199cb9833ddb79dabce2b14f508c6ded3686357f9d073ccfa2a
Instruction Fuzzy Hash: F7D02BE26092D15FE70A63A0242118EBBA6EF863A8B0444CFE04AC7583E9584C0083A2

Function 06252870 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415116513b3c1cf95e8ebcd98105106c7e51d73a3be05c039fdd8872f91c5847
Instruction ID: ddd42281447af4d1830614ffdd23fdb93b45a42098b3099d659161489c471169
Opcode Fuzzy Hash: 415116513b3c1cf95e8ebcd98105106c7e51d73a3be05c039fdd8872f91c5847
Instruction Fuzzy Hash: 25E0263D404695CFC387EB37B8962993F21DB82214B0852A9D5444725FEB34888AC7A2

Function 012ABB98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eff4e618564d13ffff92477cb99d9169854f79f3ef9d355bdf90e7ed10820b42
Instruction ID: 9546266dfb494d05a7e61aa2c215a826b036671697fe0bce644488590800b981
Opcode Fuzzy Hash: eff4e618564d13ffff92477cb99d9169854f79f3ef9d355bdf90e7ed10820b42
Instruction Fuzzy Hash: B0E092B0D0424D9F8B84DFE9D8426BEBFF8AB48200F10816AE918E2240E7745A51CFD5

Function 06B74939 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0ebeb9bb6976aa0bb30e4c8ab9d87d30bc5e6eadf0f97333db907726629811
Instruction ID: 3e84369155c38d106b8e32ccbc57496a7e7e24a6e542395ef3f29f4d4435805b
Opcode Fuzzy Hash: 3d0ebeb9bb6976aa0bb30e4c8ab9d87d30bc5e6eadf0f97333db907726629811
Instruction Fuzzy Hash: 2FD05E3A7545204BD65872F9650027E32AACFC4522F149057E62AD6362CE788D0262A1

Function 012A3460 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04c046b523bc22e2148d10b7ac94c7396430b10a325db106570f7ada7f538c7
Instruction ID: 2b6eb810a41eda6312cb393be0356b555491056812eafe816ce4c5775f4dc71a
Opcode Fuzzy Hash: b04c046b523bc22e2148d10b7ac94c7396430b10a325db106570f7ada7f538c7
Instruction Fuzzy Hash: 2FE0BF36D50508CFCB04DFA8E4548DCB770FF89325B404166D51577220E7306999CF51

Function 06C1CD60 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d6b0690c78101962fb8e7f9caf85952de22e8f7928b8745ad3af5ca1aa31bf
Instruction ID: 871ce6a91ee76dae16ea855f52f5a3d13494162f026a23f543a52114c5f62160
Opcode Fuzzy Hash: d4d6b0690c78101962fb8e7f9caf85952de22e8f7928b8745ad3af5ca1aa31bf
Instruction Fuzzy Hash: FCD0953250D1605FC74407A42C015C73776DF4D300B0580E7B901D7146CDBC4D0593F1

Function 05A0CC32 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909346b4158d344b9d984fd35851207d1c6191f7d6cefb9092212be1ebaf3636
Instruction ID: dd9c0c1c39f85d1915716dee96a0420f9dac343d46c60a2a27ca3bf5d400a3fe
Opcode Fuzzy Hash: 909346b4158d344b9d984fd35851207d1c6191f7d6cefb9092212be1ebaf3636
Instruction Fuzzy Hash: 99D05B303142109BC758DA79E425A76B7D6A748328B04D55DE41BC7681D673ED118681

Function 062524D0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9518cace00cb4890b238586c89e02e8eeedce0c794f729cf5dd000a94495fbd
Instruction ID: 303857a4d0cbd2ab8d9e0aad00c4a008eae7bf501344daa72177a4e3f47e7e51
Opcode Fuzzy Hash: f9518cace00cb4890b238586c89e02e8eeedce0c794f729cf5dd000a94495fbd
Instruction Fuzzy Hash: 56D05E35200224DFC715EBA8F409C4677ECE70C2113000065F504C3325CA31D800CB90

Function 06B73FEA Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e887a0676204bf29b60c536da2c9297e110b4322599d7ae0591b3741fd86b1
Instruction ID: 473023a07dd782cbe9902781eb8594c3164f67b277cb00ce7c044f3cfad982a5
Opcode Fuzzy Hash: 90e887a0676204bf29b60c536da2c9297e110b4322599d7ae0591b3741fd86b1
Instruction Fuzzy Hash: 13C08CE624F2901F9BC222310C204E30FA8882318771AA1E7E0A1C7993F5098B1A5272

Function 06B74988 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3d4b09797409812ee114cd83b28b6df5693b7110ec9cc8891dc43ebcaab588
Instruction ID: 2213b2c7da31420882469d4b19474e1feb56101136cbdc41734011225d265ed9
Opcode Fuzzy Hash: be3d4b09797409812ee114cd83b28b6df5693b7110ec9cc8891dc43ebcaab588
Instruction Fuzzy Hash: 3FD01271A1110CEF8B40EFA5ED4195DB7F9EB45208B1045B9E409D3251DA355F009B51

Function 06B73FC0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f2c1a8ca8b2402f991e1389d02ef6e42f1393409f587cce01276739793a51a
Instruction ID: 8b08f5d3821d89df44e7aa7f6fbe0fdc3743d3a86a3510d9cb8d081bb34c8cd9
Opcode Fuzzy Hash: 82f2c1a8ca8b2402f991e1389d02ef6e42f1393409f587cce01276739793a51a
Instruction Fuzzy Hash: C6D012717543088B9B4466B5740442A33EEDB8474875045B8E52DC7644EE36DC01D655

Function 06B7F769 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e168138206d6c7a9f4cdd7b7bb7641243a6eaec86b9af069515f56963b6ce589
Instruction ID: bae17f760b82e57f8bace1725ae7ac19ad03db9fecca4bebf3cf0054091504e7
Opcode Fuzzy Hash: e168138206d6c7a9f4cdd7b7bb7641243a6eaec86b9af069515f56963b6ce589
Instruction Fuzzy Hash: 88D05E75105A44DFC265DA28E909BB23FECDF49219B2804E4E1884A523C165E42AC7A5

Function 06252230 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5a5382951d49b5da902b6caf9a4f8ad9fb7c44ded29e746afe2e9618431f69
Instruction ID: 3d7c44c8b1b770713e5fa7118d001afa791926ed44adb55134e84219c3ff29be
Opcode Fuzzy Hash: 4a5a5382951d49b5da902b6caf9a4f8ad9fb7c44ded29e746afe2e9618431f69
Instruction Fuzzy Hash: 62C080F130002557E61431987421A9FB5DDEB897F8F400059E50DC3742DD995C0043D7

Function 06250F40 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c3c6f3e65a7aa89e028821f37458a22875d24a41b23d1ce394abc0c963c753
Instruction ID: f1a8f9c4d2bcfdfc561cff15ce83f1e9e20c66dfc182e0e3eee015f094571bae
Opcode Fuzzy Hash: f1c3c6f3e65a7aa89e028821f37458a22875d24a41b23d1ce394abc0c963c753
Instruction Fuzzy Hash: 2BD0C936210118AF8B44DE89D840C95BBA9FF4D6607158096FA188B332C672EC11DB90

Function 06251980 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d2ca49859dbaceae900209a04c3c76e96ca06444ab160190a94bd776f77498
Instruction ID: 7ef9f8a3b36b996f3bfe3a61cc070a05c4ea2e857eade826a62fc2a544494b04
Opcode Fuzzy Hash: f3d2ca49859dbaceae900209a04c3c76e96ca06444ab160190a94bd776f77498
Instruction Fuzzy Hash: 90D012A241D3481FD7876725B8138883FB8ED936047475AD2D08986027D65C69068353

Function 06B78628 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa6dced579cc2dc7161317e1f047d6e2b3904cbab44ea5dca65978f4ba78c31
Instruction ID: 94005ee746c08ce95fa7d8801e2ba398bb374396a44098d0b5bac283e0657ca2
Opcode Fuzzy Hash: 7aa6dced579cc2dc7161317e1f047d6e2b3904cbab44ea5dca65978f4ba78c31
Instruction Fuzzy Hash: 3DC012A14447040FC2416A54F815B91376E4AC0104F0409A2ED0EC72A6E5995D684791

Function 06B7F740 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4a592ec310f464ec2019200861dc87cd468b83b2621848625c268a7612c27d
Instruction ID: 98faef253e36493feeea4a96f4ee67635273566783260f2f73159696650ebb5c
Opcode Fuzzy Hash: 1d4a592ec310f464ec2019200861dc87cd468b83b2621848625c268a7612c27d
Instruction Fuzzy Hash: EAD0C9B01183548FC3418A6CD855D423B79AB66604B1600E5E1048B673C666E8508795

Function 06B72289 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6628b8e1f9b5d19c4684f8a32efd73afbb96013a5a553c9352dd414c73b06fee
Instruction ID: 65d4eca8dbe6f6192d506248fd1e7deb56f7e0aa5a3da38754184d385134c44e
Opcode Fuzzy Hash: 6628b8e1f9b5d19c4684f8a32efd73afbb96013a5a553c9352dd414c73b06fee
Instruction Fuzzy Hash: C1D0123300415D9BCB359F64BD4ABDA3B1DDF80164F400551F90C37407AA647A5186D6

Function 012A8DF8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396a277178fec934defdb940daa1cf8f03a0a367551cc55eabe2d42965690622
Instruction ID: b73506880420afa04af59f0b3e990ea643c2c63266834544551b8231bbde898f
Opcode Fuzzy Hash: 396a277178fec934defdb940daa1cf8f03a0a367551cc55eabe2d42965690622
Instruction Fuzzy Hash: 21D012D454C2C10FC713637409617953F705E96204B994DD6D48447193D519401B9325

Function 012A1F68 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116d7ebc32c9d265e279e4668f675a394f561201489332e9ea61509a67d3852d
Instruction ID: 751d6011c2ff8b570b185820dae85d9362d42079a988b47a448760fb75345792
Opcode Fuzzy Hash: 116d7ebc32c9d265e279e4668f675a394f561201489332e9ea61509a67d3852d
Instruction Fuzzy Hash: 47D0A720600248DBDB8097F884117DC7B65EFD5310F901175C105960558FE40274C673

Function 012A1F55 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa4b48362bef8abb488e7fbda60281aea06464f6cc29b7340f38a46651a8aeb6
Instruction ID: 460a582c9808c37896a13f8c4b9c6f21bdcab5426f970bfec6b3b59c9c7fdd20
Opcode Fuzzy Hash: fa4b48362bef8abb488e7fbda60281aea06464f6cc29b7340f38a46651a8aeb6
Instruction Fuzzy Hash: 56D0A735A00248DBDB40D7E4C4127DC77B5FF84310FA01165C106A3080CFB41664C672

Function 06B717BF Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29fd2e039d6265deaeeba56e6275ae9c1cf45b3f510b0324df0174d8c1c20c05
Instruction ID: e3b495b2a2b1bce51cdc9a25cf2a20cbe39931370313ef62d742bf559c7a515b
Opcode Fuzzy Hash: 29fd2e039d6265deaeeba56e6275ae9c1cf45b3f510b0324df0174d8c1c20c05
Instruction Fuzzy Hash: 16C0807700D3805FC7115E10DD54BC77F315B51705F11C046F245472C1C5211A94D773

Function 012A1F78 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37410e17c0564380e7077cf15cec12edeefdc591804871df3145f4ae997ccf8
Instruction ID: 26d08c1b809397c7ac945f2e07709eca54b55e687262a199c6c811df4f8fe7b4
Opcode Fuzzy Hash: b37410e17c0564380e7077cf15cec12edeefdc591804871df3145f4ae997ccf8
Instruction Fuzzy Hash: D7C012256406199ADBC0A7FC991478C7A5ADFD5300F501178D1088A17A8EE80634DAB3

Function 05A0A268 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e869ad8e72aa634a5bf1ce7923522816f30a61d9977c4ae62ed21e702343e375
Instruction ID: cb25e7d06b7722d9ecba2ea143dd61099912c61751926f1558eab8f10bee58c3
Opcode Fuzzy Hash: e869ad8e72aa634a5bf1ce7923522816f30a61d9977c4ae62ed21e702343e375
Instruction Fuzzy Hash: 8BD0EA352446048FCB48EBA9D498959B7E9BF4860535104E4F51ACB7A2EE65E9008B51

Function 05A0FCB0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92e6ee8d493f10bf0a5f5a025b2572861293c6474aa97df3735d18d2ffd9213
Instruction ID: 065959714901a61a812010de867fc31171a171ed98d879c1851ca8e2b7146a95
Opcode Fuzzy Hash: c92e6ee8d493f10bf0a5f5a025b2572861293c6474aa97df3735d18d2ffd9213
Instruction Fuzzy Hash: CEC012325200248FCE208F184C053ED33AAEB002A2F4A00509E01E2441E62AA5A49B62

Function 05A0FF51 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8007777f41c7e82ae861a5ecebe24624c7e0e328b4833a851a69b377595efc5
Instruction ID: 626edd2f1a163dd257eb2ba4867013eb33d18f6dbd08022fa0edc16359c67741
Opcode Fuzzy Hash: d8007777f41c7e82ae861a5ecebe24624c7e0e328b4833a851a69b377595efc5
Instruction Fuzzy Hash: C1C0929A40D3D0AFC39341A42D2D6E32FB458270103AD17D3D641CFBB2D00E0A8A42B3

Function 06B716E0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf8a432eb76128889e6298871f77f73e578f46c6cf31bff4a8ddda07730ccf5
Instruction ID: 208a9d487ba9582e08a6b3baef9309c78f6b61e6ad770fb957acb11a936c5100
Opcode Fuzzy Hash: caf8a432eb76128889e6298871f77f73e578f46c6cf31bff4a8ddda07730ccf5
Instruction Fuzzy Hash: 23C09B979D5B4559FB0151719E4B7D53D738BD1A8CF1DC4A2A552C51C1CD1D44C24121

Function 06B78600 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 632f084601502c6405c49d19a1063f2ce82f635763dc67e12259a738239f8579
Instruction ID: ce037aa71f888c91fac1e9844a76888538a98d37b9cf70a0d0235f82cdce9939
Opcode Fuzzy Hash: 632f084601502c6405c49d19a1063f2ce82f635763dc67e12259a738239f8579
Instruction Fuzzy Hash: D8C08C90D042400BDA819968922239239A29BC0244F0540E88C4ACBBC2FA25DC1843D2

Function 06B7F778 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492cccb23d7a460b0c5b9cab68c2f02c7e5df2d21aaa4f3bb9b299a9f92f7fa2
Instruction ID: 711a6c732da77946f1361cfe7b0f52e47fdcb8f951a015f4828d27827d26e461
Opcode Fuzzy Hash: 492cccb23d7a460b0c5b9cab68c2f02c7e5df2d21aaa4f3bb9b299a9f92f7fa2
Instruction Fuzzy Hash: 20C08CB0451904CFC358DE08E50CA3137ECEF0072AB6410F4E1084FA32C271E822CB95

Function 06C1B910 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01cc7d6ba282745c46934b516858c939f43a61af2f329e359ece32c77310e86
Instruction ID: b1ab366086c6cca7a298170009183929d850c5d472c6fda14d2b91b6bf9f8761
Opcode Fuzzy Hash: f01cc7d6ba282745c46934b516858c939f43a61af2f329e359ece32c77310e86
Instruction Fuzzy Hash: 8FD0C9B22093828FE3468B34E545D02BFB4AF9731070641C7E194CB973D365A828D712

Function 06B72260 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070c44752ffe3e1a0b1e17529789753fb211728d577eff51d5772170ed4dbbb4
Instruction ID: 7d6544011be2d24929772c61cd7200807262c7e91fc52949dcc5050578dbfd6d
Opcode Fuzzy Hash: 070c44752ffe3e1a0b1e17529789753fb211728d577eff51d5772170ed4dbbb4
Instruction Fuzzy Hash: DDC08C216040E487DE31CE58E8A07E72B52EBC4348F021498D8012FA46D135EA2AC781

Function 012A7220 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3901537177.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6032aba87c25aabdafd52eac7b9efeb51a424ee7a82a3b45477d507ea86fa2
Instruction ID: 5b94bb2cb3d1d5f03f7a2950088abc8b08bb95c5369fc575cf96990e74f17320
Opcode Fuzzy Hash: 4e6032aba87c25aabdafd52eac7b9efeb51a424ee7a82a3b45477d507ea86fa2
Instruction Fuzzy Hash: FEC02B708C41804BCF00091944041D83F2367E4300BE406A39141C1E51F42E44078B08

Function 06C1D3DA Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c55186832e4bda1fb39123eaabf0b9a13e4976eea1499fd4cb5a69f8e3e1275
Instruction ID: faff5985e9dee767faa1b24f5a7a0be158e36a50a48f1832a118581b466339b3
Opcode Fuzzy Hash: 0c55186832e4bda1fb39123eaabf0b9a13e4976eea1499fd4cb5a69f8e3e1275
Instruction Fuzzy Hash: EDC0801285E3D147DB11D730DC157473F319B41700F0545E994110F5D6D1415852EB92

Function 0625202F Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0abf0237e7398d5bcd47f78bbddb9da890697648a395c63f5095321e35f265
Instruction ID: c57e573beb9a467319cfdf7a615613c0f50bb93980e6869209be4c2262574ba8
Opcode Fuzzy Hash: 1c0abf0237e7398d5bcd47f78bbddb9da890697648a395c63f5095321e35f265
Instruction Fuzzy Hash: EBC09238260208DFC300DB69E589CA0BBECFF49A0835580D9F50D8BB32CB22FC01CA91

Function 06B72E4F Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d537ad3cfd1911e2568cddf10aaf58c02f8a52466c5d229e5c4694d851737d5
Instruction ID: 1c5cd8a4f3d8ce7609019eaf4c24832552bad0752afd78105c8b49270b4e5e4e
Opcode Fuzzy Hash: 9d537ad3cfd1911e2568cddf10aaf58c02f8a52466c5d229e5c4694d851737d5
Instruction Fuzzy Hash: AFA011F328E0200EB3080088300B0AE8388CAF003B822003BE320800802822202220AE

Function 06B7F5DB Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfed1d6a3013424f54511c65236bb9939969cf7233755d0cbcb0492dc5e618b1
Instruction ID: 99dcc6885ce3b41b71611a2b3505d5916569c2ff70793e455ad7df0d0e81cf20
Opcode Fuzzy Hash: dfed1d6a3013424f54511c65236bb9939969cf7233755d0cbcb0492dc5e618b1
Instruction Fuzzy Hash: AAB01237A0600C681910508478418DDF324E1906757204023D620450000222063E56E1

Function 06252030 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea37b6cea62d40df410734184e5c43626299f01a35dbb0a8c3f936d9d13bb41f
Instruction ID: 4f1a3ac6db0f59e3f0d4f9a92a27a48c10cc8b74c58d88c87f1da974c996a5cc
Opcode Fuzzy Hash: ea37b6cea62d40df410734184e5c43626299f01a35dbb0a8c3f936d9d13bb41f
Instruction Fuzzy Hash: B0C09238260208CFC300DB59D588C10BBECFF49A0835580D8E50D8B732CB22FC01CA80

Function 06B7F750 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a9bb855b66031527ad60d43b9bbe596700b8874c009695b8fe6633e9f835db
Instruction ID: 74d73ab9e6f381ab5f9d9b95b6852324e2f71f11f687843942c945560dc2aa6d
Opcode Fuzzy Hash: 94a9bb855b66031527ad60d43b9bbe596700b8874c009695b8fe6633e9f835db
Instruction Fuzzy Hash: 85B092302602088FC300DA59D444E4173ACFF48B08F5100E0E5088BB32C662FC008A40

Function 06C1BB40 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462f806103f530d795e63e7cd30240698a3559f3884ee21002b46cc62c982ebf
Instruction ID: 6fbcf1f5ec28ca42d97467a1f5765d7ad0081893954cfa62ae1f798fcecbba57
Opcode Fuzzy Hash: 462f806103f530d795e63e7cd30240698a3559f3884ee21002b46cc62c982ebf
Instruction Fuzzy Hash: 50B09237A0800889EB509A85B4813EDFB20FB91225F108027D21166400C23201689BD1

Function 05A0D2BA Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb858f04de4a9eb1fc9373e19b41fa6e12d385882c18b96a804ac1fa9c27f97
Instruction ID: 9aac35fc1c82166f4369dee0dc3fc456f94ef2cd5fb5748003e83ba1c75cbec1
Opcode Fuzzy Hash: 6cb858f04de4a9eb1fc9373e19b41fa6e12d385882c18b96a804ac1fa9c27f97
Instruction Fuzzy Hash: 5CC02B30041007DFC7012FA0F8C08D13F28EE823803106393F00A05CB993240404C794

Function 06251990 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905335956.0000000006250000.00000040.00000800.00020000.00000000.sdmp, Offset: 06250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6250000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8527945eddaeefec58fa2f15c7beedab0a81cb76c09d615540adc09def36843d
Instruction ID: 4fc0ee8d06883ad114103ae3ba3b640afbdc63108d65c6e3872d8e2ce83733ae
Opcode Fuzzy Hash: 8527945eddaeefec58fa2f15c7beedab0a81cb76c09d615540adc09def36843d
Instruction Fuzzy Hash: D1B0123004020D4FC6007B59F405D0C3F9DEAC03097506370E00C0641F5BAC7845C7C4

Function 06B78638 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b956fa11ddc691fdb22b709e9abcc2686e3aaf7533fabb235c1b0191dba62b2
Instruction ID: 22bf7a40e3d6278b5f4af26c3db9a68c6ef35133e5bfd163ffeceaa911c467d4
Opcode Fuzzy Hash: 7b956fa11ddc691fdb22b709e9abcc2686e3aaf7533fabb235c1b0191dba62b2
Instruction Fuzzy Hash: 84B0123105420D4FC6017B95F844D05373DDE802047405660F20C46579AAECBC588794

Function 06B72298 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48999ff56786dddec2df21cefa7d9357d66542e3c7ac013285525548fe22916
Instruction ID: d2598afdb06e78c336152936f5da4e0a08a2bcb1ba13e4506644f77ba862bd9b
Opcode Fuzzy Hash: b48999ff56786dddec2df21cefa7d9357d66542e3c7ac013285525548fe22916
Instruction Fuzzy Hash: C6B0123114020E8FC5097B65F644915372DDEC02947400220F30C0641A6EBCA9468784

Function 06C1B920 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c5e80e5d161c6cd17717d7e90366d7df6c86bdedef1d8d57fbaaa881c347e6
Instruction ID: 1485e72821faeb6dd9078d765896f2924cff3babc4a0a417e0ffd36dedc08b16
Opcode Fuzzy Hash: 99c5e80e5d161c6cd17717d7e90366d7df6c86bdedef1d8d57fbaaa881c347e6
Instruction Fuzzy Hash: 69B092721502088F8300DB68E548C0277A8AB18A1031140A1E2048B232C621F8108A65

Function 05A0D2C0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3905242208.0000000005A00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5a00000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f67e3de12a693726ca9b0693a53c8784ba7f83f353e6bc05e447521f9b6884
Instruction ID: 14862e1646b6c278fda201411efc4cde3ef0e085b8239e93801963ed514d92b2
Opcode Fuzzy Hash: 42f67e3de12a693726ca9b0693a53c8784ba7f83f353e6bc05e447521f9b6884
Instruction Fuzzy Hash: C8B0123008020E8FC6427B75F844955376DEE822857806722E20D464997B6C6909C6D8

Non-executed Functions

Function 06C154F9 Relevance: 6.6, Strings: 5, Instructions: 388COMMON

Download Yara Rule

Strings

Pl]q, xrefs: 06C1584E
Pl]q, xrefs: 06C1555D
Pl]q, xrefs: 06C158C5
Pl]q, xrefs: 06C15701
Pl]q, xrefs: 06C157BA

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: Pl]q$Pl]q$Pl]q$Pl]q$Pl]q
API String ID: 0-2296359727
Opcode ID: 7e2a0e1ab80baf82e1f6c786feab544c74cd03f3d44263864374f3ac67e27a98
Instruction ID: b5ef7aae42bd0a4f5c3cc30454a85621c5516d672179af43a373a0813760e25f
Opcode Fuzzy Hash: 7e2a0e1ab80baf82e1f6c786feab544c74cd03f3d44263864374f3ac67e27a98
Instruction Fuzzy Hash: 47E1CA70B406048FD755DF39C984A6ABBEABFC8300F1489ADD5428B3B5DA78EC05CB91

Function 06C1C200 Relevance: 6.5, Strings: 5, Instructions: 213COMMON

Download Yara Rule

Strings

(_]q, xrefs: 06C1C3E2
c]q, xrefs: 06C1C331
4c]q, xrefs: 06C1C34D
Haq, xrefs: 06C1C401
$]q, xrefs: 06C1C229

Memory Dump Source

Source File: 00000001.00000002.3906126105.0000000006C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c10000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (_]q$4c]q$Haq$$]q$c]q
API String ID: 0-3600044206
Opcode ID: 4bfd35fa236c377da4266d61ed4caeb8d8758a1d2dc53a2b8617007f19109ea1
Instruction ID: 59550e9438920a0b5ac51ce4182d76f9359fd3d1fb5b6048050375265a376a85
Opcode Fuzzy Hash: 4bfd35fa236c377da4266d61ed4caeb8d8758a1d2dc53a2b8617007f19109ea1
Instruction Fuzzy Hash: 0471B830B4435ACBEBA05A6DD4407A677A4DF46B40F501C7EFC81EF284D628CD82EB96

Function 06B76B50 Relevance: 6.3, Strings: 5, Instructions: 94COMMON

Download Yara Rule

Strings

(aq, xrefs: 06B76C30
`]bq, xrefs: 06B76BD7
Haq, xrefs: 06B76BF1
,aq, xrefs: 06B76B7F
,aq, xrefs: 06B76B8B

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$,aq$,aq$Haq$`]bq
API String ID: 0-3222906251
Opcode ID: 87a2cf41af2c969c0b0f03b63c170f677d54f222ef86984eb4f2593c2475f3b6
Instruction ID: 6c87635fdc4328fb214e97acc549571777c3e7f2219daf26888ae46446612eec
Opcode Fuzzy Hash: 87a2cf41af2c969c0b0f03b63c170f677d54f222ef86984eb4f2593c2475f3b6
Instruction Fuzzy Hash: EB312531B045198FC7989F2CD4154AE7BEAFF8A32176144EAE006DB3A4DE20AC41C7C5

Function 06B73B28 Relevance: 5.1, Strings: 4, Instructions: 148COMMON

Download Yara Rule

Strings

c]q, xrefs: 06B73C1B
(aq, xrefs: 06B73C81
4c]q, xrefs: 06B73C49
$]q, xrefs: 06B73C32

Memory Dump Source

Source File: 00000001.00000002.3905963543.0000000006B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6b70000_WebCompanion-Installer.jbxd

Similarity

API ID:
String ID: (aq$4c]q$$]q$c]q
API String ID: 0-4156575840
Opcode ID: 7e1a7a0cb33f4150487851dead64848fa75f247c954ff12782f290c59cd9e0cf
Instruction ID: 0317e0a6cb1e4f4c6cfea5b8cd765f8b1d7a5e07afe685b37a23a6c06cb60783
Opcode Fuzzy Hash: 7e1a7a0cb33f4150487851dead64848fa75f247c954ff12782f290c59cd9e0cf
Instruction Fuzzy Hash: 9D414871344B108FD7698B39898066E7BE6FFC4210B1845DEC4928B761DB24EC45D392

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ICSharpCode.SharpZipLib.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\Newtonsoft.Json.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\WebCompanion-Installer.exe.config

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\de-DE\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\en-US\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\es-ES\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\fr-CA\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\it-IT\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ja-JP\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\pt-BR\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\ru-RU\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\tr-TR\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\7zSC3876AD5\zh-CHS\WebCompanion-Installer.resources.dll

C:\Users\user\AppData\Local\Temp\WcInstaller.log

C:\Users\user\AppData\Local\Temp\WebCompanion.zip

C:\Users\user\AppData\Roaming\Lavasoft\Web Companion\Options\Statistics.txt

Static File Info

General

File Icon

Windows Analysis Report
Setup.exe

Function 004148D4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
COMMON

Function 00405434 Relevance: 3.0, APIs: 2, Instructions: 44
fileCOMMON

Function 00401014 Relevance: 48.0, APIs: 8, Strings: 19, Instructions: 715
windowsynchronizationCOMMON

Function 0040AB05 Relevance: 14.2, APIs: 9, Instructions: 682
COMMON

Function 004051B7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 102
threadCOMMON

Function 00404908 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36
filetimeCOMMON

Function 004083AB Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Function 00405620 Relevance: 4.6, APIs: 3, Instructions: 130
COMMON

Function 00406F68 Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Function 0040280E Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 384
COMMON

Function 004030FC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Function 00404A3E Relevance: 3.2, APIs: 2, Instructions: 166
COMMON

Function 00408755 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Function 0041468E Relevance: 3.0, APIs: 2, Instructions: 45
threadCOMMON

Function 00405892 Relevance: 3.0, APIs: 2, Instructions: 45
fileCOMMON