Edit tour

Windows Analysis Report
5kplayer-setup.exe

Overview

General Information

Sample name:	5kplayer-setup.exe
Analysis ID:	1428553
MD5:	0cb8a509b925197bd4b94b4c835c8db9
SHA1:	b741c00855307aa3a8a3c52c651c2c8d969a4f78
SHA256:	02b4b6cd3a3a78cc764cb0ad573a9bce3ab0f1681d5e6926c9501e0ebcd7bbbb
Infos:

Detection

Score:	9
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample crashes during execution, try analyze it on another analysis machine

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Sample searches for specific file, try point organization specific fake files to the analysis machine

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Process Tree

System is w10x64

5kplayer-setup.exe (PID: 3228 cmdline: "C:\Users\user\Desktop\5kplayer-setup.exe" MD5: 0CB8A509B925197BD4B94B4C835C8DB9)

5kp.exe (PID: 5436 cmdline: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe MD5: 3E71A7C07BB5BD316F64768D21971CFC)

WerFault.exe (PID: 1016 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 6324 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

HTTP traffic detected: GET /r/go.php?an=5kpwin&cvs=6.0&pvs=1.0&cb=&ev=dlop&fui=undef&rt=undef&uc=b05ce96439b86b60&eid=&jump=&h=332266dd795ace9fc247de70ace0e169 HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-CH,*User-Agent: Mozilla/5.0Host: www.5kplayer.com

Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000013BA000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr

String found in binary or memory: mail.google.com04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1eQSslCertificate(D:/Qt/qt-5.7.1-src/qtbase/src/corelib/tools/qarraydata.hsize == 0 || offset < 0 || size_t(offset) >= sizeof(QArrayData), QMap([*?[][\$\*\+\.\?\[\]\^\{\}\|].f5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: www.5kplayer.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:36 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:36 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:37 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:40 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:41 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:41 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:41 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:41 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:42 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:42 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:42 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:42 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:42 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:42 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:42 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:42 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:43 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:43 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:44 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:44 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:44 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:44 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:44 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:45 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:46 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:46 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:46 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:46 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:46 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:46 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:46 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:46 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:46 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:47 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:47 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:47 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:47 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:47 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:47 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:47 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:47 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:47 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:48 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:48 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:48 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:48 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:48 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:48 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:48 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:48 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:48 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:49 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:49 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:49 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:49 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:49 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:49 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:49 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:49 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:49 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:50 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:50 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:50 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:50 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:50 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:50 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:50 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:50 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:50 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:51 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:51 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:51 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:51 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:51 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:51 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:51 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:51 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:51 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:52 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:53 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:54 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:55 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:56 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:57 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 19 Apr 2024 05:57:58 GMTServer: ApacheKeep-Alive: timeout=5, max=800Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1

Source: 5kplayer-setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 5kplayer-setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: 5kplayer-setup.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: 5kplayer-setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 5kplayer-setup.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: 5kplayer-setup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 5kplayer-setup.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 5kplayer-setup.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 5kp.exe.0.dr	String found in binary or memory: http://dejavu-fonts.org
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe.0.dr	String found in binary or memory: http://dl1.5kplayer.com/download/5kplayer-32bit.exe
Source: 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe.0.dr	String found in binary or memory: http://dl1.5kplayer.com/download/5kplayer-64bit.exe
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: http://dl1.5kplayer.com/download/onlineload.config
Source: 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com/download/onlineload.configN
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: http://dl1.5kplayer.com/download/onlineload.confighttp://dl1.5kplayer.com/download/5kplayer-64bit.ex
Source: 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80
Source: 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80#
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80%
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80)
Source: 5kp.exe, 00000001.00000002.2198720408.000000001ECA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80I2
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80L
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80N
Source: 5kp.exe, 00000001.00000002.2184869709.00000000078E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80O
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007927000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80U
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80m
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80m)
Source: 5kp.exe, 00000001.00000002.2183945857.0000000005B96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80m3Y
Source: 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80m85
Source: 5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80m;
Source: 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mM
Source: 5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mS
Source: 5kp.exe, 00000001.00000002.2198720408.000000001ECA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mV1
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mW
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mZ
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80ma
Source: 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mb
Source: 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mc=
Source: 5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2198720408.000000001ECA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mf
Source: 5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mgdz
Source: 5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mh
Source: 5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mi
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80ms
Source: 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mt
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80mw
Source: 5kp.exe, 00000001.00000002.2198720408.000000001ECA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80my=
Source: 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80u
Source: 5kp.exe, 00000001.00000002.2184869709.0000000007ADB000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80y
Source: 5kp.exe, 00000001.00000002.2198720408.000000001ECA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dl1.5kplayer.com:80z?
Source: 5kp.exe, 00000001.00000000.1721326889.00000000015CF000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://gcc.gnu.org/bugs.html):
Source: 5kplayer-setup.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 5kplayer-setup.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: 5kplayer-setup.exe	String found in binary or memory: http://ocsp.digicert.com0N
Source: 5kplayer-setup.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: 5kplayer-setup.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000013BA000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000013BA000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000013BA000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: http://www.phreedom.org/md5)
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000013BA000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: http://www.phreedom.org/md5)08:27
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://jp.videoproc.com?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jp.videoproc.com?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-de.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-de.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-es.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-es.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-fr.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-fr.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-it.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-it.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-jp.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-jp.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-pt.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-pt.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-zh.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-zh.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit.htm?ttsoft=5kpwin-%1-instui
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit.htm?ttsoft=5kpwin-%1-instuidownFailin
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/install/download-5kplayer-32bit-64bit.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/iphone-manager-de?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/iphone-manager-de?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/iphone-manager-jp?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/iphone-manager-jp?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/iphone-manager-zh?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/iphone-manager-zh?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/iphone-manager/?ttsoft=5kpwin-%1-instui
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/iphone-manager/?ttsoft=5kpwin-%1-instuiipManagerinstuiSetup/recsoftipmng/na
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/iphone-manager?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com/iphone-manager?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/r/go.php?
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/r/go.php?undefan=5kpwin&cvs=%1&pvs=%2&cb=&ev=licl&fui=%3&rt=%4&uc=%5&eid=&j
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/software/rip-dvd.htm?ttsoft=5kpwin-%1-instui
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.5kplayer.com/software/rip-dvd.htm?ttsoft=5kpwin-%1-instuidvdRepinstuiSetup/recsoftdvdRip
Source: 5kp.exe, 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com:443
Source: 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.5kplayer.com:443aming
Source: 5kplayer-setup.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.videoproc.com/?ttsoft=5kpwin-%1-instui
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.videoproc.com/?ttsoft=5kpwin-%1-instuivideoporcinstuiSetup/recsoftvdproc/namevdproc/info
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.videoproc.com/index-de.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.videoproc.com/index-de.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.videoproc.com/index-es.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.videoproc.com/index-es.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.videoproc.com/index-fr.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe	String found in binary or memory: https://www.videoproc.com/index-fr.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.videoproc.com/index-fr.htm?ttsoft=5kpwin-6.0-instui-undefL
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.videoproc.com/index-it.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe	String found in binary or memory: https://www.videoproc.com/index-it.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.videoproc.com/index-it.htm?ttsoft=5kpwin-6.0-instui-undefL
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.videoproc.com/index-zh.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.videoproc.com/index-zh.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.videoproc.com?ttsoft=5kpwin-%1-instui
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.videoproc.com?ttsoft=5kpwin-%1-instuivideoporc_enhttps://jp.videoproc.com?ttsoft=5kpwin-
Source: 5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.videoproc.com?ttsoft=5kpwin-6.0-instui-undef
Source: 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.videoproc.com?ttsoft=5kpwin-6.0-instui-undefX
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum/index-de.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum/index-de.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum/index-es.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum/index-es.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum/index-fr.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum/index-fr.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum/index-jp.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum/index-jp.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum/index-zh.htm?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum/index-zh.htm?ttsoft=5kpwin-6.0-instui-undef
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum?ttsoft=5kpwin-%1-instui
Source: 5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.winxdvd.com/dvd-ripper-platinum?ttsoft=5kpwin-6.0-instui-undef

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733

Source: unknown

HTTPS traffic detected: 67.228.121.196:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_004038AF

Source: C:\Users\user\Desktop\5kplayer-setup.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03E95006	1_3_03E95006

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Code function: String function: 004062CF appears 58 times

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 6324

Source: 5kplayer-setup.exe, 00000000.00000003.1719133937.0000000002320000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename5kplayer.exe2 vs 5kplayer-setup.exe
Source: 5kplayer-setup.exe, 00000000.00000003.1719338884.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename5kplayer.exe2 vs 5kplayer-setup.exe
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.0000000003DBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename5kplayer.exe2 vs 5kplayer-setup.exe
Source: 5kplayer-setup.exe, 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamensis7z.dll, vs 5kplayer-setup.exe

Source: 5kplayer-setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5kplayer-setup.exe

Static PE information: Section: .reloc ZLIB complexity 1.002685546875

Binary or memory string: nna.nosciencehu.comtadaoka.osaka.jphayakawa.yamanashi.jpdnsalias.orgedu.saedu.sbedu.rsedu.sclib.id.usogori.fukuoka.jpnotogawa.shiga.jpedu.sdrepbody.aeroid.auedu.ruk12.nj.usloyalist.museumedu.rwedu.sgxyzmoka.tochigi.jpdynathome.netkimino.wakayama.jpedu.slnissanveterinaire.kmkokubunji.tokyo.jpedu.snos.hordaland.notm.kmartsandcrafts.museumis-a-musician.com*.kitakyushu.jpiitate.fukushima.jpedu.stav.iturayasu.chiba.jpedu.svflorida.museumninjaedu.synemuro.hokkaido.jpedu.tjs

Source: classification engine

Classification label: clean9.winEXE@4/9@2/2

Source: C:\Users\user\Desktop\5kplayer-setup.exe

0_2_004044D1

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

File created: C:\Users\user\AppData\Roaming\Digiarty

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Mutant created: \Sessions\1\BaseNamedObjects\5KPlayer - Online
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5436

Source: C:\Users\user\Desktop\5kplayer-setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsl8A29.tmp

Jump to behavior

Source: 5kplayer-setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5kplayer-setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\5kplayer-setup.exe

File read: C:\Users\user\Desktop\5kplayer-setup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\5kplayer-setup.exe "C:\Users\user\Desktop\5kplayer-setup.exe"
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process created: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 6324
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process created: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Jump to behavior

Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wintab32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Section loaded: ubsec.dll	Jump to behavior

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: 5kplayer-setup.exe

Static PE information: certificate valid

Source: 5kplayer-setup.exe

Static file information: File size 7270888 > 1048576

Source: 5kplayer-setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: 5kp.exe.0.dr	Static PE information: section name: .qtmetad
Source: 5kp.exe.0.dr	Static PE information: section name: .eh_fram

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03EB8F0E push ds; retf	1_3_03EB8F15
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03EC54F9 push es; retf	1_3_03EC54FA
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03EC54FB push es; iretd	1_3_03EC5506
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03EC54DC push es; ret	1_3_03EC54E6
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03EB9FE7 push cs; ret	1_3_03EB9FED
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03EB9DFA push es; ret	1_3_03EB9E7B
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03E5A2E5 pushfd ; retn 0000h	1_3_03E5A3FB
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03E5202A push 9703E185h; ret	1_3_03E52041
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03E527F0 pushad ; ret	1_3_03E527F9
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03E5479C pushad ; iretd	1_3_03E547F9
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03E59EBC pushad ; ret	1_3_03E59EBD
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03E54604 push esi; iretd	1_3_03E54649
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Code function: 1_3_03E545BA push esi; iretd	1_3_03E54649

Source: C:\Users\user\Desktop\5kplayer-setup.exe	File created: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe			Jump to dropped file
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\nsis7zU.dll			Jump to dropped file

Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Window / User API: foregroundWindowGot 1325

Jump to behavior

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\nsis7zU.dll

Jump to dropped file

Source: C:\Users\user\Desktop\5kplayer-setup.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\5kplayer-setup.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\Temp\5kplayer\	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\Desktop\5kplayer-setup.exe	File opened: C:\Users\user\	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 5kp.exe, 00000001.00000003.1774495271.0000000001D23000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183035264.0000000001D1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: 5kplayer-setup.exe, 00000000.00000002.2205853167.000000000075D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: 5kplayer-setup.exe, 00000000.00000003.1717563861.0000000003DBF000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000015CF000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: 21QEmulationPaintEngine
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 5kp.exe, 00000001.00000003.1774495271.0000000001D23000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000003.1735532907.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000003.1776663873.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000003.1730092660.0000000001D33000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000003.1735659860.0000000001D39000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000003.1740450430.0000000001D34000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183035264.0000000001D1B000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000003.1730212751.0000000001D39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll`
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\5kplayer-setup.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Source: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Masquerading	11 Input Capture	21 Security Software Discovery	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5kplayer-setup.exe	3%	ReversingLabs
5kplayer-setup.exe	1%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\nsis7zU.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://dejavu-fonts.org	0%	Virustotal		Browse
https://www.videoproc.com?ttsoft=5kpwin-%1-instuivideoporc_enhttps://jp.videoproc.com?ttsoft=5kpwin-	1%	Virustotal		Browse
http://www.phreedom.org/md5)	1%	Virustotal		Browse
https://www.videoproc.com/index-zh.htm?ttsoft=5kpwin-6.0-instui-undef	1%	Virustotal		Browse
https://www.videoproc.com/?ttsoft=5kpwin-%1-instui	1%	Virustotal		Browse
http://www.phreedom.org/md5)08:27	1%	Virustotal		Browse
https://www.videoproc.com/index-fr.htm?ttsoft=5kpwin-6.0-instui-undef	1%	Virustotal		Browse
https://www.videoproc.com?ttsoft=5kpwin-%1-instui	1%	Virustotal		Browse
https://www.videoproc.com/?ttsoft=5kpwin-%1-instuivideoporcinstuiSetup/recsoftvdproc/namevdproc/info	1%	Virustotal		Browse
https://www.videoproc.com/index-it.htm?ttsoft=5kpwin-%1-instui	1%	Virustotal		Browse
https://jp.videoproc.com?ttsoft=5kpwin-6.0-instui-undef	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.5kplayer.com	67.228.121.196	true	false		high
dl1.5kplayer.com	67.228.121.193	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://dl1.5kplayer.com:80mW	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dejavu-fonts.org	5kp.exe.0.dr	false	0%, Virustotal, Browse	unknown
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dl1.5kplayer.com:80mZ	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com:80mM	5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-jp.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
http://dl1.5kplayer.com:80mS	5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.5kplayer.com/iphone-manager-zh?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.winxdvd.com/dvd-ripper-platinum?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.5kplayer.com/software/rip-dvd.htm?ttsoft=5kpwin-%1-instuidvdRepinstuiSetup/recsoftdvdRip	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
https://www.winxdvd.com/dvd-ripper-platinum/index-zh.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-jp.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dl1.5kplayer.com:80mw	5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.5kplayer.com/iphone-manager-de?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
http://dl1.5kplayer.com:80m3Y	5kp.exe, 00000001.00000002.2183945857.0000000005B96000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com:80mt	5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-es.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-fr.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dl1.5kplayer.com:80ms	5kp.exe, 00000001.00000002.2184869709.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com/download/onlineload.confighttp://dl1.5kplayer.com/download/5kplayer-64bit.ex	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
http://dl1.5kplayer.com:80mf	5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2198720408.000000001ECA2000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.videoproc.com?ttsoft=5kpwin-%1-instuivideoporc_enhttps://jp.videoproc.com?ttsoft=5kpwin-	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false	1%, Virustotal, Browse	low
http://dl1.5kplayer.com:80mV1	5kp.exe, 00000001.00000002.2198720408.000000001ECA2000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com:80mi	5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com:80mh	5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com:80mb	5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.videoproc.com/index-fr.htm?ttsoft=5kpwin-6.0-instui-undefL	5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.winxdvd.com/dvd-ripper-platinum/index-de.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
http://dl1.5kplayer.com:80ma	5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com/download/onlineload.config	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
http://dl1.5kplayer.com:80my=	5kp.exe, 00000001.00000002.2198720408.000000001ECA2000.00000004.00000020.00020000.00000000.sdmp	false		low
http://www.phreedom.org/md5)	5kplayer-setup.exe, 00000000.00000003.1717563861.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000013BA000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false	1%, Virustotal, Browse	unknown
http://dl1.5kplayer.com:80mgdz	5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.winxdvd.com/dvd-ripper-platinum/index-fr.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
https://jp.videoproc.com?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://www.5kplayer.com/iphone-manager-jp?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	5kplayer-setup.exe	false		high
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit.htm?ttsoft=5kpwin-%1-instuidownFailin	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
http://dl1.5kplayer.com:80m85	5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.5kplayer.com/iphone-manager-de?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-it.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dl1.5kplayer.com:80m;	5kp.exe, 00000001.00000002.2184869709.000000000781C000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-fr.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
https://www.5kplayer.com/iphone-manager/?ttsoft=5kpwin-%1-instuiipManagerinstuiSetup/recsoftipmng/na	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
https://www.videoproc.com/index-zh.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://dl1.5kplayer.com/download/onlineload.configN	5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.videoproc.com/?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false	1%, Virustotal, Browse	unknown
http://dl1.5kplayer.com:80y	5kp.exe, 00000001.00000002.2184869709.0000000007ADB000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com:80m)	5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-pt.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.5kplayer.com/iphone-manager/?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
https://www.videoproc.com/index-fr.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe	false	1%, Virustotal, Browse	unknown
https://www.winxdvd.com/dvd-ripper-platinum/index-de.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dl1.5kplayer.com:80u	5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com:80I2	5kp.exe, 00000001.00000002.2198720408.000000001ECA2000.00000004.00000020.00020000.00000000.sdmp	false		low
http://www.phreedom.org/md5)08:27	5kplayer-setup.exe, 00000000.00000003.1717563861.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000013BA000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false	1%, Virustotal, Browse	unknown
http://dl1.5kplayer.com:80m	5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.videoproc.com/index-it.htm?ttsoft=5kpwin-6.0-instui-undefL	5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.sectigo.com0	5kplayer-setup.exe	false	URL Reputation: safe	unknown
https://www.5kplayer.com/iphone-manager-jp?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
http://dl1.5kplayer.com:80z?	5kp.exe, 00000001.00000002.2198720408.000000001ECA2000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.winxdvd.com/dvd-ripper-platinum/index-es.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.5kplayer.com:443aming	5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com:80mc=	5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-de.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dl1.5kplayer.com:80U	5kp.exe, 00000001.00000002.2184869709.0000000007927000.00000004.00000020.00020000.00000000.sdmp	false		low
http://www.openssl.org/support/faq.html	5kplayer-setup.exe, 00000000.00000003.1717563861.0000000003BAA000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000013BA000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
http://dl1.5kplayer.com:80L	5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	false		low
http://dl1.5kplayer.com:80O	5kp.exe, 00000001.00000002.2184869709.00000000078E5000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-zh.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
http://dl1.5kplayer.com:80N	5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.videoproc.com?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false	1%, Virustotal, Browse	low
http://dl1.5kplayer.com/download/5kplayer-64bit.exe	5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe.0.dr	false		high
https://www.videoproc.com/?ttsoft=5kpwin-%1-instuivideoporcinstuiSetup/recsoftvdproc/namevdproc/info	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false	1%, Virustotal, Browse	unknown
https://www.videoproc.com/index-it.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false	1%, Virustotal, Browse	unknown
https://www.videoproc.com/index-de.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-zh.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.winxdvd.com/dvd-ripper-platinum/index-zh.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
https://www.videoproc.com/index-es.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		unknown
http://dl1.5kplayer.com:80	5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
https://www.videoproc.com?ttsoft=5kpwin-6.0-instui-undefX	5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.videoproc.com/index-it.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe	false		unknown
https://jp.videoproc.com?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		low
https://www.5kplayer.com/r/go.php?	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
https://www.winxdvd.com/dvd-ripper-platinum/index-jp.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003EB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.5kplayer.com/install/download-5kplayer-32bit-64bit-de.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
http://dl1.5kplayer.com:80)	5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	false		low
https://sectigo.com/CPS0	5kplayer-setup.exe	false	URL Reputation: safe	unknown
https://www.5kplayer.com/iphone-manager?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
https://www.5kplayer.com/software/rip-dvd.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high
https://www.winxdvd.com/dvd-ripper-platinum/index-fr.htm?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dl1.5kplayer.com:80#	5kp.exe, 00000001.00000002.2183945857.0000000005BA7000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.5kplayer.com/iphone-manager?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 00000001.00000002.2183945857.00000000059E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.videoproc.com?ttsoft=5kpwin-6.0-instui-undef	5kp.exe, 5kp.exe, 00000001.00000003.1733194432.0000000003E4E000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000002.2183649527.0000000003E02000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.videoproc.com/index-zh.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		unknown
http://dl1.5kplayer.com:80%	5kp.exe, 00000001.00000002.2184869709.0000000007762000.00000004.00000020.00020000.00000000.sdmp	false		low
https://www.videoproc.com/index-fr.htm?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		unknown
http://upx.sf.net	Amcache.hve.8.dr	false		high
https://www.5kplayer.com/iphone-manager-zh?ttsoft=5kpwin-%1-instui	5kplayer-setup.exe, 00000000.00000003.1717563861.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, 5kp.exe, 00000001.00000000.1721326889.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 5kp.exe.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
67.228.121.196	www.5kplayer.com	United States		36351	SOFTLAYERUS	false
67.228.121.193	dl1.5kplayer.com	United States		36351	SOFTLAYERUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428553
Start date and time:	2024-04-19 07:56:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5kplayer-setup.exe
Detection:	CLEAN
Classification:	clean9.winEXE@4/9@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): fs.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 5kp.exe, PID 5436 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:57:28	API Interceptor	11513x Sleep call for process: 5kp.exe modified
07:58:14	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.228.121.196	5kplayer-setup.exe	Get hash	malicious	Unknown	Browse
67.228.121.193	5kplayer-setup.exe	Get hash	malicious	Unknown	Browse	dl1.5kplayer.com/download/5kplayer-64bit.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dl1.5kplayer.com	5kplayer-setup.exe	Get hash	malicious	Unknown	Browse	67.228.121.193
www.5kplayer.com	5kplayer-setup.exe	Get hash	malicious	Unknown	Browse	67.228.121.196

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SOFTLAYERUS	ZOHH8muwjh.elf	Get hash	malicious	Mirai	Browse	150.239.41.80
	enEQvjUlGl.elf	Get hash	malicious	Mirai	Browse	74.55.103.75
	Vedtb2CYvY.elf	Get hash	malicious	Mirai	Browse	75.125.154.146
	siGMVX2KKD.elf	Get hash	malicious	Mirai	Browse	52.116.198.173
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	169.46.231.220
	iZYqP2K1UC.elf	Get hash	malicious	Mirai	Browse	119.81.48.243
	xexngqLbiY.elf	Get hash	malicious	Gafgyt, Mirai	Browse	149.81.137.145
	hiqWVuoNwf.elf	Get hash	malicious	Mirai	Browse	169.38.203.55
	GFw6joeIJl.elf	Get hash	malicious	Mirai	Browse	159.8.169.210
	XFJxqIEFFQ.elf	Get hash	malicious	Mirai	Browse	161.156.204.101
SOFTLAYERUS	ZOHH8muwjh.elf	Get hash	malicious	Mirai	Browse	150.239.41.80
	enEQvjUlGl.elf	Get hash	malicious	Mirai	Browse	74.55.103.75
	Vedtb2CYvY.elf	Get hash	malicious	Mirai	Browse	75.125.154.146
	siGMVX2KKD.elf	Get hash	malicious	Mirai	Browse	52.116.198.173
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	169.46.231.220
	iZYqP2K1UC.elf	Get hash	malicious	Mirai	Browse	119.81.48.243
	xexngqLbiY.elf	Get hash	malicious	Gafgyt, Mirai	Browse	149.81.137.145
	hiqWVuoNwf.elf	Get hash	malicious	Mirai	Browse	169.38.203.55
	GFw6joeIJl.elf	Get hash	malicious	Mirai	Browse	159.8.169.210
	XFJxqIEFFQ.elf	Get hash	malicious	Mirai	Browse	161.156.204.101

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
26d6a4eb718d3312039bfcd7e5fe611b	5kplayer-setup.exe	Get hash	malicious	Unknown	Browse	67.228.121.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\nsis7zU.dll	https://www.imobie.com/go/download.php?product=ati	Get hash	malicious	Unknown	Browse
	5kplayer-setup.exe	Get hash	malicious	Unknown	Browse
	NX-19-RGB.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5kp.exe_62a77edd96bbf36f4741e2a9b852effc9e803e_f76daea9_f1600ac1-62a3-4192-80c6-43550a3d8940\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.16369423696766
Encrypted:	false
SSDEEP:	192:9tssh/q0cKhCjICBpmCCK7lzuiFxZ24IO8x:Hssh/xcKhCjI+RzuiFxY4IO8x
MD5:	16ED8FBCF2E1CDD25F5FA5D331FB8FF7
SHA1:	D719429B9C3C35C6A14E71A48BD8501A9CFC41B4
SHA-256:	DCCC4434F888C9C66A49095BAE43185DCEAF13C1A2DECFBDFE97B6AD5C7BC3EE
SHA-512:	115479622CDE3836D4214819677F3E6B47DE3B95285E6E9FB6766330C91EF917EDB69024C9591D0937BB17B1258EA599FE9A65726742C690E9D1963910147327
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.9.7.9.8.7.7.4.4.5.4.1.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.9.7.9.8.8.7.2.0.6.4.0.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.1.6.0.0.a.c.1.-.6.2.a.3.-.4.1.9.2.-.8.0.c.6.-.4.3.5.5.0.a.3.d.8.9.4.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.e.1.c.d.a.4.6.-.3.c.c.1.-.4.6.8.c.-.a.1.e.a.-.6.2.f.b.2.2.b.3.9.e.a.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.5.k.p...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.5.k.p.l.a.y.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.3.c.-.0.0.0.1.-.0.0.1.4.-.8.1.c.b.-.d.e.7.5.1.e.9.2.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.3.1.9.c.b.8.3.8.f.0.d.a.b.a.6.1.3.2.3.5.5.1.f.c.4.3.c.c.b.c.f.0.0.0.0.0.9.0.4.!.0.0.0.0.a.b.3.e.c.2.9.6.5.f.4.d.5.7.6.1.f.b.a.0.a.c.d.e.7.8.f.d.7.2.a.c.2.8.9.3.5.4.c.6.!.5.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER238.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Apr 19 05:58:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	5079782
Entropy (8bit):	2.888124722332594
Encrypted:	false
SSDEEP:	24576:+8YFEh0vGBhDkkUwfGmI3ldy13/dsAT4ViMoSQZWJlHsOma9RZ:XGAfxOz
MD5:	33040753581D69D657184EF6425A3230
SHA1:	ACF8499AB7335C2208FA3FE7216452159AD444E9
SHA-256:	0FCF0776EF237F7539FDF3EE46D16ABF52AFBDD4AC0B3695A6322AFD5FCAEF82
SHA-512:	724CDBB4702D40BBB8284408B040A341E972039964BF6D92A51B9186010F45F9F759282245771576A2380F3478D04E654B5FF76452C7523B40ECD0D635A38125
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........."f............D)...........#..X0......<...`S......4...............`.......8...........T...........P.....L..........S...........U..............................................................................eJ...... V......GenuineIntel............T.......<....."f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2784.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8284
Entropy (8bit):	3.695322202554871
Encrypted:	false
SSDEEP:	192:R6l7wVeJLG6z6YFM6RgmfWfpD189bpbfsf2Djm:R6lXJa6z6Y+6RgmfWopbEfC6
MD5:	83DBEEDD29757AA8C4A73E9251D3311D
SHA1:	8B9E3DA2EF010FB274DAEDD97B42D4CFB950E4DA
SHA-256:	F49266E106B89AF7835A5C9C933226DB892BC63688D5E7119D477E421F1CF589
SHA-512:	E13A1A03E90927325B28E2CFC4CF90AF4B53E6D257BF29922EBAE579D691D4E0CA3FA86657A67AD342692B6C8A51163AE349012BEA3F12DBADADD4D8D551300C
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER27B4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4599
Entropy (8bit):	4.439332938917051
Encrypted:	false
SSDEEP:	48:cvIwWl8zsbJg77aI9WpnWpW8VY+Ym8M4Jcy7aFr0k+q8/akjbuW2lqHYrd:uIjf1I7E47VuJcmssaOuW2lq4rd
MD5:	2C206494B510637C9C56C6CD7E93ED3F
SHA1:	5C4DCBB5966FBC819373A19276B3606B2EB7C470
SHA-256:	1B0C6E585D81FE7EEAE5A886BCA5027301673E11D0990017BBD19FD8F89330B9
SHA-512:	2BDC6D0FB27D74D12E9021C2A6AFB76BADB8D8C870C09D09B941A0CC301B8549BF3B1517EAD1259518D8C4F0CDC659A75F18681E26FFA26AF6493E6E3F61F383
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="286380" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\5kplayer\5kp.7z

Download File

Process:	C:\Users\user\Desktop\5kplayer-setup.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	6642423
Entropy (8bit):	7.999970186659846
Encrypted:	true
SSDEEP:	196608:YS7xbdSAGLoAu6pKph80WK0oASRL7/zwVGNOufRLsl:ZVcAGLoAuPpoK9AeL7rBjRLsl
MD5:	C37A6740BD8E7C1AB2010BD60697A95D
SHA1:	D27729DF46E2D6106F3C4F62B05A7EA19923B24C
SHA-256:	356DF231CC379D53CE7998E9AF9AAD8E7E725F366F7D893EE759C637855248D4
SHA-512:	E289B6A4922E0C3A266733B7EA508313256432EA52225FF2ACB94C68B52B7332003E6E709070D79A26891B02214BF7D101C4368FE6D5B8FD9C186E39A149D901
Malicious:	false
Reputation:	low
Preview:	7z..'.... ..=Ze.............t.g>.&..p.........../D.\|....D.).S......a.....z.k..T..&.q..G+.."E.A..Y.r...o:l^.T..'..\..Q..e.9w...2....a.9....)1L..S..}^.S\|C.....Q.>......ve%.%...]W..mO}.X.0Rz.M.........Ta..n....y..Kk..L.-$......+........$....Ay.Y.....Q....Q...[oMu.M.....ZS..+pY......R..(...W..Z..%........=oeP...A..q<X.0.B.F.)........I......K=.).v.{&g..&..PS....r.(.....z.....]\|e%_...H.wz.``.....!..EI.....[..<o.A\...>..-1+..y.x.....wQF...h..."....X. .. ....p.[......zn..U.}q{..a.t.j.X@..t.)0.'.l.u..o.U.,u....T..KJ......%...*.k..........6.qS....5./R...i....j,..2..$.d... .4.....Q6......"?.....&6...@.k.hzb....o.,..B6.Q.OX.}..^.i.i.=z16p......b...L.gVKwI(..g_.`c.6..v.NK......lb.ep..........;LH.....q\RA.....u.=.%Dyl.e.J6...J......>.o.}..o.egN.OS..)..0......r'wr....w........y.s9L.\..".....}$....2..p..o...tr"E.Svxb....r.u...g.u...........8<.1.9.`...d....m....I.B$@....{y.d.l.8.p......&/..Q.......Y\|.x.rv...'...9(.0..A...]..$J..b.0.D.z...7..J

C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Download File

Process:	C:\Users\user\Desktop\5kplayer-setup.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	21981840
Entropy (8bit):	6.563657127759979
Encrypted:	false
SSDEEP:	393216:PjIl2ax/Cc+fbdmjwzveH/WylLJsv6tWKFdu9CJCSC:7c4bFkjY
MD5:	3E71A7C07BB5BD316F64768D21971CFC
SHA1:	AB3EC2965F4D5761FBA0ACDE78FD72AC289354C6
SHA-256:	E00F8BB3EAAFF144C30CEAC509CA4D5267D73A5BAF6D0FE45B3BF8CC58CE3178
SHA-512:	B58ADFD7F5EE981637026A65EA7C21D964E8589AD76D4B6C80F2D00D2EFE477D609852F597FDED713D50F0253B5EB7D5BA34642A8FC5C1B090760248A0E1A117
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e.....................FO...................@...........................P.....{.P....... .............................. J.\|B....J..)...........JO.. ....................................J......................J.h............................text...............................`.P`.data...p...........................@.`..rdata..`.D.......D.................@.p@.qtmetad......!......r!.............@.`@.eh_fram$T'...!..V'...!.............@.0@.bss..........I.......................p..idata..\|B... J..D....H.............@.0..CRT....8....pJ.......I.............@.0..tls.... .....J.......I.............@.0..rsrc....)....J..... I.............@.0.................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\nsis7zU.dll

Download File

Process:	C:\Users\user\Desktop\5kplayer-setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	321024
Entropy (8bit):	6.401347031241621
Encrypted:	false
SSDEEP:	6144:rA9ssOlBrbYr5UP4m3mC/FvBbhQ1JzI+yQKiJGxdNtsm0:r2S165UP4mL/FvBtC8zQdSDmm0
MD5:	06A47571AC922F82C098622B2F5F6F63
SHA1:	8A581C33B7F2029C41EDAAD55D024FC0D2D7C427
SHA-256:	E4AB3064F2E094910AE80104EF9D371CCB74EBBEEED592582CF099ACD83F5FE9
SHA-512:	04B3D18042F1FAA536E1393179F412A5644D2CF691FBC14970F79DF5C0594EEEDB0826B495807A3243F27AAA0380423C1F975FE857F32E057309BB3F2A529A83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: 5kplayer-setup.exe, Detection: malicious, Browse Filename: NX-19-RGB.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h..\|;..\|;..\|;/:.;..\|;/:.;..\|;/:.;..\|;"..;..\|;..};..\|;"..;..\|;...;..\|;...;..\|;...;..\|;...;..\|;...;..\|;Rich..\|;........PE..L...b..V...........!.....j...................................................`............@..........................g......$^..P................................9......................................@............................................text...Ri.......j.................. ..`.rdata..p............n..............@..@.data....{...p...2...X..............@....rsrc...............................@..@.reloc...W.......X..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Digiarty\unique.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.1556390622295662
Encrypted:	false
SSDEEP:	3:aixV:a+V
MD5:	3A88B300C647EAC6307DB1FC994A7471
SHA1:	F72C1E0172E2B57C5180D4FC5BB19E3F3133BBB6
SHA-256:	3B265DC980F40468C9377BF617F885B1E12FEBB1C23689528C59A1F53CF0B73F
SHA-512:	F3CB951488744908A4EFDD629E712A395280F163D17A4C5A62E841C4B953FD2DEBCF2D83F1137222E62AD85133EA0981963536ED9D5EF3DC47021729E5C8A5B0
Malicious:	false
Reputation:	low
Preview:	b05ce96439b86b60

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465677038748547
Encrypted:	false
SSDEEP:	6144:OIXfpi67eLPU9skLmb0b4wWSPKaJG8nAgejZMMhA2gX4WABl0uNTdwBCswSbb:DXD94wWlLZMM6YFHV+b
MD5:	3A49C76B8FC3213FB78D38A399D4A102
SHA1:	2265514AA6BA5B0E51BF28AE49C7C133CBE9FF86
SHA-256:	3CFC6C88D24B759AD03783C8870A3BB0005531FFCFD387C5AC87AE828911365D
SHA-512:	62CCD97EE20FDF7CF486767FB8F1726DC95CD2630F48D8F88AAB261FCC4BC31AA7200D036099ECA12F2E020BECD60E976CB195F284A8E053CA69D579BEB3EDEC
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmz..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.994216722262718
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5kplayer-setup.exe
File size:	7'270'888 bytes
MD5:	0cb8a509b925197bd4b94b4c835c8db9
SHA1:	b741c00855307aa3a8a3c52c651c2c8d969a4f78
SHA256:	02b4b6cd3a3a78cc764cb0ad573a9bce3ab0f1681d5e6926c9501e0ebcd7bbbb
SHA512:	7901dd30c8b4169db731006e4e8c33aeada24ae3908999755ee45601e3824a8e845d5bea00c37207373615f6bf1c8acf1cde0d579edaefbacad01d323d227b2b
SSDEEP:	196608:aVsR6S7xbdSAGLoAu6pKph80WK0oASRL7/zwVGNOufRLsDz:jVcAGLoAuPpoK9AeL7rBjRLsX
TLSH:	6D7633136FB78E3CD39225F0CB477E38A9B5DB60A06AC683135299EF6D333895934524
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...z...B...8.....

File Icon


Icon Hash:	71d6aa317032564d

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	19/05/2021 01:00:00 23/05/2024 00:59:59
Subject Chain	CN="Digiarty Software, Inc.", O="Digiarty Software, Inc.", L=Chengdu, S=Sichuan, C=CN
Version:	3
Thumbprint MD5:	E52449B6FB0D71581A2377613347EF76
Thumbprint SHA-1:	E122C1337C0DCAE9D48B776CCFD12A70C33F9CE8
Thumbprint SHA-256:	7E00A55AC7216D474B66FE6DBE66A7014631BA5693B10E5A829EA3CE59A77DAC
Serial:	01F30A8BB86816538B43BF89D74D9F48

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007FE9A1668D0Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007FE9A16689EDh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007FE9A16689DBh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007FE9A16662DAh
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007FE9A16686B1h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FE9A1666363h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FE9A16662DAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x62a30	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x6ed158	0x2090
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x62a30	0x62c00	d773160704a138822d8999da378bbf7f	False	0.826053204113924	data	7.5601313915570545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x163000	0xfd6	0x1000	a9d283bb30600743cf491f95d083e061	False	1.002685546875	data	7.92677442477738	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1003e8	0x1bb7f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0003611221209319
RT_ICON	0x11bf68	0x16444	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9998574623920004
RT_ICON	0x1323b0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.5893765527031823
RT_ICON	0x142bd8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.6659922219886483
RT_ICON	0x14c080	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.6628947368421053
RT_ICON	0x152868	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.6903881700554528
RT_ICON	0x157cf0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.6789088332546056
RT_ICON	0x15bf18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.7429460580912863
RT_ICON	0x15e4c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7680581613508443
RT_ICON	0x15f568	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.7630597014925373
RT_ICON	0x160410	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.8331967213114754
RT_ICON	0x160d98	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.865072202166065
RT_ICON	0x161640	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.8911290322580645
RT_ICON	0x161d08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.7463872832369942
RT_ICON	0x162270	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8351063829787234
RT_DIALOG	0x1626d8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x1627d8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x1628f8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x162958	0xd8	Targa image data - Map 8 x 25668 x 1 +1	English	United States	0.6620370370370371

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 07:57:30.875927925 CEST	49733	443	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:30.876023054 CEST	443	49733	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:30.876138926 CEST	49733	443	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:30.889292002 CEST	49733	443	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:30.889324903 CEST	443	49733	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:30.990550995 CEST	49734	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:31.111515999 CEST	49737	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:31.113192081 CEST	80	49734	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:31.113327980 CEST	49734	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:31.160948992 CEST	443	49733	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:31.161062956 CEST	49733	443	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:31.221826077 CEST	49733	443	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:31.221875906 CEST	443	49733	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:31.222306013 CEST	443	49733	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:31.223274946 CEST	49733	443	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:31.234343052 CEST	80	49737	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:31.234457016 CEST	49737	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:31.268114090 CEST	443	49733	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:31.774032116 CEST	443	49733	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:31.774172068 CEST	443	49733	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:31.774260044 CEST	49733	443	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:31.787297964 CEST	49733	443	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:31.787345886 CEST	443	49733	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.200773001 CEST	49739	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.336234093 CEST	80	49739	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.336339951 CEST	49739	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.336973906 CEST	49739	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.345174074 CEST	49740	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.436446905 CEST	49741	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.448250055 CEST	49742	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.467700005 CEST	80	49740	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:34.467778921 CEST	49740	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.472225904 CEST	80	49739	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.472371101 CEST	49739	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.546792030 CEST	49743	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.570480108 CEST	80	49741	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.570575953 CEST	49741	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.570816040 CEST	49741	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.576210976 CEST	49744	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.585588932 CEST	80	49742	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:34.585694075 CEST	49742	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.659955978 CEST	49745	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.669363976 CEST	80	49743	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.669471979 CEST	49743	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.669676065 CEST	49743	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.673952103 CEST	49746	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.688800097 CEST	49747	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.699004889 CEST	80	49744	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:34.699132919 CEST	49744	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.704900980 CEST	80	49741	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.704963923 CEST	49741	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.768858910 CEST	49748	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.782810926 CEST	80	49745	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.782939911 CEST	49745	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.783682108 CEST	49749	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.784286976 CEST	49745	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.789491892 CEST	49750	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.792253017 CEST	80	49743	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.792342901 CEST	80	49743	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.792494059 CEST	49743	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.807979107 CEST	80	49746	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:34.808048964 CEST	49746	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.811388969 CEST	80	49747	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:34.811492920 CEST	49747	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.882934093 CEST	49751	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.891695976 CEST	80	49748	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.891835928 CEST	49748	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.892009974 CEST	49748	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.894085884 CEST	49752	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.897355080 CEST	49753	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.906251907 CEST	80	49749	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:34.906338930 CEST	49749	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.907104969 CEST	80	49745	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:34.907380104 CEST	49745	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.912266970 CEST	80	49750	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:34.912365913 CEST	49750	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:34.988198042 CEST	49754	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:34.997375011 CEST	49755	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.014842033 CEST	80	49748	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.014921904 CEST	49748	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.020467997 CEST	80	49751	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.020598888 CEST	49751	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.020806074 CEST	49751	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.023904085 CEST	49756	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.031974077 CEST	80	49752	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.032067060 CEST	49752	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.032474041 CEST	80	49753	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.032550097 CEST	49753	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.101041079 CEST	49757	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.110985994 CEST	80	49754	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.111253023 CEST	49754	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.111337900 CEST	49754	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.115339041 CEST	49758	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.120165110 CEST	80	49755	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.123788118 CEST	49755	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.135070086 CEST	49759	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.158349991 CEST	80	49751	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.158385038 CEST	80	49751	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.158478022 CEST	49751	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.160501957 CEST	80	49756	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.163748026 CEST	49756	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.203360081 CEST	49760	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.215647936 CEST	49761	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.223488092 CEST	80	49757	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.223622084 CEST	49757	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.223887920 CEST	49757	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.228122950 CEST	49762	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.233875990 CEST	80	49754	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.233947039 CEST	49754	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.252629995 CEST	80	49758	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.252696991 CEST	49758	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.268881083 CEST	80	49759	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.268965006 CEST	49759	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.313906908 CEST	49763	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.326176882 CEST	80	49760	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.326868057 CEST	49760	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.327136040 CEST	49760	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.338229895 CEST	80	49761	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.338340044 CEST	49761	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.343288898 CEST	49765	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.346352100 CEST	49766	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.346378088 CEST	80	49757	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.346451998 CEST	49757	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.351061106 CEST	80	49762	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.351496935 CEST	49762	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.427886009 CEST	49767	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.436419964 CEST	80	49763	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.438479900 CEST	49763	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.439063072 CEST	49763	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.442996025 CEST	49768	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.449815035 CEST	80	49760	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.450246096 CEST	49760	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.455517054 CEST	49769	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.468925953 CEST	80	49766	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.469027042 CEST	49766	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.478312969 CEST	80	49765	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.478411913 CEST	49765	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.533557892 CEST	49770	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.552594900 CEST	49771	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.561611891 CEST	80	49763	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.561707020 CEST	49763	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.563054085 CEST	80	49767	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.563153028 CEST	49767	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.563275099 CEST	49767	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.565428019 CEST	80	49768	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.565530062 CEST	49768	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.567553997 CEST	49772	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.578506947 CEST	80	49769	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.578722000 CEST	49769	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.668730021 CEST	80	49770	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.668823957 CEST	49770	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.668984890 CEST	49770	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.673507929 CEST	49773	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.673923016 CEST	49774	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.686703920 CEST	80	49771	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.686909914 CEST	49771	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.687772989 CEST	49775	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.698774099 CEST	80	49767	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.698930025 CEST	49767	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.701513052 CEST	80	49772	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.701562881 CEST	49772	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.761399031 CEST	49776	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.794007063 CEST	49777	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.804179907 CEST	80	49770	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.804240942 CEST	49770	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.807704926 CEST	80	49774	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.808475018 CEST	80	49773	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.808577061 CEST	49774	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.809731960 CEST	49773	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.810241938 CEST	80	49775	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.810394049 CEST	49775	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.821310997 CEST	49774	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.883927107 CEST	80	49776	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.884524107 CEST	49776	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.886600971 CEST	49776	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.903810024 CEST	49778	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.916507959 CEST	80	49777	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:35.916639090 CEST	49777	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:35.943273067 CEST	49779	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.955388069 CEST	80	49774	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:35.968224049 CEST	49774	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:35.992789030 CEST	49780	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.009398937 CEST	80	49776	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.009485960 CEST	49776	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.021795988 CEST	49781	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.037754059 CEST	80	49778	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.037827969 CEST	49778	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.039973021 CEST	49783	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.065994978 CEST	80	49779	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.066102028 CEST	49779	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.066910982 CEST	49779	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.093823910 CEST	49784	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.096682072 CEST	49785	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.100579023 CEST	49786	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.115777016 CEST	80	49780	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.115833998 CEST	49780	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.156321049 CEST	80	49781	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.156555891 CEST	49781	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.162552118 CEST	80	49783	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.162657976 CEST	49783	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.189533949 CEST	80	49779	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.189632893 CEST	49779	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.216423988 CEST	80	49784	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.216775894 CEST	49784	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.222395897 CEST	49783	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.230880976 CEST	80	49785	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.231015921 CEST	49785	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.235785961 CEST	80	49786	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.235886097 CEST	49786	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.248128891 CEST	49785	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.248477936 CEST	49784	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.251030922 CEST	49786	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.293812037 CEST	49787	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.301368952 CEST	49788	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.319681883 CEST	49789	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.332200050 CEST	49790	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.345144033 CEST	80	49783	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.345211029 CEST	49783	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.371047974 CEST	80	49784	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.371608973 CEST	80	49784	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.382008076 CEST	80	49785	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.382545948 CEST	80	49785	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.386291027 CEST	80	49786	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.386324883 CEST	80	49786	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.386392117 CEST	49786	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.411254883 CEST	49791	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.413130999 CEST	49792	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.426124096 CEST	49785	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.426129103 CEST	49784	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.428272009 CEST	49793	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.429805040 CEST	80	49787	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.429982901 CEST	49787	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.430133104 CEST	49787	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.435195923 CEST	80	49788	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.435257912 CEST	49788	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.437052011 CEST	49794	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.454850912 CEST	80	49790	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.455030918 CEST	49790	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.455168962 CEST	49790	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.456969023 CEST	80	49789	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.457031965 CEST	49789	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.465892076 CEST	49795	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.529086113 CEST	49796	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.535634041 CEST	80	49792	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.535723925 CEST	49792	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.535907984 CEST	49792	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.541134119 CEST	49797	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.541933060 CEST	49798	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.545129061 CEST	80	49791	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.545258045 CEST	49791	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.550714016 CEST	80	49793	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.550796986 CEST	49793	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.559564114 CEST	80	49794	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.559627056 CEST	49794	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.566236019 CEST	80	49787	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.566296101 CEST	49787	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.577882051 CEST	80	49790	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.577945948 CEST	49790	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.588561058 CEST	49799	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.601010084 CEST	80	49795	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.601080894 CEST	49795	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.628954887 CEST	49800	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.651938915 CEST	80	49796	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.652120113 CEST	49796	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.652388096 CEST	49801	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.652544022 CEST	49796	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.657761097 CEST	49802	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.658524990 CEST	80	49792	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.658590078 CEST	49792	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.675951004 CEST	80	49798	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.676204920 CEST	49798	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.676351070 CEST	80	49797	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.676413059 CEST	49797	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.725931883 CEST	80	49799	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.726025105 CEST	49799	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.734061003 CEST	49803	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.763266087 CEST	49804	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.764353037 CEST	80	49800	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.764561892 CEST	49800	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.764643908 CEST	49800	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.768487930 CEST	49805	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.775526047 CEST	80	49796	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.775593996 CEST	49796	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.780411005 CEST	80	49802	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.780714035 CEST	49802	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.786446095 CEST	80	49801	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.786514044 CEST	49801	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.856715918 CEST	80	49803	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.856810093 CEST	49803	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.857026100 CEST	49803	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.861721039 CEST	49806	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.869332075 CEST	49807	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.870717049 CEST	49808	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.891215086 CEST	80	49805	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.891298056 CEST	49805	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.898418903 CEST	80	49804	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:36.898499012 CEST	49804	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.899885893 CEST	80	49800	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.899950981 CEST	49800	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.975886106 CEST	49809	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.979852915 CEST	80	49803	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.979903936 CEST	49803	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.982321978 CEST	49810	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:36.999393940 CEST	80	49806	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:36.999505997 CEST	49806	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:36.999742985 CEST	49806	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.003381968 CEST	80	49807	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.003453016 CEST	49807	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.003951073 CEST	49811	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.005824089 CEST	80	49808	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.005918980 CEST	49808	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.080460072 CEST	49812	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.098877907 CEST	80	49809	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.099020004 CEST	49809	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.099122047 CEST	49809	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.102140903 CEST	49813	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.108820915 CEST	49814	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.117877007 CEST	80	49810	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.117955923 CEST	49810	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.137489080 CEST	80	49806	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.137546062 CEST	49806	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.139921904 CEST	80	49811	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.139993906 CEST	49811	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.207806110 CEST	49815	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.208066940 CEST	49816	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.214286089 CEST	80	49812	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.214570999 CEST	49812	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.214732885 CEST	49812	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.218343019 CEST	49817	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.222165108 CEST	80	49809	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.222240925 CEST	49809	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.231324911 CEST	80	49814	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.231396914 CEST	49814	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.237550020 CEST	80	49813	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.237596035 CEST	49813	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.302650928 CEST	49818	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.333101034 CEST	49819	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.341834068 CEST	80	49815	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.341933012 CEST	49815	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.343111992 CEST	80	49816	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.343189001 CEST	49816	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.348714113 CEST	80	49812	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.348779917 CEST	49812	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.353399992 CEST	80	49817	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.353471994 CEST	49817	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.354188919 CEST	49816	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.357182026 CEST	49820	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.415112972 CEST	49821	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.436531067 CEST	80	49818	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.436606884 CEST	49818	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.436778069 CEST	49818	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.440236092 CEST	49822	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.468146086 CEST	80	49819	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.468219042 CEST	49819	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.478048086 CEST	49823	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.479650974 CEST	80	49820	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.479708910 CEST	49820	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.489489079 CEST	80	49816	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.489559889 CEST	49816	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.527882099 CEST	49824	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.548975945 CEST	80	49821	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.549067020 CEST	49821	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.549283981 CEST	49821	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.551182985 CEST	49825	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.554610014 CEST	49826	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.570713997 CEST	80	49818	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.570795059 CEST	49818	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.574325085 CEST	80	49822	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.574554920 CEST	49822	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.600564003 CEST	80	49823	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.600629091 CEST	49823	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.600960016 CEST	49823	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.622700930 CEST	49827	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.650590897 CEST	80	49824	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.650671959 CEST	49824	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.650831938 CEST	49824	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.653434038 CEST	49828	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.663860083 CEST	49829	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.673928022 CEST	80	49825	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.674254894 CEST	49825	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.677124977 CEST	80	49826	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.677206993 CEST	49826	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.683173895 CEST	80	49821	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.683254004 CEST	49821	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.723242044 CEST	80	49823	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.723768950 CEST	80	49823	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.733828068 CEST	49830	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.757819891 CEST	80	49827	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.757911921 CEST	49827	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.758064985 CEST	49827	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.760711908 CEST	49831	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.762258053 CEST	49832	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.773463011 CEST	80	49824	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.773766041 CEST	49824	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.779216051 CEST	49823	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.791169882 CEST	80	49828	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.791238070 CEST	49828	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.797983885 CEST	80	49829	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.798046112 CEST	49829	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.844489098 CEST	49833	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.871361017 CEST	80	49830	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.871464968 CEST	49830	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.871659040 CEST	49830	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.878246069 CEST	49834	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.883182049 CEST	80	49831	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.883866072 CEST	49831	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.884663105 CEST	80	49832	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:37.884910107 CEST	49832	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.893186092 CEST	80	49827	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.893265963 CEST	49827	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.895423889 CEST	49835	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:37.967082977 CEST	80	49833	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:37.971787930 CEST	49833	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.972554922 CEST	49833	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.976370096 CEST	49836	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:37.980305910 CEST	49837	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.001096010 CEST	80	49834	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.001187086 CEST	49834	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.003644943 CEST	49838	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.009205103 CEST	80	49830	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.009280920 CEST	49830	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.017930031 CEST	80	49835	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.017980099 CEST	49835	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.069251060 CEST	49839	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.095247984 CEST	80	49833	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.095499992 CEST	49833	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.096910954 CEST	49840	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.098968983 CEST	80	49836	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.099050999 CEST	49836	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.099432945 CEST	49836	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.103935957 CEST	49841	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.117697954 CEST	80	49837	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.117793083 CEST	49837	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.126142979 CEST	80	49838	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.126205921 CEST	49838	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.179666042 CEST	49842	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.191919088 CEST	80	49839	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.192090988 CEST	49839	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.204169989 CEST	49839	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.219559908 CEST	80	49840	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.220196009 CEST	49840	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.222062111 CEST	80	49836	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.223882914 CEST	49836	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.226306915 CEST	80	49841	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.226367950 CEST	49841	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.227551937 CEST	49843	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.239835978 CEST	49844	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.291662931 CEST	49845	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.317040920 CEST	80	49842	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.317332983 CEST	49842	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.319169044 CEST	49842	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.324070930 CEST	49846	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.326843023 CEST	80	49839	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.326910019 CEST	49839	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.350209951 CEST	80	49843	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.350442886 CEST	49843	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.350786924 CEST	49847	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.379839897 CEST	80	49844	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.379930973 CEST	49844	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.404818058 CEST	49848	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.429831982 CEST	80	49845	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.430083990 CEST	49845	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.430633068 CEST	49845	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.456712008 CEST	80	49842	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.456775904 CEST	49842	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.461364985 CEST	80	49846	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.461503029 CEST	49846	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.465127945 CEST	49849	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.473587036 CEST	80	49847	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.473660946 CEST	49847	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.492750883 CEST	49850	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.512044907 CEST	49851	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.527327061 CEST	80	49848	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.527410030 CEST	49848	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.527523041 CEST	49848	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.565869093 CEST	80	49845	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.565942049 CEST	49845	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.567320108 CEST	49852	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.601243019 CEST	80	49849	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.601324081 CEST	49849	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.605021000 CEST	49853	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.606870890 CEST	49854	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.615130901 CEST	80	49850	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.615312099 CEST	49850	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.649276018 CEST	80	49851	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.649346113 CEST	49851	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.649537086 CEST	49851	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.650223017 CEST	80	49848	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.650293112 CEST	49848	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.653294086 CEST	49855	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.668298006 CEST	49856	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.701411963 CEST	80	49852	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.701486111 CEST	49852	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.718713045 CEST	49857	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.740670919 CEST	80	49854	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.740752935 CEST	49854	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.740984917 CEST	49854	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.742373943 CEST	80	49853	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.742472887 CEST	49853	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.744257927 CEST	49858	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.762787104 CEST	49859	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.775742054 CEST	80	49855	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.775824070 CEST	49855	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.786879063 CEST	80	49851	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.786946058 CEST	49851	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.790999889 CEST	80	49856	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.791202068 CEST	49856	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.832206011 CEST	49860	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.841372013 CEST	80	49857	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.841613054 CEST	49857	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.841700077 CEST	49857	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.846327066 CEST	49861	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.860342026 CEST	49862	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.874953985 CEST	80	49854	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.875061035 CEST	49854	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.881779909 CEST	80	49858	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.883877039 CEST	49858	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.896791935 CEST	80	49859	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.896874905 CEST	49859	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.941215992 CEST	49863	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.954905987 CEST	80	49860	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.964349985 CEST	80	49857	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.964390993 CEST	80	49857	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:38.973664045 CEST	49857	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.973794937 CEST	49860	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.975754023 CEST	49860	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:38.976979017 CEST	49864	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.981399059 CEST	49865	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.981524944 CEST	80	49861	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.981595993 CEST	49861	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:38.982860088 CEST	80	49862	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:38.982955933 CEST	49862	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.060040951 CEST	49866	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.076317072 CEST	80	49863	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.076472044 CEST	49863	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.076611042 CEST	49863	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.081815004 CEST	49867	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.098603964 CEST	80	49860	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.098687887 CEST	49860	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.099546909 CEST	80	49864	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.099841118 CEST	49864	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.099848986 CEST	49868	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.103960991 CEST	80	49865	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.104125023 CEST	49865	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.153187990 CEST	49869	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.182779074 CEST	80	49866	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.182881117 CEST	49866	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.183024883 CEST	49866	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.184611082 CEST	49870	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.188349009 CEST	49871	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.204675913 CEST	80	49867	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.204732895 CEST	49867	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.211956024 CEST	80	49863	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.212018013 CEST	49863	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.222467899 CEST	80	49868	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.225860119 CEST	49868	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.275966883 CEST	80	49869	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.276120901 CEST	49869	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.276634932 CEST	49869	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.279100895 CEST	49872	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.284442902 CEST	49873	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.307188034 CEST	49874	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.317429066 CEST	80	49866	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.317468882 CEST	80	49866	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.317534924 CEST	49866	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.334074020 CEST	80	49871	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.334139109 CEST	49871	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.372494936 CEST	49875	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.386409044 CEST	49876	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.407804012 CEST	80	49873	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.407879114 CEST	49873	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.407932997 CEST	80	49869	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.408014059 CEST	49869	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.423140049 CEST	80	49872	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.423234940 CEST	49872	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.429692984 CEST	80	49874	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.429766893 CEST	49874	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.434175968 CEST	49872	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.437908888 CEST	49877	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.484301090 CEST	49878	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.495186090 CEST	80	49875	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.495299101 CEST	49875	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.495515108 CEST	49875	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.503889084 CEST	49879	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.524337053 CEST	80	49876	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.524476051 CEST	49876	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.546892881 CEST	49880	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.560436964 CEST	80	49877	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.562063932 CEST	49877	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.572196007 CEST	80	49872	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.572277069 CEST	49872	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.601052046 CEST	49881	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.610964060 CEST	49882	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.618179083 CEST	80	49875	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.618262053 CEST	49875	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.621531963 CEST	80	49878	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.621615887 CEST	49878	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.621805906 CEST	49878	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.626580954 CEST	80	49879	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.626631021 CEST	49879	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.629415989 CEST	49883	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.669501066 CEST	80	49880	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.669599056 CEST	49880	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.706743002 CEST	49884	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.723622084 CEST	80	49881	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.723701954 CEST	49881	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.723855019 CEST	49881	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.731723070 CEST	49885	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.733513117 CEST	49886	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.733551025 CEST	80	49882	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.733828068 CEST	49882	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.759202003 CEST	80	49878	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.759278059 CEST	49878	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.766994953 CEST	80	49883	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.767199993 CEST	49883	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.820982933 CEST	49887	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.842017889 CEST	80	49884	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.842117071 CEST	49884	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.846463919 CEST	80	49881	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.846518040 CEST	80	49881	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.846590996 CEST	49881	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.848170042 CEST	49888	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.848400116 CEST	49884	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.851408958 CEST	49889	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.854342937 CEST	80	49885	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.854475021 CEST	49885	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.867321014 CEST	80	49886	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.867391109 CEST	49886	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.930228949 CEST	49890	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.949134111 CEST	49891	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.958502054 CEST	80	49887	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.965655088 CEST	49887	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.966950893 CEST	49887	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.970679998 CEST	80	49888	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.970774889 CEST	49888	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.972430944 CEST	49892	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:39.983747005 CEST	80	49884	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:39.983925104 CEST	49884	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:39.986480951 CEST	80	49889	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:39.986560106 CEST	49889	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.031049967 CEST	49893	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.064341068 CEST	80	49890	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.064430952 CEST	49890	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.064594984 CEST	49890	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.070724964 CEST	49894	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.071891069 CEST	80	49891	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.071981907 CEST	49891	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.076879978 CEST	49895	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.095104933 CEST	80	49892	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.095177889 CEST	49892	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.104336977 CEST	80	49887	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.104399920 CEST	80	49887	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.104621887 CEST	49887	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.143187046 CEST	49896	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.168569088 CEST	80	49893	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.168656111 CEST	49893	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.168821096 CEST	49893	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.171222925 CEST	49897	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.175209045 CEST	49898	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.188149929 CEST	49870	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.193063974 CEST	80	49894	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.193383932 CEST	49894	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.198616982 CEST	80	49890	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.198677063 CEST	49890	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.211894035 CEST	80	49895	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.211998940 CEST	49895	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.253844976 CEST	49899	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.282248974 CEST	80	49896	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.282366991 CEST	49896	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.282520056 CEST	49896	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.284641981 CEST	49900	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.290903091 CEST	49901	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.322285891 CEST	80	49870	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.322376966 CEST	49870	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.356477022 CEST	49902	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.376413107 CEST	80	49899	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.376509905 CEST	49899	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.376661062 CEST	49899	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.380081892 CEST	49903	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.386564016 CEST	49904	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.408842087 CEST	80	49900	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.408914089 CEST	49900	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.413304090 CEST	80	49901	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.413372040 CEST	49901	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.421760082 CEST	80	49896	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.421855927 CEST	49896	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.476666927 CEST	49905	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.479146004 CEST	80	49902	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.479229927 CEST	49902	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.479379892 CEST	49902	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.480876923 CEST	49906	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.482656002 CEST	49907	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.499346018 CEST	80	49899	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.499403954 CEST	80	49899	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.499712944 CEST	49899	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.515165091 CEST	80	49903	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.515233994 CEST	49903	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.520442963 CEST	80	49904	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.520517111 CEST	49904	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.583528996 CEST	49908	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.585133076 CEST	49893	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.599138975 CEST	80	49905	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.602066994 CEST	80	49902	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.602168083 CEST	49902	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.602197886 CEST	49905	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.616040945 CEST	80	49906	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.616127968 CEST	49906	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.616662979 CEST	80	49907	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.616718054 CEST	49907	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.618223906 CEST	49909	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.618772030 CEST	49906	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.620094061 CEST	49905	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.675968885 CEST	49910	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.684644938 CEST	49911	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.706115007 CEST	80	49908	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.706229925 CEST	49908	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.706338882 CEST	49908	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.708431005 CEST	49912	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.722861052 CEST	80	49893	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.722932100 CEST	49893	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.740605116 CEST	80	49909	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.740689039 CEST	49909	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.742764950 CEST	80	49905	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.742831945 CEST	49905	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.753783941 CEST	80	49906	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.754321098 CEST	80	49906	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.777286053 CEST	49913	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.795563936 CEST	49914	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.807297945 CEST	80	49911	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.807465076 CEST	49911	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.807614088 CEST	49911	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.808116913 CEST	49906	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.808990955 CEST	49915	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.810952902 CEST	49916	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.811115980 CEST	80	49910	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.811212063 CEST	49910	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.828943014 CEST	80	49908	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.829042912 CEST	49908	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.830858946 CEST	80	49912	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.830905914 CEST	49912	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.912273884 CEST	80	49913	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.912372112 CEST	49913	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.918289900 CEST	80	49914	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.918375969 CEST	49914	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.918606043 CEST	49914	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.925236940 CEST	49917	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.925611019 CEST	49918	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.930295944 CEST	80	49911	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:40.930368900 CEST	49911	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:40.933453083 CEST	80	49916	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.933577061 CEST	49916	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.938611984 CEST	49919	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:40.943063974 CEST	80	49915	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:40.943262100 CEST	49915	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.020495892 CEST	49920	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.041389942 CEST	80	49914	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.041456938 CEST	49914	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.047775984 CEST	80	49917	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.048054934 CEST	49917	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.048161983 CEST	80	49918	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.048374891 CEST	49918	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.048959017 CEST	49921	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.049213886 CEST	49918	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.061789036 CEST	49922	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.073771000 CEST	80	49919	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.073975086 CEST	49919	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.131414890 CEST	49923	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.154495001 CEST	80	49920	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.154582977 CEST	49920	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.154706955 CEST	49920	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.157335043 CEST	49924	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.171439886 CEST	80	49921	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.171528101 CEST	49921	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.171703100 CEST	80	49918	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.171773911 CEST	49918	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.175117970 CEST	49897	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.176559925 CEST	49925	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.195873022 CEST	80	49922	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.195949078 CEST	49922	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.242273092 CEST	49926	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.253911018 CEST	80	49923	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.254045010 CEST	49923	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.264178991 CEST	49923	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.265573025 CEST	49927	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.267261982 CEST	49928	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.280766010 CEST	80	49924	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.280828953 CEST	49924	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.288748980 CEST	80	49920	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.288809061 CEST	49920	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.308933020 CEST	80	49897	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.309003115 CEST	49897	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.313874006 CEST	80	49925	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.313941002 CEST	49925	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.353827000 CEST	49929	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.376991034 CEST	80	49784	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.377094984 CEST	49784	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.377317905 CEST	49784	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.377513885 CEST	80	49926	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.377583027 CEST	49926	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.384035110 CEST	49926	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.384365082 CEST	49930	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.386010885 CEST	49931	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.386809111 CEST	80	49923	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.386866093 CEST	49923	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.387634039 CEST	80	49785	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.387701988 CEST	49785	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.387970924 CEST	80	49927	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.387984037 CEST	49785	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.388025045 CEST	49927	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.405220032 CEST	80	49928	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.405267954 CEST	49928	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.449867010 CEST	49932	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.476129055 CEST	80	49929	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.476190090 CEST	49929	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.476293087 CEST	49929	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.477379084 CEST	49933	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.499639034 CEST	80	49784	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.506793976 CEST	80	49930	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.506874084 CEST	49930	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.508532047 CEST	80	49931	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.508606911 CEST	49931	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.508806944 CEST	49931	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.519390106 CEST	80	49926	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.519437075 CEST	80	49926	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.519500017 CEST	49926	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.521763086 CEST	80	49785	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.562825918 CEST	49934	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.586534977 CEST	80	49932	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.586852074 CEST	49932	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.587004900 CEST	49932	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.588790894 CEST	49935	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.598666906 CEST	80	49929	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.598717928 CEST	49929	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.612215042 CEST	80	49933	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.612272978 CEST	49933	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.612469912 CEST	49933	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.631174088 CEST	80	49931	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.631737947 CEST	80	49931	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.677126884 CEST	49936	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.683331013 CEST	49931	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.685198069 CEST	80	49934	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.685266972 CEST	49934	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.685381889 CEST	49934	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.687050104 CEST	49937	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.722636938 CEST	80	49935	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.722706079 CEST	49935	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.722893953 CEST	49935	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.723675966 CEST	80	49932	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.723723888 CEST	49932	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.747291088 CEST	80	49933	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.747776985 CEST	80	49933	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.786863089 CEST	49938	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.799115896 CEST	49933	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.807847023 CEST	80	49934	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.807917118 CEST	49934	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.809393883 CEST	80	49937	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.809468985 CEST	49937	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.809655905 CEST	49937	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.810817957 CEST	80	49936	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.810880899 CEST	49936	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.810990095 CEST	49936	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.812455893 CEST	49939	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.856610060 CEST	80	49935	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.857171059 CEST	80	49935	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.896825075 CEST	49940	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.909130096 CEST	49935	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.909276962 CEST	80	49938	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.909476995 CEST	49938	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.909997940 CEST	49938	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.911758900 CEST	49941	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.931951046 CEST	80	49937	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.932529926 CEST	80	49937	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.944865942 CEST	80	49936	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:41.944957018 CEST	49936	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:41.949661970 CEST	80	49939	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:41.949783087 CEST	49939	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.950123072 CEST	49939	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:41.976152897 CEST	49937	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.013701916 CEST	49942	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.019258022 CEST	80	49940	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.019520998 CEST	49940	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.019664049 CEST	49940	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.020843029 CEST	49943	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.032493114 CEST	80	49938	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.032572031 CEST	49938	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.034194946 CEST	80	49941	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.034259081 CEST	49941	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.034466982 CEST	49941	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.087321043 CEST	80	49939	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.087918997 CEST	80	49939	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.104844093 CEST	49944	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.135190964 CEST	49939	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.136076927 CEST	80	49942	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.136544943 CEST	49942	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.137387991 CEST	49942	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.139693022 CEST	49945	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.142100096 CEST	80	49940	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.142162085 CEST	49940	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.156776905 CEST	80	49941	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.157371998 CEST	80	49941	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.157830954 CEST	80	49943	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.157922029 CEST	49943	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.158150911 CEST	49943	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.199139118 CEST	49941	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.224438906 CEST	49946	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.227385998 CEST	80	49944	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.227452993 CEST	49944	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.228193045 CEST	49944	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.259953976 CEST	80	49942	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.260078907 CEST	49942	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.262105942 CEST	80	49945	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.262198925 CEST	49945	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.262557030 CEST	49945	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.266546965 CEST	49947	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.295106888 CEST	80	49943	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.296025038 CEST	80	49943	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.343122005 CEST	49943	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.347152948 CEST	80	49946	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.347249031 CEST	49946	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.347711086 CEST	49946	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.349550962 CEST	49948	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.350790024 CEST	80	49944	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.350871086 CEST	49944	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.352232933 CEST	49949	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.384887934 CEST	80	49945	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.385428905 CEST	80	49945	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.400317907 CEST	80	49947	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.402348995 CEST	49947	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.410171986 CEST	49947	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.438137054 CEST	49945	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.440762997 CEST	49950	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.470320940 CEST	80	49946	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.470396042 CEST	80	49946	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.470964909 CEST	49946	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.472013950 CEST	80	49948	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.472122908 CEST	49948	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.472280979 CEST	49948	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.477480888 CEST	49951	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.488142014 CEST	80	49949	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.488205910 CEST	49949	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.488538980 CEST	49949	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.543926954 CEST	80	49947	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.544517040 CEST	80	49947	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.563610077 CEST	80	49950	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.563808918 CEST	49950	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.565578938 CEST	49950	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.571907043 CEST	49952	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.573323011 CEST	49953	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.594973087 CEST	80	49948	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.595113039 CEST	49948	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.598143101 CEST	49947	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.611547947 CEST	80	49951	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.611630917 CEST	49951	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.611906052 CEST	49951	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.623708963 CEST	80	49949	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.624416113 CEST	80	49949	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.660646915 CEST	49954	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.678131104 CEST	49949	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.688292027 CEST	80	49950	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.688473940 CEST	49950	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.694467068 CEST	80	49952	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.695065022 CEST	49952	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.695255041 CEST	49952	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.695677996 CEST	80	49953	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.695761919 CEST	49953	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.695964098 CEST	49953	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.729051113 CEST	80	49823	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.731561899 CEST	49823	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.745842934 CEST	80	49951	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.746433020 CEST	80	49951	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.789146900 CEST	49951	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:42.797281981 CEST	80	49954	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.797986031 CEST	49954	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.817867994 CEST	80	49952	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:42.817943096 CEST	49952	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:42.818224907 CEST	80	49953	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.818728924 CEST	80	49953	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:42.874131918 CEST	49953	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.005922079 CEST	49823	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.007137060 CEST	49954	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.100790024 CEST	49955	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.128205061 CEST	80	49823	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:43.143852949 CEST	80	49954	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:43.143922091 CEST	49954	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.161365986 CEST	49956	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.161648035 CEST	49957	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.236216068 CEST	80	49955	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:43.239819050 CEST	49955	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.254172087 CEST	49955	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.269923925 CEST	49958	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.295636892 CEST	80	49957	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:43.295718908 CEST	49957	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.295841932 CEST	49957	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.296483994 CEST	80	49956	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:43.296566010 CEST	49956	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.296900988 CEST	49956	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.300383091 CEST	49959	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.316289902 CEST	49960	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.389916897 CEST	80	49955	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:43.390516996 CEST	80	49955	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:43.392539024 CEST	80	49958	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:43.392631054 CEST	49958	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.392757893 CEST	49958	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.398267031 CEST	49961	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.429864883 CEST	80	49957	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:43.429986000 CEST	49957	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.431857109 CEST	80	49956	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:43.432481050 CEST	80	49956	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:43.434286118 CEST	80	49959	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:43.438231945 CEST	49959	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.438694000 CEST	80	49960	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:43.438762903 CEST	49960	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.441122055 CEST	49955	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.473211050 CEST	49956	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:43.515440941 CEST	80	49958	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:43.518363953 CEST	49958	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:43.533442020 CEST	80	49961	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:43.533763885 CEST	49961	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.129576921 CEST	49959	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.129904032 CEST	49960	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.136013031 CEST	49961	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.222296000 CEST	49962	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.222930908 CEST	49963	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.252465963 CEST	80	49960	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:44.252521038 CEST	49960	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.263775110 CEST	80	49959	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.264350891 CEST	80	49959	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.271267891 CEST	80	49961	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.271859884 CEST	80	49961	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.318173885 CEST	49959	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.318269014 CEST	49961	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.338834047 CEST	49964	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.345182896 CEST	80	49962	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.345318079 CEST	49962	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.345530987 CEST	80	49963	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:44.345596075 CEST	49963	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.347296000 CEST	49962	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.347443104 CEST	49963	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.352849007 CEST	49965	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.461555958 CEST	80	49964	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:44.461641073 CEST	49964	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.466459036 CEST	49964	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.469876051 CEST	80	49962	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.470061064 CEST	80	49963	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:44.470115900 CEST	49963	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.470587969 CEST	80	49962	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.487615108 CEST	49966	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.488039970 CEST	80	49965	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.488123894 CEST	49965	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.488343000 CEST	49965	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.488511086 CEST	49967	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.525182009 CEST	49962	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.589205027 CEST	80	49964	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:44.589282990 CEST	49964	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.611881971 CEST	80	49967	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:44.611984968 CEST	49967	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.621491909 CEST	80	49966	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.621598005 CEST	49966	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.624480009 CEST	80	49965	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.625067949 CEST	80	49965	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.700150967 CEST	49965	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.796886921 CEST	49967	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.798158884 CEST	49966	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.839559078 CEST	49968	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.840893030 CEST	49969	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.840962887 CEST	49970	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.875200033 CEST	49971	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.919713974 CEST	80	49967	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:44.919914007 CEST	49967	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.931931973 CEST	80	49966	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.932533026 CEST	80	49966	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.962256908 CEST	80	49968	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:44.962356091 CEST	49968	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.962569952 CEST	49968	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.963502884 CEST	80	49970	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:44.963640928 CEST	49970	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.963946104 CEST	49970	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.970180988 CEST	49972	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.976249933 CEST	80	49969	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:44.976335049 CEST	49969	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.976731062 CEST	49969	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:44.979125023 CEST	49973	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:44.992130995 CEST	49966	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.000619888 CEST	49974	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.010329962 CEST	80	49971	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.010447025 CEST	49971	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.020169020 CEST	49971	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.027348995 CEST	49975	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.075440884 CEST	49976	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.085321903 CEST	80	49968	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.085573912 CEST	80	49968	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.085648060 CEST	49968	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.086322069 CEST	80	49970	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.086879969 CEST	80	49970	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.101721048 CEST	80	49973	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.101851940 CEST	49973	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.102093935 CEST	49973	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.104185104 CEST	80	49972	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.104258060 CEST	49972	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.106304884 CEST	49972	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.112005949 CEST	80	49969	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.112729073 CEST	49969	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.112848043 CEST	49977	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.135725975 CEST	80	49974	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.138375044 CEST	49974	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.138652086 CEST	49974	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.155283928 CEST	80	49971	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.155478001 CEST	80	49971	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.155538082 CEST	49971	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.163701057 CEST	80	49975	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.163865089 CEST	49975	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.164304972 CEST	49970	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.164767981 CEST	49975	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.185273886 CEST	49978	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.197977066 CEST	80	49976	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.198816061 CEST	49976	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.199832916 CEST	49976	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.224469900 CEST	80	49973	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.225109100 CEST	80	49973	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.240493059 CEST	80	49972	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.240561008 CEST	49972	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.248925924 CEST	80	49977	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.249655008 CEST	49977	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.273734093 CEST	80	49974	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.274390936 CEST	80	49974	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.278189898 CEST	49977	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.303179979 CEST	80	49975	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.303198099 CEST	80	49975	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.319205046 CEST	80	49978	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.319300890 CEST	49978	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.319421053 CEST	49978	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.327538013 CEST	49979	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.329219103 CEST	80	49976	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.329291105 CEST	49976	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.348838091 CEST	49980	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.349236965 CEST	49981	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.408705950 CEST	49982	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.414361000 CEST	80	49977	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.414994955 CEST	80	49977	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.423145056 CEST	49973	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.423459053 CEST	49974	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.453347921 CEST	80	49978	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.453393936 CEST	80	49978	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.453778028 CEST	49978	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.453792095 CEST	49975	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.462714911 CEST	80	49979	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.462821960 CEST	49979	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.463057041 CEST	49979	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.471299887 CEST	80	49980	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.471390963 CEST	49980	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.471929073 CEST	80	49981	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.472071886 CEST	49981	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.472981930 CEST	49980	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.473073006 CEST	49981	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.475465059 CEST	49983	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.519431114 CEST	49985	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.531250000 CEST	80	49982	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.531352043 CEST	49982	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.531462908 CEST	49982	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.534708977 CEST	49986	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.595431089 CEST	80	49980	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.595889091 CEST	80	49981	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.596038103 CEST	49981	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.596055984 CEST	80	49980	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.598058939 CEST	80	49979	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.598185062 CEST	49977	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.598643064 CEST	80	49979	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.609658957 CEST	80	49983	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.609759092 CEST	49983	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.609946966 CEST	49983	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.631575108 CEST	49987	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.653353930 CEST	80	49985	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.653506041 CEST	49985	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.654052973 CEST	80	49982	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.657531977 CEST	49982	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.657841921 CEST	49985	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.665272951 CEST	49988	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.668821096 CEST	80	49986	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.668934107 CEST	49986	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.669172049 CEST	49986	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.729840994 CEST	49989	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.741513968 CEST	49980	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.743964911 CEST	80	49983	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.744537115 CEST	80	49983	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.759299994 CEST	80	49906	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.759392977 CEST	49906	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.759629965 CEST	49906	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.765604973 CEST	80	49987	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.765676975 CEST	49987	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.765853882 CEST	49987	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.775989056 CEST	49990	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.791784048 CEST	80	49985	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.791841984 CEST	49985	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.800506115 CEST	80	49988	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.800653934 CEST	49988	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.800954103 CEST	49988	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.803235054 CEST	80	49986	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.803791046 CEST	80	49986	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.822149992 CEST	49979	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.840508938 CEST	49991	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.852510929 CEST	80	49989	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.852607965 CEST	49989	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.852745056 CEST	49989	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.854448080 CEST	49992	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.894601107 CEST	80	49906	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.898412943 CEST	80	49990	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.898489952 CEST	49990	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.898780107 CEST	49990	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.899882078 CEST	80	49987	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.899930954 CEST	49987	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.902208090 CEST	49983	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.936223030 CEST	80	49988	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.936799049 CEST	80	49988	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.959172964 CEST	49993	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.963222027 CEST	80	49991	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.963567019 CEST	49991	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.963644981 CEST	49991	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.965370893 CEST	49994	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.975255966 CEST	80	49989	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:45.975311995 CEST	49989	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:45.988549948 CEST	80	49992	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:45.988775969 CEST	49992	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:45.989296913 CEST	49992	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.021085978 CEST	80	49990	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.021590948 CEST	80	49990	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.030155897 CEST	49986	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.030591011 CEST	49988	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.064811945 CEST	49995	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.082048893 CEST	80	49993	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.082153082 CEST	49993	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.086334944 CEST	80	49991	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.086529970 CEST	49991	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.087734938 CEST	80	49994	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.087815046 CEST	49994	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.087990999 CEST	49993	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.088146925 CEST	49994	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.091867924 CEST	49996	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.094146967 CEST	49990	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.123812914 CEST	80	49992	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.124341011 CEST	80	49992	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.176367998 CEST	49997	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.187438965 CEST	80	49995	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.187530994 CEST	49995	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.187671900 CEST	49995	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.192965031 CEST	49998	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.210413933 CEST	80	49994	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.210900068 CEST	80	49993	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.210958958 CEST	49993	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.211065054 CEST	80	49994	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.214428902 CEST	80	49996	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.214624882 CEST	49996	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.214715958 CEST	49996	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.300823927 CEST	49999	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.302263021 CEST	49992	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.310393095 CEST	80	49995	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.310432911 CEST	80	49997	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.310467005 CEST	80	49995	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.310547113 CEST	49995	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.310612917 CEST	49997	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.314301968 CEST	49997	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.315310955 CEST	80	49998	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.315407038 CEST	49998	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.316417933 CEST	49998	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.341425896 CEST	80	49996	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.341826916 CEST	80	49996	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.394882917 CEST	50001	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.399987936 CEST	50002	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.430227995 CEST	49994	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.430249929 CEST	49996	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.435849905 CEST	80	49999	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.435908079 CEST	49999	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.436038017 CEST	49999	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.438719988 CEST	80	49998	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.439188004 CEST	50003	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.439294100 CEST	80	49998	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.448400974 CEST	80	49997	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.448436975 CEST	80	49997	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.448575974 CEST	49997	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.497292995 CEST	50004	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.517276049 CEST	80	50001	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.517496109 CEST	50001	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.517625093 CEST	50001	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.536572933 CEST	80	50002	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.536648989 CEST	50002	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.536809921 CEST	50002	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.537936926 CEST	50005	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.571089983 CEST	80	49999	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.571178913 CEST	49999	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.574403048 CEST	80	50003	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.574476957 CEST	50003	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.574953079 CEST	50003	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.583189964 CEST	49998	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.611933947 CEST	50006	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.619936943 CEST	80	50004	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.620110035 CEST	50004	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.620110035 CEST	50004	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.621107101 CEST	50008	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.637346983 CEST	80	49931	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.637587070 CEST	49931	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.637588024 CEST	49931	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.640209913 CEST	80	50001	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.640631914 CEST	80	50001	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.660428047 CEST	80	50005	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.663790941 CEST	50005	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.665251017 CEST	50005	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.673491001 CEST	80	50002	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.673573971 CEST	50002	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.702171087 CEST	50001	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.710011005 CEST	80	50003	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.710577965 CEST	80	50003	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.720043898 CEST	50009	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.734596968 CEST	80	50006	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.734683037 CEST	50006	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.734782934 CEST	50006	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.735945940 CEST	50010	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.742902994 CEST	80	50004	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.743128061 CEST	50004	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.743685007 CEST	80	50008	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.743772030 CEST	50008	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.743952990 CEST	50008	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.753284931 CEST	80	49933	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.753355980 CEST	49933	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.753592968 CEST	49933	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.760349035 CEST	80	49931	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.787738085 CEST	80	50005	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.788311005 CEST	80	50005	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.830133915 CEST	50003	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.830359936 CEST	50005	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.832397938 CEST	50011	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.853955030 CEST	80	50009	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.854096889 CEST	50009	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.854183912 CEST	50009	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.855443001 CEST	50012	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.857593060 CEST	80	50006	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.857651949 CEST	50006	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.862720966 CEST	80	49935	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.862780094 CEST	49935	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.862894058 CEST	49935	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.866555929 CEST	80	50008	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.867150068 CEST	80	50008	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.871078014 CEST	80	50010	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.871768951 CEST	50010	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.871929884 CEST	50010	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.888405085 CEST	80	49933	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.934346914 CEST	50013	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.937942982 CEST	80	49937	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.938028097 CEST	49937	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.938138962 CEST	49937	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.954895973 CEST	80	50011	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.959193945 CEST	50011	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.960442066 CEST	50011	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.966650963 CEST	50014	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.988085985 CEST	80	50009	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:46.988204002 CEST	50009	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:46.990559101 CEST	80	50012	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:46.991076946 CEST	50012	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.991355896 CEST	50012	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:46.996783972 CEST	80	49935	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.006972075 CEST	80	50010	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.007550955 CEST	80	50010	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.022149086 CEST	50008	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.050760031 CEST	50015	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.060559034 CEST	80	49937	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.069142103 CEST	80	50013	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.069217920 CEST	50013	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.069331884 CEST	50013	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.071234941 CEST	50016	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.083206892 CEST	80	50011	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.083280087 CEST	50011	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.093405962 CEST	80	49939	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.093573093 CEST	49939	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.093816996 CEST	49939	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.101862907 CEST	80	50014	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.101929903 CEST	50014	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.102241993 CEST	50014	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.102268934 CEST	50010	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.126364946 CEST	80	50012	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.126933098 CEST	80	50012	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.161458969 CEST	50017	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.162698030 CEST	80	49941	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.162753105 CEST	49941	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.162874937 CEST	49941	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.186008930 CEST	80	50015	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.186089039 CEST	50015	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.186320066 CEST	50015	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.187789917 CEST	50018	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.193799019 CEST	80	50016	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.193875074 CEST	50016	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.194066048 CEST	50016	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.203466892 CEST	80	50013	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.203613043 CEST	50013	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.231034040 CEST	80	49939	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.237200975 CEST	80	50014	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.237854958 CEST	80	50014	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.269306898 CEST	50019	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.285351038 CEST	80	50017	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.285418034 CEST	50017	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.285703897 CEST	50017	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.286556005 CEST	80	49941	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.287012100 CEST	50021	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.293134928 CEST	50012	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.300244093 CEST	80	49943	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.300296068 CEST	49943	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.300440073 CEST	49943	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.310261965 CEST	80	50018	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.310324907 CEST	50018	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.310724974 CEST	50018	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.316488028 CEST	80	50016	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.317075968 CEST	80	50016	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.321624041 CEST	80	50015	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.322056055 CEST	50015	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.388676882 CEST	50022	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.391242981 CEST	80	49945	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.391346931 CEST	49945	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.392173052 CEST	49945	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.406764984 CEST	80	50019	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.406866074 CEST	50019	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.407036066 CEST	50019	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.408199072 CEST	80	50017	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.408335924 CEST	50017	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.409007072 CEST	50023	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.409476995 CEST	80	50021	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.409589052 CEST	50021	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.409843922 CEST	50021	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.421195984 CEST	50014	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.433218002 CEST	80	50018	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.433784962 CEST	80	50018	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.437433958 CEST	80	49943	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.501131058 CEST	50016	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.514468908 CEST	80	49945	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.519413948 CEST	50024	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.522595882 CEST	80	50022	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.522664070 CEST	50022	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.522787094 CEST	50022	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.524648905 CEST	50025	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.531553984 CEST	80	50023	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.531619072 CEST	50023	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.531796932 CEST	50023	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.532443047 CEST	80	50021	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.533014059 CEST	80	50021	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.544533968 CEST	80	50019	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.544594049 CEST	50019	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.549961090 CEST	80	49947	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.550044060 CEST	49947	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.550167084 CEST	49947	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.601345062 CEST	50026	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.628134012 CEST	50018	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.629616976 CEST	80	49949	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.629693985 CEST	49949	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.629859924 CEST	49949	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.654232025 CEST	80	50023	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.654779911 CEST	80	50023	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.656660080 CEST	80	50022	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.656833887 CEST	50022	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.657152891 CEST	80	50024	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.657233953 CEST	50024	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.657774925 CEST	50024	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.659698009 CEST	50027	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.659728050 CEST	80	50025	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.659929991 CEST	50025	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.660068035 CEST	50025	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.664629936 CEST	50021	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.683969975 CEST	80	49947	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.712385893 CEST	50028	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.723892927 CEST	80	50026	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.724045038 CEST	50026	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.724258900 CEST	50026	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.732429028 CEST	50029	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.752073050 CEST	80	49951	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.752204895 CEST	49951	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.752285957 CEST	49951	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.764884949 CEST	80	49949	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.782326937 CEST	80	50027	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.782417059 CEST	50027	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.782604933 CEST	50027	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.795214891 CEST	80	50025	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.795676947 CEST	80	50024	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.795696974 CEST	80	50025	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.795749903 CEST	50024	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.820198059 CEST	50023	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.824604988 CEST	50031	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.824660063 CEST	80	49953	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.824851036 CEST	49953	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.825052977 CEST	49953	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.835206032 CEST	80	50028	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.835397959 CEST	50028	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.835423946 CEST	50028	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.837456942 CEST	50032	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.846918106 CEST	80	50026	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.847071886 CEST	50026	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.854906082 CEST	80	50029	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.854964972 CEST	50029	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.855176926 CEST	50029	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.886501074 CEST	80	49951	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.905436993 CEST	80	50027	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.905909061 CEST	80	50027	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.917927980 CEST	50033	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.947233915 CEST	80	50031	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.947377920 CEST	50031	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.947434902 CEST	80	49953	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.947488070 CEST	50031	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.949376106 CEST	50034	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.959353924 CEST	80	50028	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:47.959974051 CEST	80	50032	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.965264082 CEST	50032	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.965361118 CEST	50028	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:47.968893051 CEST	50032	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:47.977672100 CEST	80	50029	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:47.978543997 CEST	80	50029	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.029146910 CEST	50025	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.031419039 CEST	50035	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.041027069 CEST	80	50033	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.041126013 CEST	50033	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.041251898 CEST	50033	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.045386076 CEST	50036	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.070139885 CEST	80	50031	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.070205927 CEST	50031	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.083406925 CEST	80	50034	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.083498001 CEST	50034	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.083656073 CEST	50034	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.091602087 CEST	80	50032	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.092175961 CEST	80	50032	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.093139887 CEST	50027	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.093204975 CEST	50029	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.143030882 CEST	50037	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.164016008 CEST	80	50033	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.164089918 CEST	50033	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.167939901 CEST	80	50036	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.168149948 CEST	50036	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.168366909 CEST	50036	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.168668985 CEST	80	50035	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.168781042 CEST	50035	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.168917894 CEST	50035	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.170387030 CEST	50038	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.217595100 CEST	80	50034	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.218184948 CEST	80	50034	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.221363068 CEST	50032	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.259300947 CEST	50039	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.265661955 CEST	80	50037	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.265786886 CEST	50037	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.265862942 CEST	50037	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.276774883 CEST	50040	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.290815115 CEST	80	50036	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.291440964 CEST	80	50036	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.293199062 CEST	80	50038	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.293272018 CEST	50038	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.295794010 CEST	50038	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.300158978 CEST	50034	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.306240082 CEST	80	50035	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.310045004 CEST	50035	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.373838902 CEST	50041	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.388875008 CEST	80	50037	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.389206886 CEST	50037	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.395836115 CEST	80	49955	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.395956993 CEST	49955	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.396106005 CEST	49955	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.396481991 CEST	80	50039	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.396560907 CEST	50039	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.396882057 CEST	50039	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.405231953 CEST	50036	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.414062023 CEST	80	50040	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.414154053 CEST	50040	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.414357901 CEST	50040	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.418113947 CEST	50042	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.418375969 CEST	80	50038	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.418886900 CEST	80	50038	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.437810898 CEST	80	49956	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.437880993 CEST	49956	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.438010931 CEST	49956	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.478089094 CEST	50043	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.499660969 CEST	80	50041	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.499867916 CEST	50041	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.509171009 CEST	50041	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.512521982 CEST	50044	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.531230927 CEST	80	49955	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.534434080 CEST	80	50039	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.534497023 CEST	50039	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.540956020 CEST	80	50042	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.541102886 CEST	50042	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.541472912 CEST	50042	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.551661015 CEST	80	50040	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.552185059 CEST	80	50040	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.573282957 CEST	80	49956	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.573972940 CEST	50045	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.612456083 CEST	80	50043	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.612683058 CEST	50043	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.612767935 CEST	50043	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.614053011 CEST	50046	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.620201111 CEST	50038	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.620306015 CEST	50040	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.634172916 CEST	80	50041	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.634356976 CEST	50041	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.635407925 CEST	80	50044	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.635624886 CEST	50044	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.635812044 CEST	50044	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.665036917 CEST	80	50042	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.665537119 CEST	80	50042	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.685991049 CEST	50047	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.709888935 CEST	80	50045	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.709961891 CEST	50045	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.710092068 CEST	50045	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.711416960 CEST	50048	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.737525940 CEST	80	50046	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.737603903 CEST	50046	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.737783909 CEST	50046	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.747061014 CEST	80	50043	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.751261950 CEST	80	50043	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.751496077 CEST	50043	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.758318901 CEST	80	50044	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.758981943 CEST	80	50044	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.798676014 CEST	50049	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.821460962 CEST	80	50047	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.821542978 CEST	50047	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.821671963 CEST	50047	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.823199987 CEST	50050	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.834145069 CEST	80	50048	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.834225893 CEST	50048	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.834433079 CEST	50048	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.845920086 CEST	80	50045	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.845993042 CEST	50045	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.860444069 CEST	80	50046	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.860904932 CEST	80	50046	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.892132044 CEST	50042	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.892261028 CEST	50044	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.909506083 CEST	50051	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.921928883 CEST	80	50049	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.922019958 CEST	50049	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.922139883 CEST	50049	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.926223040 CEST	50052	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.957164049 CEST	80	50048	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.957278013 CEST	80	50047	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:48.957586050 CEST	80	50048	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.960803032 CEST	80	50050	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:48.965374947 CEST	50047	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:48.965506077 CEST	50050	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:48.967338085 CEST	50050	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.027544975 CEST	50053	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.028230906 CEST	50046	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.028737068 CEST	50048	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.044874907 CEST	80	50049	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.044915915 CEST	80	50051	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.045003891 CEST	50051	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.045284986 CEST	50051	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.047693014 CEST	50054	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.048789024 CEST	80	50052	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.048894882 CEST	50052	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.049071074 CEST	50052	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.104967117 CEST	80	50050	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.126674891 CEST	50055	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.150393009 CEST	80	50053	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.150486946 CEST	50053	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.150614023 CEST	50053	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.155266047 CEST	50056	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.170433998 CEST	80	50054	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.170625925 CEST	50054	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.170840979 CEST	50054	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.171539068 CEST	80	50052	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.180728912 CEST	80	50051	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.190632105 CEST	80	50049	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.190690994 CEST	50049	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.236227989 CEST	50057	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.238425016 CEST	80	50050	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.262554884 CEST	80	50055	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.262643099 CEST	50055	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.262765884 CEST	50055	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.264266014 CEST	50058	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.270565987 CEST	80	49959	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.270649910 CEST	49959	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.270775080 CEST	49959	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.273611069 CEST	80	50053	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.277456999 CEST	80	49961	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.277636051 CEST	49961	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.277636051 CEST	49961	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.291002035 CEST	80	50056	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.291085958 CEST	50056	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.291270971 CEST	50056	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.293494940 CEST	80	50054	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.298248053 CEST	50050	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.307038069 CEST	80	50052	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.307730913 CEST	80	50051	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.307797909 CEST	50051	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.307801962 CEST	80	50053	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.307919979 CEST	50053	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.308494091 CEST	80	50054	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.348176003 CEST	50059	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.374049902 CEST	80	50057	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.374161959 CEST	50057	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.374305964 CEST	50057	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.376182079 CEST	50060	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.387146950 CEST	80	50058	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.387274981 CEST	50058	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.387572050 CEST	50058	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.398104906 CEST	80	50055	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.398180008 CEST	50055	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.404895067 CEST	80	49959	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.413202047 CEST	80	49961	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.426322937 CEST	80	50056	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.460237026 CEST	50061	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.470829964 CEST	80	49962	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.470912933 CEST	49962	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.471060038 CEST	49962	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.474577904 CEST	80	50056	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.485929966 CEST	80	50059	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.486104012 CEST	50059	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.486161947 CEST	50059	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.488034010 CEST	50062	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.490145922 CEST	50052	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.510176897 CEST	80	50058	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.510216951 CEST	80	50060	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.510391951 CEST	50060	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.510633945 CEST	50060	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.510741949 CEST	80	50058	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.511718035 CEST	80	50057	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.522136927 CEST	50054	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.522209883 CEST	50056	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.526643038 CEST	80	50057	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.526710987 CEST	50057	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.575486898 CEST	50063	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.575849056 CEST	80	50049	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.576000929 CEST	50049	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.594868898 CEST	80	49962	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.602159023 CEST	50058	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.603859901 CEST	80	50061	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.605809927 CEST	50061	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.607453108 CEST	50061	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.613991022 CEST	50064	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.623414993 CEST	80	50062	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.623507977 CEST	50062	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.623945951 CEST	80	50059	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.624373913 CEST	50059	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.625971079 CEST	50062	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.630811930 CEST	80	49965	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.630902052 CEST	49965	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.631485939 CEST	49965	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.644963026 CEST	80	50060	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.645442009 CEST	80	50060	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.697134018 CEST	50060	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.699076891 CEST	50065	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.715509892 CEST	80	50063	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.715620041 CEST	50063	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.715749025 CEST	50063	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.717907906 CEST	50066	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.736957073 CEST	80	50064	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.737168074 CEST	50064	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.737382889 CEST	50064	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.745677948 CEST	80	50061	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.745744944 CEST	50061	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.761054993 CEST	80	50062	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.761665106 CEST	80	50062	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.766927958 CEST	80	49965	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.798106909 CEST	50067	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.822236061 CEST	80	50065	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.822328091 CEST	50065	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.822439909 CEST	50065	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.823997021 CEST	50068	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.853390932 CEST	80	50063	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.854141951 CEST	80	50066	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.854212999 CEST	50066	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.854454994 CEST	50066	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.859968901 CEST	80	50064	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.909122944 CEST	50069	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.921139002 CEST	50062	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.926256895 CEST	80	50063	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.926318884 CEST	50063	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.926717997 CEST	80	50064	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.932233095 CEST	80	50067	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.932436943 CEST	50067	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.939300060 CEST	80	49966	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.939388990 CEST	49966	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.939503908 CEST	49966	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.942159891 CEST	50067	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:49.943295956 CEST	50070	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.945377111 CEST	80	50065	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:49.960840940 CEST	80	50068	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:49.960920095 CEST	50068	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.961082935 CEST	50068	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.974134922 CEST	50064	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:49.990530968 CEST	80	50066	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.019784927 CEST	80	50065	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.020128012 CEST	50065	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.020246983 CEST	80	50066	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.025319099 CEST	50071	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.031682968 CEST	80	50069	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.031783104 CEST	50069	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.032342911 CEST	50069	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.040812969 CEST	50072	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.065932035 CEST	80	50070	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.066026926 CEST	50070	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.066277981 CEST	50070	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.073281050 CEST	80	49966	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.076307058 CEST	80	50067	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.076436996 CEST	50067	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.092343092 CEST	80	49970	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.092449903 CEST	49970	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.092573881 CEST	49970	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.097965956 CEST	80	50068	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.098481894 CEST	80	50068	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.118145943 CEST	50066	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.138839006 CEST	50073	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.147903919 CEST	80	50071	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.148005962 CEST	50071	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.148153067 CEST	50071	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.149841070 CEST	50074	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.154988050 CEST	80	50069	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.155061007 CEST	50069	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.176007032 CEST	80	50072	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.176079988 CEST	50072	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.176291943 CEST	50072	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.189013958 CEST	80	50070	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.189624071 CEST	80	50070	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.215078115 CEST	80	49970	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.230129957 CEST	50068	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.230130911 CEST	50070	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.230845928 CEST	80	49973	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.231125116 CEST	49973	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.231125116 CEST	49973	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.231200933 CEST	50075	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.261845112 CEST	80	50073	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.261964083 CEST	50073	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.262290001 CEST	50073	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.263890028 CEST	50076	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.280003071 CEST	80	50071	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.280030012 CEST	80	50074	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.280067921 CEST	80	49974	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.280123949 CEST	50074	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.280167103 CEST	50071	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.280167103 CEST	49974	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.280508995 CEST	49974	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.280510902 CEST	50074	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.305691957 CEST	80	49975	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.305752039 CEST	49975	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.305923939 CEST	49975	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.312094927 CEST	80	50072	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.312645912 CEST	80	50072	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.346894026 CEST	50077	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.353684902 CEST	80	49973	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.358151913 CEST	50072	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.368436098 CEST	80	50075	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.368516922 CEST	50075	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.369111061 CEST	50075	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.380181074 CEST	50078	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.385428905 CEST	80	50073	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.385521889 CEST	50073	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.397998095 CEST	80	50076	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.398113966 CEST	50076	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.398344994 CEST	50076	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.402832031 CEST	80	50074	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.404167891 CEST	80	50074	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.415669918 CEST	80	49974	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.420442104 CEST	80	49977	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.420501947 CEST	49977	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.420756102 CEST	49977	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.440840006 CEST	80	49975	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.454256058 CEST	50074	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.455930948 CEST	50079	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.484493017 CEST	80	50077	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.484690905 CEST	50077	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.484761953 CEST	50077	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.488070965 CEST	50080	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.506716013 CEST	80	50075	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.506742954 CEST	80	50075	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.506788969 CEST	50075	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.515362024 CEST	80	50078	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.515424967 CEST	50078	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.515625954 CEST	50078	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.532466888 CEST	80	50076	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.532875061 CEST	80	50076	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.556747913 CEST	80	49977	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.567316055 CEST	50081	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.581121922 CEST	50076	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.593027115 CEST	80	50079	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.593116999 CEST	50079	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.593244076 CEST	50079	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.597009897 CEST	50082	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.602256060 CEST	80	49980	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.602464914 CEST	49980	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.602513075 CEST	49980	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.604026079 CEST	80	49979	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.604085922 CEST	49979	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.604259968 CEST	49979	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.610460043 CEST	80	50080	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.610538006 CEST	50080	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.610770941 CEST	50080	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.622476101 CEST	80	50077	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.622617006 CEST	50077	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.650644064 CEST	80	50078	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.651299000 CEST	80	50078	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.677268982 CEST	50083	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.692142963 CEST	50078	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.702605963 CEST	80	50081	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.702775002 CEST	50081	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.703113079 CEST	50081	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.719645023 CEST	80	50082	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.719748020 CEST	50082	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.719985962 CEST	50082	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.722656965 CEST	50084	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.724868059 CEST	80	49980	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.730459929 CEST	80	50079	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.730627060 CEST	50079	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.733026981 CEST	80	50080	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.733586073 CEST	80	50080	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.739223003 CEST	80	49979	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.750113964 CEST	80	49983	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.750169039 CEST	49983	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.750304937 CEST	49983	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.788129091 CEST	50080	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.789971113 CEST	50085	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.809389114 CEST	80	49986	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.809557915 CEST	49986	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.809622049 CEST	49986	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.812678099 CEST	80	50083	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.812845945 CEST	50083	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.813050985 CEST	50083	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.814563036 CEST	50086	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.838352919 CEST	80	50081	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.838536024 CEST	50081	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.842533112 CEST	80	50082	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.843008995 CEST	80	50082	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.856738091 CEST	80	50084	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.856821060 CEST	50084	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.857057095 CEST	50084	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.884151936 CEST	50082	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.885438919 CEST	80	49983	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.903500080 CEST	50087	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.912805080 CEST	80	50085	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.912889957 CEST	50085	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.923167944 CEST	50085	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.924640894 CEST	50088	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.943386078 CEST	80	49988	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.943460941 CEST	49988	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.943685055 CEST	49988	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.943913937 CEST	80	49986	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.948448896 CEST	80	50083	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:50.948653936 CEST	50083	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:50.948895931 CEST	80	50086	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.948980093 CEST	50086	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.949595928 CEST	50086	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:50.991218090 CEST	80	50084	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:50.991642952 CEST	80	50084	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.021645069 CEST	50089	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.027493000 CEST	80	49990	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.027570963 CEST	49990	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.027703047 CEST	49990	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.040139914 CEST	80	50087	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.040240049 CEST	50087	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.040487051 CEST	50087	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.042547941 CEST	50090	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.044142008 CEST	50084	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.045850992 CEST	80	50085	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.045953035 CEST	50085	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.062514067 CEST	80	50088	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.062587976 CEST	50088	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.062988997 CEST	50088	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.079608917 CEST	80	49988	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.083755970 CEST	80	50086	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.084286928 CEST	80	50086	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.124145031 CEST	50086	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.129486084 CEST	80	49992	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.129586935 CEST	49992	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.129770041 CEST	49992	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.135442019 CEST	50091	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.150216103 CEST	80	49990	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.155853033 CEST	80	50089	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.155940056 CEST	50089	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.156064034 CEST	50089	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.159410000 CEST	50092	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.165146112 CEST	80	50090	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.165225983 CEST	50090	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.165524960 CEST	50090	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.176773071 CEST	80	50087	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.176867008 CEST	50087	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.200608969 CEST	80	50088	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.201143980 CEST	80	50088	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.217509031 CEST	80	49994	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.217731953 CEST	49994	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.217829943 CEST	49994	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.238359928 CEST	50093	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.251125097 CEST	50088	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.258546114 CEST	80	50091	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.258660078 CEST	50091	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.258789062 CEST	50091	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.260446072 CEST	50094	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.264066935 CEST	80	49992	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.282350063 CEST	80	50092	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.282442093 CEST	50092	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.282622099 CEST	50092	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.289997101 CEST	80	50090	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.290060043 CEST	80	50090	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.290493965 CEST	80	50089	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.320208073 CEST	80	50089	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.320477962 CEST	50089	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.331140041 CEST	50090	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.340089083 CEST	80	49994	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.343425035 CEST	80	49996	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.343509912 CEST	49996	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.343657970 CEST	49996	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.348718882 CEST	50095	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.372327089 CEST	80	50093	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.372479916 CEST	50093	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.372770071 CEST	50093	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.375691891 CEST	50096	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.381767988 CEST	80	50091	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.381881952 CEST	50091	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.383089066 CEST	80	50094	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.383177996 CEST	50094	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.383464098 CEST	50094	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.405586004 CEST	80	50092	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.406723022 CEST	80	50092	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.444649935 CEST	80	49998	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.444706917 CEST	49998	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.444828033 CEST	49998	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.456151009 CEST	50092	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.458995104 CEST	50097	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.466167927 CEST	80	49996	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.471266985 CEST	80	50095	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.471345901 CEST	50095	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.471473932 CEST	50095	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.474837065 CEST	50098	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.498389006 CEST	80	50096	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.498562098 CEST	50096	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.498733044 CEST	50096	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.505888939 CEST	80	50094	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.506850958 CEST	80	50093	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.507152081 CEST	50093	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.507230043 CEST	80	50094	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.551276922 CEST	50094	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.567332029 CEST	80	49998	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.572626114 CEST	50099	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.592892885 CEST	80	50097	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.592979908 CEST	50097	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.593121052 CEST	50097	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.594213009 CEST	80	50095	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.594269037 CEST	50095	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.594500065 CEST	50100	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.608911037 CEST	80	50098	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.609113932 CEST	50098	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.609201908 CEST	50098	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.621175051 CEST	80	50096	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.621716976 CEST	80	50096	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.645349026 CEST	80	50001	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.645454884 CEST	50001	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.645564079 CEST	50001	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.663243055 CEST	50096	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.680439949 CEST	50101	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.695312023 CEST	80	50099	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.698210001 CEST	50099	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.700213909 CEST	50099	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.703953981 CEST	50102	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.716490030 CEST	80	50003	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.717406988 CEST	80	50100	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.717504978 CEST	50003	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.717535019 CEST	50100	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.725228071 CEST	50100	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.725343943 CEST	50003	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.727349043 CEST	80	50097	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.727440119 CEST	50097	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.743362904 CEST	80	50098	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.743732929 CEST	80	50098	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.768167019 CEST	80	50001	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.789282084 CEST	50098	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.793721914 CEST	80	50005	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.793829918 CEST	50005	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.793962955 CEST	50005	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.795794010 CEST	50103	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.817043066 CEST	80	50101	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.817261934 CEST	50101	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.818603039 CEST	50101	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.823425055 CEST	80	50099	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.823571920 CEST	50099	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.839272976 CEST	80	50102	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.839361906 CEST	50102	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.839814901 CEST	50102	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.848328114 CEST	80	50100	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.849003077 CEST	80	50100	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.860629082 CEST	80	50003	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.869441986 CEST	50104	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.869534016 CEST	80	50008	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.869594097 CEST	50008	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.869698048 CEST	50008	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.899127007 CEST	50100	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.902731895 CEST	50105	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.916476011 CEST	80	50005	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.929796934 CEST	80	50103	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.929899931 CEST	50103	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.930088997 CEST	50103	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.933197975 CEST	50106	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.955308914 CEST	80	50101	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:51.958600998 CEST	50101	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:51.975847006 CEST	80	50102	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.976361036 CEST	80	50102	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.992321968 CEST	80	50104	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.992435932 CEST	50104	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.992475033 CEST	80	50008	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:51.992635012 CEST	50104	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:51.997363091 CEST	50107	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.013219118 CEST	80	50010	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.013305902 CEST	50010	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.013436079 CEST	50010	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.026112080 CEST	80	50105	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.026316881 CEST	50105	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.026316881 CEST	50105	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.027131081 CEST	50102	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.029004097 CEST	50108	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.055795908 CEST	80	50106	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.056087971 CEST	50106	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.056202888 CEST	50106	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.064169884 CEST	80	50103	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.064239979 CEST	50103	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.108810902 CEST	50109	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.115374088 CEST	80	50104	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.115910053 CEST	80	50104	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.132581949 CEST	80	50012	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.132654905 CEST	80	50107	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.132661104 CEST	50012	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.132720947 CEST	50107	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.132810116 CEST	50012	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.132903099 CEST	50107	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.134423018 CEST	50110	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.148782015 CEST	80	50010	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.149257898 CEST	80	50105	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.149329901 CEST	50105	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.164410114 CEST	80	50108	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.164624929 CEST	50108	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.164793968 CEST	50108	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.171200991 CEST	50104	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.179387093 CEST	80	50106	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.179946899 CEST	80	50106	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.221302986 CEST	50111	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.235255957 CEST	50106	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.243437052 CEST	80	50014	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.243514061 CEST	50014	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.243633986 CEST	50014	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.244019032 CEST	80	50109	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.244112968 CEST	50109	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.244256973 CEST	50109	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.246900082 CEST	50112	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.268058062 CEST	80	50012	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.268188000 CEST	80	50107	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.268290997 CEST	80	50110	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.268335104 CEST	50107	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.268378019 CEST	50110	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.268560886 CEST	50110	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.300189972 CEST	80	50108	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.300604105 CEST	80	50108	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.322478056 CEST	80	50016	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.322539091 CEST	50016	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.322659969 CEST	50016	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.333147049 CEST	50113	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.346163034 CEST	50108	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.355201960 CEST	80	50111	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.355272055 CEST	50111	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.355393887 CEST	50111	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.357877970 CEST	50114	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.378931046 CEST	80	50014	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.379736900 CEST	80	50109	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.379806042 CEST	50109	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.380878925 CEST	80	50112	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.381084919 CEST	50112	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.382050991 CEST	50112	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.402332067 CEST	80	50110	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.403541088 CEST	80	50110	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.439440012 CEST	80	50018	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.439543962 CEST	50018	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.439668894 CEST	50018	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.443645954 CEST	50115	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.445106983 CEST	80	50016	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.455776930 CEST	80	50113	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.455957890 CEST	50113	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.458137989 CEST	50110	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.466159105 CEST	50113	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.468282938 CEST	50116	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.480351925 CEST	80	50114	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.480411053 CEST	50114	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.480602026 CEST	50114	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.489581108 CEST	80	50111	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.489635944 CEST	50111	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.515885115 CEST	80	50112	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.516421080 CEST	80	50112	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.538479090 CEST	80	50021	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.538700104 CEST	50021	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.539104939 CEST	50021	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.556092024 CEST	50117	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.562231064 CEST	80	50018	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.570128918 CEST	50112	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.581320047 CEST	80	50115	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.581401110 CEST	50115	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.581518888 CEST	50115	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.584527016 CEST	50118	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.589541912 CEST	80	50113	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.589600086 CEST	50113	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.602345943 CEST	80	50116	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.602415085 CEST	50116	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.603025913 CEST	80	50114	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.603632927 CEST	80	50114	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.604258060 CEST	50116	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.649136066 CEST	50114	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.661312103 CEST	80	50023	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.661374092 CEST	50023	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.661531925 CEST	80	50021	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.661537886 CEST	50023	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.669737101 CEST	50119	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.691459894 CEST	80	50117	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.691665888 CEST	50117	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.691665888 CEST	50117	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.693644047 CEST	50120	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.707222939 CEST	80	50118	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.707292080 CEST	50118	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.707595110 CEST	50118	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.717767954 CEST	80	50115	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.719754934 CEST	50115	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.738220930 CEST	80	50116	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.738863945 CEST	80	50116	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.762166023 CEST	50121	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.783979893 CEST	80	50023	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.793133020 CEST	50116	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.801198006 CEST	80	50025	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.801362038 CEST	50025	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.801487923 CEST	50025	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.804920912 CEST	80	50119	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.804989100 CEST	50119	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.805088997 CEST	50119	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.806456089 CEST	50122	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.827052116 CEST	80	50117	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.827126026 CEST	50117	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.827405930 CEST	80	50120	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.827475071 CEST	50120	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.827692986 CEST	50120	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.830020905 CEST	80	50118	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.830604076 CEST	80	50118	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.873147011 CEST	50118	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.874280930 CEST	50123	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.897543907 CEST	80	50121	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.897622108 CEST	50121	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.897746086 CEST	50121	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.898977041 CEST	50124	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.911149025 CEST	80	50027	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.911223888 CEST	50027	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.911344051 CEST	50027	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.936594963 CEST	80	50025	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.940398932 CEST	80	50119	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.940418959 CEST	80	50122	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.940452099 CEST	50119	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.940495968 CEST	50122	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.940696001 CEST	50122	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.961627960 CEST	80	50120	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.962805986 CEST	80	50120	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.983984947 CEST	80	50029	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:52.984049082 CEST	50029	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.984159946 CEST	50029	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:52.986100912 CEST	50125	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.996761084 CEST	80	50123	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:52.996841908 CEST	50123	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:52.996932030 CEST	50123	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.000017881 CEST	50126	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.017126083 CEST	50120	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.033169985 CEST	80	50121	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.033354998 CEST	50121	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.033680916 CEST	80	50027	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.036077976 CEST	80	50124	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.036283970 CEST	50124	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.036556005 CEST	50124	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.074522018 CEST	80	50122	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.075943947 CEST	80	50122	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.098053932 CEST	80	50032	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.098197937 CEST	50032	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.098284960 CEST	50032	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.099164963 CEST	50127	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.106626987 CEST	80	50029	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.119649887 CEST	80	50123	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.119720936 CEST	50123	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.121207952 CEST	80	50125	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.121278048 CEST	50125	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.121434927 CEST	50125	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.123879910 CEST	50128	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.129437923 CEST	50122	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.135425091 CEST	80	50126	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.135514975 CEST	50126	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.135914087 CEST	50126	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.173803091 CEST	80	50124	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.175088882 CEST	80	50124	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.198895931 CEST	50129	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.220896959 CEST	80	50032	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.224215984 CEST	80	50034	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.224282026 CEST	50034	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.224695921 CEST	50034	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.225147963 CEST	50124	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.234179020 CEST	80	50127	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.234653950 CEST	50127	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.234812021 CEST	50127	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.239480019 CEST	50130	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.246301889 CEST	80	50128	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.246411085 CEST	50128	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.246602058 CEST	50128	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.256815910 CEST	80	50125	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.256871939 CEST	50125	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.271229982 CEST	80	50126	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.272558928 CEST	80	50126	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.296757936 CEST	80	50036	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.296818018 CEST	50036	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.296941042 CEST	50036	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.321228027 CEST	50126	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.322870016 CEST	50131	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.336424112 CEST	80	50129	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.336647987 CEST	50129	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.336647987 CEST	50129	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.341028929 CEST	50132	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.358881950 CEST	80	50034	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.362524033 CEST	80	50130	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.362606049 CEST	50130	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.362824917 CEST	50130	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.369097948 CEST	80	50128	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.369932890 CEST	80	50128	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.369962931 CEST	80	50127	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.370141983 CEST	50127	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.417141914 CEST	50128	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.418673038 CEST	50133	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.423546076 CEST	80	50036	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.425544024 CEST	80	50038	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.425617933 CEST	50038	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.425757885 CEST	50038	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.445619106 CEST	80	50131	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.445723057 CEST	50131	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.445852041 CEST	50131	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.447210073 CEST	50134	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.464045048 CEST	80	50132	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.464147091 CEST	50132	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.464348078 CEST	50132	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.474204063 CEST	80	50129	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.474435091 CEST	50129	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.485506058 CEST	80	50130	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.486152887 CEST	80	50130	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.528297901 CEST	50130	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.529968023 CEST	50135	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.541237116 CEST	80	50133	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.541313887 CEST	50133	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.541436911 CEST	50133	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.545993090 CEST	50136	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.548211098 CEST	80	50038	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.557431936 CEST	80	50040	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.557492018 CEST	50040	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.557967901 CEST	50040	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.568985939 CEST	80	50131	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.569176912 CEST	50131	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.569570065 CEST	80	50134	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.569644928 CEST	50134	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.569863081 CEST	50134	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.586869001 CEST	80	50132	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.587287903 CEST	80	50132	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.640130043 CEST	50132	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.641362906 CEST	50137	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.652611017 CEST	80	50135	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.652786016 CEST	50135	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.652827024 CEST	50135	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.657682896 CEST	50138	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.664226055 CEST	80	50133	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.664307117 CEST	50133	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.668742895 CEST	80	50136	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.668914080 CEST	50136	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.669107914 CEST	50136	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.669853926 CEST	80	50042	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.669922113 CEST	50042	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.670063972 CEST	50042	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.692208052 CEST	80	50134	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.692734003 CEST	80	50134	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.695153952 CEST	80	50040	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.736145973 CEST	50134	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.753736019 CEST	50139	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.764532089 CEST	80	50044	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.764771938 CEST	50044	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.764771938 CEST	50044	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.775624990 CEST	80	50137	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.775706053 CEST	50137	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.775799990 CEST	50137	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.775943995 CEST	80	50135	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.776084900 CEST	50135	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.778203011 CEST	50140	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.791764021 CEST	80	50138	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.791791916 CEST	80	50136	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.791867018 CEST	50138	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.792059898 CEST	50138	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.792190075 CEST	80	50136	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.792521954 CEST	80	50042	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.832146883 CEST	50136	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.861277103 CEST	80	50046	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.861350060 CEST	50046	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.861644983 CEST	50046	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.869045019 CEST	50141	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.887427092 CEST	80	50044	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.889018059 CEST	80	50139	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.889127970 CEST	50139	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.889322042 CEST	50139	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.891602993 CEST	50142	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.900942087 CEST	80	50140	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.901041985 CEST	50140	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.905245066 CEST	50140	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.910283089 CEST	80	50137	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.910357952 CEST	50137	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.927242041 CEST	80	50138	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.927877903 CEST	80	50138	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.963185072 CEST	80	50048	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.963329077 CEST	50048	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.963613987 CEST	50048	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.975158930 CEST	50138	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:53.976885080 CEST	50143	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:53.984309912 CEST	80	50046	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:53.992230892 CEST	80	50141	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:53.992521048 CEST	50141	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.020458937 CEST	50141	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.029738903 CEST	80	50140	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.030241966 CEST	80	50140	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.032860041 CEST	80	50139	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.035324097 CEST	80	50142	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.035429001 CEST	50142	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.035444975 CEST	50139	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.058969021 CEST	50142	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.065475941 CEST	50144	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.071144104 CEST	50140	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.086314917 CEST	80	50048	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.088382959 CEST	50145	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.099730015 CEST	80	50143	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.099931955 CEST	50143	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.099931955 CEST	50143	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.101207018 CEST	50146	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.143423080 CEST	80	50141	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.143626928 CEST	50141	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.184575081 CEST	50147	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.188038111 CEST	80	50144	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.188129902 CEST	50144	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.188332081 CEST	50144	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.196981907 CEST	80	50142	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.197521925 CEST	80	50142	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.211510897 CEST	80	50145	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.211724043 CEST	50145	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.222184896 CEST	50145	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.222938061 CEST	80	50143	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.223047018 CEST	50143	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.225847960 CEST	50148	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.237754107 CEST	80	50146	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.237833023 CEST	50146	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.238012075 CEST	50146	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.243819952 CEST	80	50050	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.243877888 CEST	50050	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.244002104 CEST	50050	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.246157885 CEST	50142	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.295209885 CEST	50149	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.312180996 CEST	80	50052	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.312385082 CEST	50052	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.312386036 CEST	50052	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.315807104 CEST	80	50144	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.316283941 CEST	80	50144	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.316348076 CEST	80	50054	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.316590071 CEST	50054	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.316674948 CEST	50054	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.326051950 CEST	80	50147	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.326404095 CEST	50147	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.327316046 CEST	50147	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.329375029 CEST	50150	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.346327066 CEST	80	50145	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.346503973 CEST	50145	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.349802017 CEST	80	50148	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.349932909 CEST	50148	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.350097895 CEST	50148	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.358129978 CEST	50144	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.375905991 CEST	80	50146	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.376569033 CEST	80	50146	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.381975889 CEST	80	50050	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.407704115 CEST	50151	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.418327093 CEST	80	50149	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.418451071 CEST	50149	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.418662071 CEST	50149	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.420463085 CEST	50152	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.422130108 CEST	50146	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.435278893 CEST	80	50052	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.439563990 CEST	80	50054	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.462034941 CEST	80	50147	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.462254047 CEST	50147	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.468461990 CEST	80	50150	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.468558073 CEST	50150	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.468863964 CEST	50150	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.473643064 CEST	80	50148	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.474129915 CEST	80	50148	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.480330944 CEST	80	50056	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.480397940 CEST	50056	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.480567932 CEST	50056	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.516076088 CEST	80	50058	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.516140938 CEST	50058	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.516280890 CEST	50058	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.518174887 CEST	50148	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.519674063 CEST	50153	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.542557001 CEST	80	50149	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.542627096 CEST	50149	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.543467999 CEST	80	50151	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.543543100 CEST	50151	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.543889046 CEST	50151	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.548170090 CEST	50154	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.554878950 CEST	80	50152	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.554968119 CEST	50152	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.555254936 CEST	50152	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.606398106 CEST	80	50150	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.606951952 CEST	80	50150	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.615957975 CEST	80	50056	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.627140999 CEST	50155	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.639203072 CEST	80	50058	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.642491102 CEST	80	50153	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.642740011 CEST	50153	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.642740011 CEST	50153	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.644961119 CEST	50156	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.651062012 CEST	80	50060	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.651221037 CEST	50060	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.651355982 CEST	50060	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.662254095 CEST	50150	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.671031952 CEST	80	50154	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.671129942 CEST	50154	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.671480894 CEST	50154	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.679764986 CEST	80	50151	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.679837942 CEST	50151	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.690896034 CEST	80	50152	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.690958977 CEST	80	50152	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.743588924 CEST	50152	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.750245094 CEST	80	50155	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.750504971 CEST	50155	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.750633001 CEST	50155	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.755819082 CEST	50157	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.769054890 CEST	80	50153	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.769217968 CEST	50153	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.769243956 CEST	80	50062	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.769488096 CEST	50062	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.769570112 CEST	80	50156	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.769681931 CEST	50062	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.769730091 CEST	50156	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.770021915 CEST	50156	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.776813030 CEST	50158	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.785603046 CEST	80	50060	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.796713114 CEST	80	50154	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.797265053 CEST	80	50154	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.838146925 CEST	50154	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.841553926 CEST	50159	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.876243114 CEST	80	50155	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.876344919 CEST	50155	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.894857883 CEST	80	50156	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.895380020 CEST	80	50156	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.895734072 CEST	80	50157	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.895812035 CEST	50157	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.896195889 CEST	50157	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.900501013 CEST	80	50158	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.900569916 CEST	50158	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.908097029 CEST	80	50062	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.911233902 CEST	50158	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.912800074 CEST	50160	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.934753895 CEST	80	50064	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:54.934968948 CEST	50064	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.935060978 CEST	50064	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.948147058 CEST	50156	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:54.950824976 CEST	50161	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.981777906 CEST	80	50159	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:54.981878996 CEST	50159	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.982052088 CEST	50159	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:54.983668089 CEST	50162	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.028691053 CEST	80	50066	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.028959036 CEST	50066	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.029095888 CEST	50066	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.037019014 CEST	80	50158	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.037153959 CEST	50158	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.042161942 CEST	80	50157	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.042706966 CEST	80	50157	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.053731918 CEST	80	50160	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.054214954 CEST	50160	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.055656910 CEST	50160	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.060616970 CEST	80	50064	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.074872017 CEST	50163	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.077137947 CEST	80	50161	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.077322960 CEST	50161	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.077378988 CEST	50161	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.091260910 CEST	50157	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.100509882 CEST	50164	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.106892109 CEST	80	50068	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.106975079 CEST	50068	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.107553005 CEST	50068	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.109404087 CEST	80	50162	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.109661102 CEST	50162	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.109740973 CEST	50162	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.121895075 CEST	80	50159	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.122087955 CEST	50159	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.168406963 CEST	80	50066	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.175446033 CEST	50165	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.196861982 CEST	80	50160	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.197307110 CEST	80	50160	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.197767973 CEST	80	50070	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.197828054 CEST	50070	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.198112011 CEST	50070	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.203572989 CEST	80	50161	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.203646898 CEST	50161	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.213426113 CEST	80	50163	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.213507891 CEST	50163	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.213637114 CEST	50163	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.219819069 CEST	50166	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.235538960 CEST	80	50162	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.235935926 CEST	80	50162	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.240483046 CEST	80	50164	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.240629911 CEST	50164	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.240890980 CEST	50164	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.247746944 CEST	80	50068	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.251280069 CEST	50160	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.283240080 CEST	50162	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.286962986 CEST	50167	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.313039064 CEST	80	50165	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.313119888 CEST	50165	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.313278913 CEST	50165	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.314867020 CEST	50168	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.322866917 CEST	80	50072	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.322935104 CEST	50072	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.323048115 CEST	50072	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.323916912 CEST	80	50070	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.352392912 CEST	80	50163	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.352453947 CEST	50163	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.357120991 CEST	80	50166	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.357192039 CEST	50166	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.357450962 CEST	50166	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.377695084 CEST	80	50164	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.378279924 CEST	80	50164	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.398416042 CEST	50169	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.409857035 CEST	80	50074	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.409941912 CEST	50074	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.410612106 CEST	50074	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.410674095 CEST	80	50167	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.410773993 CEST	50167	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.410985947 CEST	50167	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.418512106 CEST	50170	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.427221060 CEST	50164	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.448375940 CEST	80	50165	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.448429108 CEST	80	50165	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.448621035 CEST	50165	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.449743986 CEST	80	50168	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.449842930 CEST	50168	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.450067043 CEST	50168	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.458105087 CEST	80	50072	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.494627953 CEST	80	50166	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.495208979 CEST	80	50166	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.499211073 CEST	50171	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.533031940 CEST	80	50074	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.533405066 CEST	80	50167	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.533468008 CEST	50167	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.534650087 CEST	80	50169	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.534729958 CEST	50169	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.534853935 CEST	50169	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.536181927 CEST	50172	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.538465977 CEST	80	50076	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.538527966 CEST	50076	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.538975954 CEST	50076	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.539135933 CEST	50166	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.553514004 CEST	80	50170	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.553719997 CEST	50170	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.553838968 CEST	50170	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.585238934 CEST	80	50168	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.585716963 CEST	80	50168	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.608431101 CEST	50173	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.621972084 CEST	80	50171	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.622097969 CEST	50171	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.622243881 CEST	50171	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.624385118 CEST	50174	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.634267092 CEST	50168	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.656608105 CEST	80	50078	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.656683922 CEST	50078	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.656812906 CEST	50078	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.671399117 CEST	80	50169	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.671442986 CEST	80	50172	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.671463013 CEST	50169	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.671516895 CEST	50172	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.671710968 CEST	50172	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.673187971 CEST	80	50076	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.688781023 CEST	80	50170	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.689380884 CEST	80	50170	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.719388008 CEST	50175	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.730501890 CEST	50170	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.739485025 CEST	80	50080	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.741902113 CEST	50080	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.742387056 CEST	50080	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.744823933 CEST	80	50173	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.744931936 CEST	50173	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.746579885 CEST	80	50171	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.746642113 CEST	50171	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.748238087 CEST	80	50174	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.748321056 CEST	50174	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.748503923 CEST	50173	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.748794079 CEST	50174	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.750339985 CEST	50176	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.792212963 CEST	80	50078	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.807202101 CEST	80	50172	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.807647943 CEST	80	50172	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.833384037 CEST	50177	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.848737001 CEST	80	50082	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.848839998 CEST	50082	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.848987103 CEST	50082	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.855741978 CEST	80	50175	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.855851889 CEST	50175	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.856002092 CEST	50175	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.857131958 CEST	50172	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.860811949 CEST	50178	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.864726067 CEST	80	50080	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.871447086 CEST	80	50174	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.871953964 CEST	80	50174	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.872730017 CEST	80	50176	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.872889042 CEST	50176	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.874665976 CEST	50176	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.884747982 CEST	80	50173	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.884829044 CEST	50173	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.921196938 CEST	50174	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.942133904 CEST	50179	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.968765020 CEST	80	50177	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.968888998 CEST	50177	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.969046116 CEST	50177	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.971040964 CEST	50180	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.971386909 CEST	80	50082	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.983513117 CEST	80	50178	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.983598948 CEST	50178	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.983804941 CEST	50178	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.992170095 CEST	80	50175	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:55.992284060 CEST	50175	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:55.996818066 CEST	80	50084	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.996885061 CEST	50084	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.997018099 CEST	50084	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:55.997046947 CEST	80	50176	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:55.997594118 CEST	80	50176	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.044764996 CEST	50176	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.061542988 CEST	50181	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.076185942 CEST	80	50179	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.076266050 CEST	50179	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.076400995 CEST	50179	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.077542067 CEST	50182	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.089493990 CEST	80	50086	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.089607000 CEST	50086	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.089730024 CEST	50086	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.094820023 CEST	80	50180	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.094878912 CEST	50180	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.095083952 CEST	50180	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.105437994 CEST	80	50177	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.105470896 CEST	80	50177	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.105552912 CEST	50177	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.106189013 CEST	80	50178	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.106780052 CEST	80	50178	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.130892992 CEST	80	50084	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.160145998 CEST	50178	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.164879084 CEST	50183	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.195552111 CEST	80	50181	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.195640087 CEST	50181	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.196192026 CEST	50181	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.200032949 CEST	80	50182	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.200158119 CEST	50182	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.203939915 CEST	50182	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.206490040 CEST	80	50088	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.206559896 CEST	50088	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.210670948 CEST	80	50179	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.210733891 CEST	80	50179	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.210993052 CEST	50179	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.215334892 CEST	50088	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.217787027 CEST	80	50180	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.218245983 CEST	80	50180	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.223505974 CEST	50184	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.223577023 CEST	80	50086	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.272125959 CEST	50180	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.276180029 CEST	50185	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.287688971 CEST	80	50183	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.287765980 CEST	50183	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.293776989 CEST	80	50090	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.293849945 CEST	50090	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.294003963 CEST	50090	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.298173904 CEST	50183	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.299998999 CEST	50186	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.327161074 CEST	80	50182	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.327455044 CEST	80	50182	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.330487967 CEST	80	50181	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.330573082 CEST	50181	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.366453886 CEST	80	50088	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.366494894 CEST	80	50184	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.366559982 CEST	50184	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.366889954 CEST	50184	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.368145943 CEST	50182	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.390284061 CEST	50187	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.412199020 CEST	80	50092	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.412266016 CEST	50092	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.412269115 CEST	80	50185	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.412334919 CEST	50185	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.412431002 CEST	50185	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.412444115 CEST	50092	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.413927078 CEST	50188	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.417246103 CEST	80	50090	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.421211958 CEST	80	50183	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.422060013 CEST	50183	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.434312105 CEST	80	50186	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.434658051 CEST	50186	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.434921980 CEST	50186	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.482676983 CEST	50189	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.501921892 CEST	80	50184	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.502497911 CEST	80	50184	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.511127949 CEST	80	50094	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.511394024 CEST	50094	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.511454105 CEST	50094	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.526544094 CEST	80	50187	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.526712894 CEST	50187	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.535296917 CEST	80	50092	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.536175013 CEST	50187	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.537630081 CEST	50190	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.544151068 CEST	50184	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.548091888 CEST	80	50188	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.548166037 CEST	50188	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.548418999 CEST	50188	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.548706055 CEST	80	50185	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.548779011 CEST	50185	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.570600986 CEST	80	50186	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.570641041 CEST	80	50186	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.594542027 CEST	50191	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.619205952 CEST	80	50189	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.619314909 CEST	50189	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.619496107 CEST	50189	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.621684074 CEST	50192	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.623142958 CEST	50186	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.627444983 CEST	80	50096	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.627523899 CEST	50096	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.627682924 CEST	50096	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.634104013 CEST	80	50094	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.660126925 CEST	80	50190	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.660214901 CEST	50190	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.660492897 CEST	50190	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.672399998 CEST	80	50187	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.672528982 CEST	80	50187	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.672643900 CEST	50187	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.682446003 CEST	80	50188	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.682828903 CEST	80	50188	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.703501940 CEST	50193	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.717430115 CEST	80	50191	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.717524052 CEST	50191	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.718504906 CEST	50191	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.720436096 CEST	50194	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.733134031 CEST	50188	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.749273062 CEST	80	50098	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.749664068 CEST	50098	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.750185013 CEST	50098	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.751903057 CEST	80	50096	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.757677078 CEST	80	50189	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.757750034 CEST	50189	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.761099100 CEST	80	50192	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.761204958 CEST	50192	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.761476994 CEST	50192	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.783344984 CEST	80	50190	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.783874989 CEST	80	50190	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.815198898 CEST	50195	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.826600075 CEST	80	50193	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.826771021 CEST	50193	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.829260111 CEST	50190	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.836194992 CEST	50193	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.837548018 CEST	50196	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.841712952 CEST	80	50191	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.841824055 CEST	50191	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.856843948 CEST	80	50100	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.857022047 CEST	50100	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.857146978 CEST	50100	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.857671976 CEST	80	50194	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.857825994 CEST	50194	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.858058929 CEST	50194	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.884253979 CEST	80	50098	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.898822069 CEST	80	50192	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.899672031 CEST	80	50192	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.926728010 CEST	50197	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.937814951 CEST	80	50195	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.937906981 CEST	50195	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.938061953 CEST	50195	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.940144062 CEST	50192	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.942416906 CEST	50198	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.958899975 CEST	80	50193	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:56.958971024 CEST	50193	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:56.974680901 CEST	80	50196	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.975003958 CEST	50196	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.975003958 CEST	50196	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.979909897 CEST	80	50100	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.982752085 CEST	80	50102	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.982933998 CEST	50102	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.983098030 CEST	50102	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:56.995407104 CEST	80	50194	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:56.995810032 CEST	80	50194	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.037132978 CEST	50194	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.040544987 CEST	50199	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.060662031 CEST	80	50195	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.060728073 CEST	50195	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.061956882 CEST	80	50197	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.062088013 CEST	50197	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.062334061 CEST	50197	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.065057993 CEST	80	50198	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.065175056 CEST	50198	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.065520048 CEST	50198	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.068103075 CEST	50200	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.113099098 CEST	80	50196	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.113614082 CEST	80	50196	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.118051052 CEST	80	50102	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.121123075 CEST	80	50104	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.121191978 CEST	50104	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.121290922 CEST	50104	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.153568029 CEST	50201	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.163131952 CEST	80	50199	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.163207054 CEST	50199	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.163345098 CEST	50199	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.164808035 CEST	50202	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.165138006 CEST	50196	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.185466051 CEST	80	50106	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.185637951 CEST	50106	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.185986042 CEST	50106	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.188222885 CEST	80	50198	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.188849926 CEST	80	50198	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.190772057 CEST	80	50200	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.190900087 CEST	50200	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.191147089 CEST	50200	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.197412968 CEST	80	50197	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.197494030 CEST	50197	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.229136944 CEST	50198	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.244235992 CEST	80	50104	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.246165037 CEST	50203	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.291600943 CEST	80	50199	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.291785955 CEST	50199	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.293668985 CEST	80	50201	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.293775082 CEST	50201	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.294373989 CEST	50201	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.296721935 CEST	50204	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.303020000 CEST	80	50202	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.303106070 CEST	50202	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.303302050 CEST	50202	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.305771112 CEST	80	50108	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.305900097 CEST	50108	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.305978060 CEST	50108	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.308454990 CEST	80	50106	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.313575983 CEST	80	50200	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.314155102 CEST	80	50200	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.357147932 CEST	50200	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.358789921 CEST	50205	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.368870974 CEST	80	50203	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.369019985 CEST	50203	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.369092941 CEST	50203	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.372580051 CEST	50206	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.409224033 CEST	80	50110	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.409313917 CEST	50110	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.417846918 CEST	50110	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.419193029 CEST	80	50204	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.419414997 CEST	50204	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.419946909 CEST	50204	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.432214022 CEST	80	50201	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.432281017 CEST	50201	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.438203096 CEST	80	50202	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.438817978 CEST	80	50202	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.441958904 CEST	80	50108	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.470300913 CEST	50207	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.485135078 CEST	50202	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.491713047 CEST	80	50203	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.491873980 CEST	50203	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.495215893 CEST	80	50206	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.495734930 CEST	50206	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.495827913 CEST	50206	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.496007919 CEST	80	50205	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.496299982 CEST	50205	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.496503115 CEST	50205	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.497735023 CEST	50208	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.521862030 CEST	80	50112	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.522511959 CEST	50112	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.522572041 CEST	50112	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.542557001 CEST	80	50204	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.542933941 CEST	80	50204	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.551738977 CEST	80	50110	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.581331968 CEST	50209	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.593478918 CEST	80	50207	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.593846083 CEST	50207	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.593846083 CEST	50207	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.596138000 CEST	50204	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.597234964 CEST	50210	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.609354019 CEST	80	50114	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.609421968 CEST	50114	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.609519958 CEST	50114	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.618807077 CEST	80	50206	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.619379997 CEST	80	50206	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.620186090 CEST	80	50208	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.620507002 CEST	50208	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.620944023 CEST	50208	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.634227037 CEST	80	50205	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.635097027 CEST	50205	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.656971931 CEST	80	50112	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.660149097 CEST	50206	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.695863008 CEST	50211	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.716896057 CEST	80	50207	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.717106104 CEST	50207	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.717955112 CEST	80	50209	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.718228102 CEST	50209	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.718228102 CEST	50209	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.719644070 CEST	50212	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.719913960 CEST	80	50210	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.719981909 CEST	50210	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.720217943 CEST	50210	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.732083082 CEST	80	50114	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.743948936 CEST	80	50208	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.744245052 CEST	80	50116	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.744517088 CEST	80	50208	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.744672060 CEST	50116	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.744893074 CEST	50116	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.787144899 CEST	50208	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.804719925 CEST	50213	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.829835892 CEST	80	50211	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.829920053 CEST	50211	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.830075026 CEST	50211	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.831792116 CEST	50214	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.836169004 CEST	80	50118	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.836230993 CEST	50118	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.836366892 CEST	50118	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.842236996 CEST	80	50212	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.842315912 CEST	50212	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.842516899 CEST	50212	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.842919111 CEST	80	50210	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.843501091 CEST	80	50210	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.854698896 CEST	80	50209	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.854790926 CEST	50209	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.878801107 CEST	80	50116	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.883131027 CEST	50210	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.919780970 CEST	50215	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.928517103 CEST	80	50213	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.928596973 CEST	50213	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.939181089 CEST	50213	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.940855026 CEST	50216	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.954297066 CEST	80	50214	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.958653927 CEST	50214	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.958888054 CEST	80	50118	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.958900928 CEST	50214	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.964137077 CEST	80	50211	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:57.964207888 CEST	50211	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:57.964884043 CEST	80	50212	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.965498924 CEST	80	50212	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.968036890 CEST	80	50120	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:57.968105078 CEST	50120	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:57.968228102 CEST	50120	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.011138916 CEST	50212	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.012478113 CEST	50217	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:58.042567015 CEST	80	50215	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:58.042649984 CEST	50215	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:58.042809963 CEST	50215	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:58.046435118 CEST	50218	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.061985016 CEST	80	50213	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:58.062046051 CEST	50213	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:58.063477993 CEST	80	50216	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.064152956 CEST	50216	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.070940018 CEST	50216	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.077347040 CEST	80	50122	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.077461958 CEST	50122	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.077583075 CEST	50122	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.081723928 CEST	80	50214	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.082295895 CEST	80	50214	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.102008104 CEST	80	50120	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.123138905 CEST	50214	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.124906063 CEST	50219	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:58.147636890 CEST	80	50217	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:58.147722006 CEST	50217	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:58.147994041 CEST	50217	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:58.150818110 CEST	50220	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.166017056 CEST	80	50215	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:58.166100025 CEST	50215	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:58.169280052 CEST	80	50218	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.169374943 CEST	50218	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.175292015 CEST	80	50124	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.175359964 CEST	50124	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.193548918 CEST	80	50216	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.194164038 CEST	80	50216	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.211469889 CEST	80	50122	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.234137058 CEST	50216	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.260138988 CEST	80	50219	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:58.260240078 CEST	50219	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:58.273467064 CEST	80	50220	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.273758888 CEST	50220	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.278106928 CEST	80	50126	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.278171062 CEST	50126	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.283301115 CEST	80	50217	67.228.121.196	192.168.2.4
Apr 19, 2024 07:57:58.283371925 CEST	50217	80	192.168.2.4	67.228.121.196
Apr 19, 2024 07:57:58.374799967 CEST	80	50128	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.374869108 CEST	50128	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.491386890 CEST	80	50130	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.491467953 CEST	50130	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.593156099 CEST	80	50132	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.593240023 CEST	50132	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.698307991 CEST	80	50134	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.698447943 CEST	50134	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.797507048 CEST	80	50136	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.797569036 CEST	50136	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:58.932965994 CEST	80	50138	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:58.933044910 CEST	50138	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:59.034354925 CEST	80	50140	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:59.034415960 CEST	50140	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:59.202904940 CEST	80	50142	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:59.203000069 CEST	50142	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:59.322459936 CEST	80	50144	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:59.322519064 CEST	50144	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:59.381774902 CEST	80	50146	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:59.381836891 CEST	50146	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:59.479727983 CEST	80	50148	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:59.479788065 CEST	50148	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:59.613810062 CEST	80	50150	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:59.613924026 CEST	50150	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:59.695121050 CEST	80	50152	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:59.695183992 CEST	50152	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:59.801680088 CEST	80	50154	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:59.801902056 CEST	50154	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:57:59.900466919 CEST	80	50156	67.228.121.193	192.168.2.4
Apr 19, 2024 07:57:59.900621891 CEST	50156	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:00.045073032 CEST	80	50157	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:00.047769070 CEST	50157	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:00.199709892 CEST	80	50160	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:00.200115919 CEST	50160	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:00.238770008 CEST	80	50162	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:00.238830090 CEST	50162	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:00.383781910 CEST	80	50164	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:00.384588957 CEST	50164	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:00.501136065 CEST	80	50166	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:00.503765106 CEST	50166	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:00.590873003 CEST	80	50168	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:00.591228008 CEST	50168	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:00.694927931 CEST	80	50170	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:00.695859909 CEST	50170	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:00.812719107 CEST	80	50172	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:00.812781096 CEST	50172	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:00.877829075 CEST	80	50174	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:00.878015995 CEST	50174	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:01.002949953 CEST	80	50176	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:01.003114939 CEST	50176	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:01.112442017 CEST	80	50178	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:01.112510920 CEST	50178	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:01.223650932 CEST	80	50180	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:01.223738909 CEST	50180	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:01.332433939 CEST	80	50182	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:01.332628965 CEST	50182	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:01.507822990 CEST	80	50184	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:01.507880926 CEST	50184	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:01.574754953 CEST	80	50186	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:01.575311899 CEST	50186	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:01.688141108 CEST	80	50188	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:01.688216925 CEST	50188	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:01.789494991 CEST	80	50190	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:01.789709091 CEST	50190	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:01.902713060 CEST	80	50192	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:01.902791023 CEST	50192	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.002752066 CEST	80	50194	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.002907038 CEST	50194	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.121356964 CEST	80	50196	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.121438026 CEST	50196	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.197164059 CEST	80	50198	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.197300911 CEST	50198	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.319456100 CEST	80	50200	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.319556952 CEST	50200	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.444350958 CEST	80	50202	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.444519997 CEST	50202	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.446500063 CEST	80	49737	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.446580887 CEST	49737	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.548264980 CEST	80	50204	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.548337936 CEST	50204	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.625030041 CEST	80	50206	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.625099897 CEST	50206	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.750267029 CEST	80	50208	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.750360012 CEST	50208	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.849102020 CEST	80	50210	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.849194050 CEST	50210	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:02.968472958 CEST	80	50212	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:02.968569994 CEST	50212	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:03.087726116 CEST	80	50214	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:03.087814093 CEST	50214	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:03.199414015 CEST	80	50216	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:03.199485064 CEST	50216	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:05.846674919 CEST	80	49747	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:05.846786022 CEST	49747	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:06.046523094 CEST	80	49752	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:06.046649933 CEST	49752	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:06.646519899 CEST	80	49749	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:06.646558046 CEST	80	49755	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:06.646593094 CEST	80	49765	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:06.646661043 CEST	80	49769	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:06.646661997 CEST	49749	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:06.646696091 CEST	80	49761	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:06.646733999 CEST	49755	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:06.646780968 CEST	49765	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:06.646819115 CEST	49769	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:06.646835089 CEST	49761	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:06.846517086 CEST	80	49759	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:06.846662998 CEST	49759	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:07.047209024 CEST	80	49771	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:07.047307014 CEST	49771	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:07.246664047 CEST	80	49773	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:07.246725082 CEST	80	49781	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:07.246762991 CEST	49773	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:07.246789932 CEST	49781	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:07.446907997 CEST	80	49777	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:07.446969986 CEST	49777	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:07.646912098 CEST	80	49793	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:07.647109985 CEST	49793	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:08.047372103 CEST	80	49798	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:08.047434092 CEST	80	49791	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:08.047610044 CEST	49791	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:08.047619104 CEST	49798	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:08.246810913 CEST	80	49804	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:08.246834993 CEST	80	49814	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:08.246851921 CEST	80	49801	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:08.246870995 CEST	49804	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:08.246880054 CEST	49814	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:08.246907949 CEST	80	49799	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:08.246907949 CEST	49801	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:08.246968985 CEST	49799	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:08.446788073 CEST	80	49808	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:08.446824074 CEST	80	49810	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:08.446845055 CEST	49808	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:08.446890116 CEST	49810	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:08.646379948 CEST	80	49819	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:08.646598101 CEST	49819	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:08.846750975 CEST	80	49815	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:08.846827030 CEST	49815	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:09.246757030 CEST	80	49834	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:09.246797085 CEST	80	49828	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:09.246809959 CEST	49834	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:09.246840000 CEST	49828	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:09.246906042 CEST	80	49825	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:09.246972084 CEST	49825	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:09.446877956 CEST	80	49832	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:09.446903944 CEST	80	49840	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:09.447017908 CEST	49832	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:09.447052002 CEST	49840	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:09.646744967 CEST	80	49838	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:09.646806002 CEST	49838	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:09.846611977 CEST	80	49847	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:09.846690893 CEST	80	49849	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:09.846689939 CEST	49847	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:09.846713066 CEST	80	49843	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:09.846752882 CEST	49849	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:09.846788883 CEST	49843	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:10.046823025 CEST	80	49853	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:10.046896935 CEST	49853	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:10.046931982 CEST	80	49856	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:10.046981096 CEST	49856	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:10.446329117 CEST	80	49862	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:10.446393967 CEST	80	49859	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:10.446428061 CEST	80	49868	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:10.446470022 CEST	49862	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:10.446491957 CEST	49859	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:10.446557999 CEST	49868	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:10.646660089 CEST	80	49864	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:10.646738052 CEST	49864	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:10.846872091 CEST	80	49880	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:10.846911907 CEST	80	49874	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:10.846985102 CEST	49880	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:10.847732067 CEST	49874	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:11.046631098 CEST	80	49876	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:11.046725988 CEST	49876	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:11.246654034 CEST	80	49888	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:11.246737957 CEST	49888	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:11.447298050 CEST	80	49895	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:11.447360039 CEST	80	49900	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:11.447397947 CEST	80	49885	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:11.447408915 CEST	49900	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:11.447434902 CEST	80	49882	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:11.447441101 CEST	49885	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:11.447473049 CEST	80	49891	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:11.447508097 CEST	49895	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:11.447519064 CEST	49891	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:11.447742939 CEST	49882	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:11.646627903 CEST	80	49870	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:11.646698952 CEST	49870	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:11.847155094 CEST	80	49904	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:11.847300053 CEST	49904	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:12.246795893 CEST	80	49909	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:12.246869087 CEST	49909	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:12.446316004 CEST	80	49913	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:12.446374893 CEST	49913	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:12.446393967 CEST	80	49897	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:12.446499109 CEST	49897	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:12.446501970 CEST	80	49915	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:12.446538925 CEST	80	49925	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:12.446559906 CEST	49915	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:12.446574926 CEST	80	49917	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:12.446597099 CEST	49925	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:12.446621895 CEST	49917	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:12.647245884 CEST	80	49927	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:12.647306919 CEST	80	49921	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:12.647344112 CEST	80	49930	67.228.121.193	192.168.2.4
Apr 19, 2024 07:58:12.647409916 CEST	49927	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:12.647474051 CEST	49930	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:12.647516012 CEST	49921	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.310681105 CEST	49737	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.310734987 CEST	49747	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.310841084 CEST	49752	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.310842991 CEST	49765	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.310848951 CEST	49761	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.310848951 CEST	49749	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.310868979 CEST	49755	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311060905 CEST	49777	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311065912 CEST	49759	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311065912 CEST	49771	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311099052 CEST	49769	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311105967 CEST	49773	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311146975 CEST	49781	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311146975 CEST	49799	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311194897 CEST	49793	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311216116 CEST	49791	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311253071 CEST	49801	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311278105 CEST	49814	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311280966 CEST	49930	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311280966 CEST	49798	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311330080 CEST	49804	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311384916 CEST	49808	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311404943 CEST	49815	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311475039 CEST	49810	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311490059 CEST	49838	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311537027 CEST	49828	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311551094 CEST	49825	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311558008 CEST	49832	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311559916 CEST	49819	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311590910 CEST	49843	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311625957 CEST	49834	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311661005 CEST	49840	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311666965 CEST	49847	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311712027 CEST	49853	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311755896 CEST	49849	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311786890 CEST	49856	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311814070 CEST	49868	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311835051 CEST	49859	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311862946 CEST	49864	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311878920 CEST	49862	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311897993 CEST	49870	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311925888 CEST	49874	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311943054 CEST	49876	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.311975956 CEST	49880	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312001944 CEST	49885	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312048912 CEST	49882	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312074900 CEST	49888	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312107086 CEST	49897	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312124014 CEST	49891	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312138081 CEST	49895	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312155008 CEST	49900	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312191010 CEST	49913	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312205076 CEST	49904	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312242985 CEST	49909	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312292099 CEST	49915	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312316895 CEST	49925	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312320948 CEST	49917	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312350988 CEST	49921	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312386036 CEST	49927	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312503099 CEST	50218	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312530994 CEST	50140	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312599897 CEST	50178	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312644005 CEST	50198	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312675953 CEST	50220	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312731028 CEST	50124	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312757969 CEST	50126	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312796116 CEST	50142	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312796116 CEST	50132	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312850952 CEST	50136	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312864065 CEST	50128	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312896967 CEST	50130	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312913895 CEST	50134	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.312961102 CEST	50138	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313019991 CEST	50146	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313021898 CEST	50150	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313050032 CEST	50157	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313067913 CEST	50144	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313071012 CEST	50148	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313097000 CEST	50156	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313111067 CEST	50152	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313142061 CEST	50154	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313189030 CEST	50160	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313200951 CEST	50162	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313235044 CEST	50166	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313266993 CEST	50164	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313273907 CEST	50168	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313301086 CEST	50172	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313327074 CEST	50170	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313407898 CEST	50182	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313412905 CEST	50174	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313412905 CEST	50176	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313441038 CEST	50184	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313460112 CEST	50180	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313479900 CEST	50192	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313539028 CEST	50186	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313541889 CEST	50188	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313580036 CEST	50202	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313582897 CEST	50196	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313604116 CEST	50210	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313632011 CEST	50190	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313652992 CEST	50194	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313707113 CEST	50200	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313710928 CEST	50204	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313745975 CEST	50206	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313776016 CEST	50208	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313796043 CEST	50214	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313808918 CEST	50212	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313857079 CEST	50216	80	192.168.2.4	67.228.121.193
Apr 19, 2024 07:58:18.313885927 CEST	50219	80	192.168.2.4	67.228.121.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 07:57:30.755409002 CEST	62059	53	192.168.2.4	1.1.1.1
Apr 19, 2024 07:57:30.868278980 CEST	54039	53	192.168.2.4	1.1.1.1
Apr 19, 2024 07:57:30.872322083 CEST	53	62059	1.1.1.1	192.168.2.4
Apr 19, 2024 07:57:30.988692045 CEST	53	54039	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 07:57:30.755409002 CEST	192.168.2.4	1.1.1.1	0xd85b	Standard query (0)	www.5kplayer.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 07:57:30.868278980 CEST	192.168.2.4	1.1.1.1	0x20b0	Standard query (0)	dl1.5kplayer.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 07:57:30.872322083 CEST	1.1.1.1	192.168.2.4	0xd85b	No error (0)	www.5kplayer.com		67.228.121.196	A (IP address)	IN (0x0001)	false
Apr 19, 2024 07:57:30.988692045 CEST	1.1.1.1	192.168.2.4	0x20b0	No error (0)	dl1.5kplayer.com		67.228.121.193	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.5kplayer.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49785	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:36.248128891 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:36.382545948 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:36 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49784	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:36.248477936 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:36.371608973 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:36 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49823	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:37.600960016 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:37.723768950 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:37 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49906	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:40.618772030 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:40.754321098 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:40 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49931	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:41.508806944 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:41.631737947 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:41 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49933	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:41.612469912 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:41.747776985 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:41 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49935	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:41.722893953 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:41.857171059 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:41 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49937	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:41.809655905 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:41.932529926 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:41 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49939	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:41.950123072 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:42.087918997 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:42 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49941	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:42.034466982 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:42.157371998 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:42 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49943	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:42.158150911 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:42.296025038 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:42 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49945	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:42.262557030 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:42.385428905 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:42 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49947	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:42.410171986 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:42.544517040 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:42 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49949	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:42.488538980 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:42.624416113 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:42 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49951	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:42.611906052 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:42.746433020 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:42 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49953	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:42.695964098 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:42.818728924 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:42 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49955	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:43.254172087 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:43.390516996 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:43 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49956	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:43.296900988 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:43.432481050 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:43 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49959	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:44.129576921 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:44.264350891 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:44 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49961	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:44.136013031 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:44.271859884 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:44 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49962	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:44.347296000 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:44.470587969 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:44 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49965	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:44.488343000 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:44.625067949 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:44 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49966	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:44.798158884 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:44.932533026 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:44 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49970	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:44.963946104 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:45.086879969 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49973	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.102093935 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:45.225109100 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49974	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.138652086 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:45.274390936 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49975	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.164767981 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:45.303198099 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49977	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.278189898 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:45.414994955 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49979	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.463057041 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:45.598643064 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49980	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.472981930 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:45.596055984 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49983	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.609946966 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:45.744537115 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49986	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.669172049 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:45.803791046 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49988	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.800954103 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:45.936799049 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49990	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.898780107 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:46.021590948 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:45 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49992	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:45.989296913 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:46.124341011 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:46 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49994	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:46.088146925 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:46.211065054 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:46 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49996	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:46.214715958 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:46.341826916 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:46 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49998	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:46.316417933 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:46.439294100 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:46 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50001	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:46.517625093 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:46.640631914 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:46 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50003	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:46.574953079 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:46.710577965 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:46 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50005	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:46.665251017 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:46.788311005 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:46 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50008	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:46.743952990 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:46.867150068 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:46 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50010	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:46.871929884 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:47.007550955 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:46 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50012	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:46.991355896 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:47.126933098 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:47 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50014	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:47.102241993 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:47.237854958 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:47 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50016	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:47.194066048 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:47.317075968 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:47 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50018	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:47.310724974 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:47.433784962 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:47 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50021	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:47.409843922 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:47.533014059 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:47 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50023	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:47.531796932 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:47.654779911 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:47 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50025	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:47.660068035 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:47.795696974 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:47 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50027	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:47.782604933 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:47.905909061 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:47 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50029	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:47.855176926 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:47.978543997 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:47 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50032	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:47.968893051 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:48.092175961 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:48 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50034	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:48.083656073 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:48.218184948 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:48 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50036	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:48.168366909 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:48.291440964 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:48 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50038	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:48.295794010 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:48.418886900 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:48 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50040	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:48.414357901 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:48.552185059 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:48 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50042	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:48.541472912 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:48.665537119 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:48 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50044	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:48.635812044 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:48.758981943 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:48 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50046	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:48.737783909 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:48.860904932 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:48 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50048	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:48.834433079 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:48.957586050 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:48 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50050	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:48.967338085 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:49.238425016 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:49 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50052	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:49.049071074 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:49.307038069 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:49 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50054	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:49.170840979 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:49.308494091 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:49 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50056	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:49.291270971 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:49.474577904 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:49 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50058	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:49.387572050 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:49.510741949 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:49 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50060	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:49.510633945 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:49.645442009 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:49 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50062	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:49.625971079 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:49.761665106 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:49 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50064	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:49.737382889 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:49.926717997 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:49 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50066	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:49.854454994 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:50.020246983 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:49 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50068	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:49.961082935 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:50.098481894 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:50 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50070	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:50.066277981 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:50.189624071 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:50 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50072	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:50.176291943 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:50.312645912 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:50 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50074	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:50.280510902 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:50.404167891 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:50 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50076	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:50.398344994 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:50.532875061 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:50 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50078	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:50.515625954 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:50.651299000 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:50 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50080	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:50.610770941 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:50.733586073 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:50 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50082	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:50.719985962 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:50.843008995 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:50 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50084	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:50.857057095 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:50.991642952 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:50 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50086	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:50.949595928 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:51.084286928 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:51 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50088	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:51.062988997 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:51.201143980 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:51 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50090	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:51.165524960 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:51.290060043 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:51 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50092	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:51.282622099 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:51.406723022 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:51 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50094	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:51.383464098 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:51.507230043 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:51 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50096	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:51.498733044 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:51.621716976 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:51 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50098	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:51.609201908 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:51.743732929 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:51 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50100	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:51.725228071 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:51.849003077 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:51 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50102	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:51.839814901 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:51.976361036 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:51 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50104	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:51.992635012 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:52.115910053 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:52 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50106	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:52.056202888 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:52.179946899 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:52 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50108	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:52.164793968 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:52.300604105 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:52 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50110	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:52.268560886 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:52.403541088 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:52 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50112	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:52.382050991 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:52.516421080 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:52 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50114	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:52.480602026 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:52.603632927 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:52 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50116	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:52.604258060 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:52.738863945 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:52 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50118	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:52.707595110 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:52.830604076 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:52 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50120	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:52.827692986 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:52.962805986 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:52 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50122	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:52.940696001 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:53.075943947 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:53 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50124	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:53.036556005 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:53.175088882 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:53 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50126	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:53.135914087 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:53.272558928 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:53 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50128	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:53.246602058 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:53.369932890 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:53 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50130	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:53.362824917 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:53.486152887 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:53 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50132	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:53.464348078 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:53.587287903 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:53 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50134	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:53.569863081 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:53.692734003 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:53 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50136	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:53.669107914 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:53.792190075 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:53 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50138	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:53.792059898 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:53.927877903 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:53 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50140	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:53.905245066 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:54.030241966 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:53 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50142	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:54.058969021 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:54.197521925 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:54 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50144	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:54.188332081 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:54.316283941 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:54 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50146	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:54.238012075 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:54.376569033 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:54 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50148	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:54.350097895 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:54.474129915 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:54 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50150	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:54.468863964 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:54.606951952 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:54 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50152	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:54.555254936 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:54.690958977 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:54 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50154	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:54.671480894 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:54.797265053 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:54 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50156	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:54.770021915 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:54.895380020 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:54 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50157	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:54.896195889 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:55.042706966 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:54 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50160	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:55.055656910 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:55.197307110 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:55 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50162	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:55.109740973 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:55.235935926 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:55 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50164	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:55.240890980 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:55.378279924 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:55 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50166	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:55.357450962 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:55.495208979 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:55 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50168	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:55.450067043 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:55.585716963 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:55 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50170	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:55.553838968 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:55.689380884 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:55 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50172	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:55.671710968 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:55.807647943 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:55 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50174	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:55.748794079 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:55.871953964 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:55 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50176	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:55.874665976 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:55.997594118 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:55 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50178	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:55.983804941 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:56.106780052 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:56 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50180	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:56.095083952 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:56.218245983 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:56 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50182	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:56.203939915 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:56.327455044 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:56 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50184	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:56.366889954 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:56.502497911 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:56 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50186	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:56.434921980 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:56.570641041 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:56 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50188	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:56.548418999 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:56.682828903 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:56 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	50190	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:56.660492897 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:56.783874989 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:56 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	50192	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:56.761476994 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:56.899672031 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:56 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	50194	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:56.858058929 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:56.995810032 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:56 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50196	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:56.975003958 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:57.113614082 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:57 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50198	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:57.065520048 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:57.188849926 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:57 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50200	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:57.191147089 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:57.314155102 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:57 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	50202	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:57.303302050 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:57.438817978 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:57 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50204	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:57.419946909 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:57.542933941 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:57 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	50206	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:57.495827913 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:57.619379997 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:57 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	50208	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:57.620944023 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:57.744517088 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:57 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	50210	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:57.720217943 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:57.843501091 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:57 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	50212	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:57.842516899 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:57.965498924 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:57 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	50214	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:57.958900928 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:58.082295895 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:58 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50216	67.228.121.193	80	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 07:57:58.070940018 CEST	177	OUT	HEAD /download/5kplayer-64bit.exe HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: dl1.5kplayer.com
Apr 19, 2024 07:57:58.194164038 CEST	180	IN	HTTP/1.1 404 Not Found Date: Fri, 19 Apr 2024 05:57:58 GMT Server: Apache Keep-Alive: timeout=5, max=800 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	67.228.121.196	443	5436	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 05:57:31 UTC	280	OUT	GET /r/go.php?an=5kpwin&cvs=6.0&pvs=1.0&cb=&ev=dlop&fui=undef&rt=undef&uc=b05ce96439b86b60&eid=&jump=&h=332266dd795ace9fc247de70ace0e169 HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-CH,* User-Agent: Mozilla/5.0 Host: www.5kplayer.com
2024-04-19 05:57:31 UTC	443	IN	HTTP/1.1 302 Found Date: Fri, 19 Apr 2024 05:57:31 GMT Server: Apache Set-Cookie: _DA=459449970.1713506251; expires=Sun, 19-Apr-2026 05:57:31 GMT; Max-Age=63072000; path=/; domain=.www.5kplayer.com Set-Cookie: _DA_TTS=5kpwin-6.0-undef-undef; expires=Fri, 19-Apr-2024 07:57:31 GMT; Max-Age=7200; path=/; domain=.www.5kplayer.com Location: Vary: User-Agent Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	07:57:26
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\5kplayer-setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5kplayer-setup.exe"
Imagebase:	0x400000
File size:	7'270'888 bytes
MD5 hash:	0CB8A509B925197BD4B94B4C835C8DB9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:57:28
Start date:	19/04/2024
Path:	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe
Imagebase:	0x400000
File size:	21'981'840 bytes
MD5 hash:	3E71A7C07BB5BD316F64768D21971CFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:57:57
Start date:	19/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 6324
Imagebase:	0xfc0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.4%
Total number of Nodes:	1482
Total number of Limit Nodes:	40

Executed Functions

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
OleUninitialize.OLE32(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

NSIS Error, xrefs: 0040390E
NCRC, xrefs: 004039A8
SeShutdownPrivilege, xrefs: 00403C42
~nsu.tmp, xrefs: 00403B23
Error launching installer, xrefs: 00403AA9
\Temp, xrefs: 00403A47
_?=, xrefs: 00403A90
/D=, xrefs: 004039D2

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: a2404dc93c360a7d828092944ab0dc425f3ae1eb0dcb292821f45ffcff0aa10c
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: a2404dc93c360a7d828092944ab0dc425f3ae1eb0dcb292821f45ffcff0aa10c
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*), ref: 00406D35
lstrcatW.KERNEL32(?,00409838), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNELBASE(00467470,?), ref: 00406D6C
FindNextFileW.KERNELBASE(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

Delete: DeleteFile("%s"), xrefs: 00406DE8
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
ptF, xrefs: 00406D1A
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
\*.*, xrefs: 00406D2F
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
Delete: DeleteFile failed("%s"), xrefs: 00406E29

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: 0773e1bb02d94fce99ad1c6111755f8979c63676e37ea285c86d1b4844ce1413
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: 0773e1bb02d94fce99ad1c6111755f8979c63676e37ea285c86d1b4844ce1413
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Uniqueness

Uniqueness Score: -1.00%

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNELBASE(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Uniqueness

Uniqueness Score: -1.00%

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Uniqueness

Uniqueness Score: -1.00%

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNEL32(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

SetFileAttributes failed., xrefs: 004017A1
Jump: %d, xrefs: 00401602
Rename on reboot: %s, xrefs: 00401943
Rename: %s, xrefs: 004018F8
Rename failed: %s, xrefs: 0040194B
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
detailprint: %s, xrefs: 00401679
CreateDirectory: "%s" (%d), xrefs: 004017BF
Aborting: "%s", xrefs: 0040161D
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes: "%s":%08X, xrefs: 0040177B
BringToFront, xrefs: 004016BD
Sleep(%d), xrefs: 0040169D
Call: %d, xrefs: 0040165A

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: 26725fba0c67dd5ef96a9c675576816e85dd1f0f980fe61be668e0bb381e457c
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: 26725fba0c67dd5ef96a9c675576816e85dd1f0f980fe61be668e0bb381e457c
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Uniqueness

Uniqueness Score: -1.00%

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNEL32(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
RichEd20, xrefs: 00405BC9
RichEd32, xrefs: 00405BD4
_Nb, xrefs: 00405AFD
RichEdit, xrefs: 00405BF0
"F, xrefs: 00405A4B
@jG, xrefs: 00405AF2
F, xrefs: 00405A22
RichEdit20A, xrefs: 00405BE2, 00405BE7
.exe, xrefs: 00405A69
.DEFAULT\Control Panel\International, xrefs: 004059C5

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Uniqueness

Uniqueness Score: -1.00%

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe,C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe,00000000,00000000,C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427E91,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427E91,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: wrote %d to "%s", xrefs: 00401BD0
File: error, user cancel, xrefs: 00401B93
File: error, user abort, xrefs: 00401B53
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user retry, xrefs: 00401B40
File: error creating "%s", xrefs: 00401AF0

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-4280956306
Opcode ID: f000a09ac758648e48b329b1911555221371326a008b212391cbd8e307ca4d7f
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: f000a09ac758648e48b329b1911555221371326a008b212391cbd8e307ca4d7f
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

soft, xrefs: 004036A1
Error launching installer, xrefs: 00403603
Null, xrefs: 004036AA
Inst, xrefs: 00403698
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 60015d4ad0f4b5f5eae55729fc88f45e330dc420916319a7d833a41d7a943f83
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 60015d4ad0f4b5f5eae55729fc88f45e330dc420916319a7d833a41d7a943f83
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040337F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00427E91,00403792,00000000), ref: 004034FF
WriteFile.KERNELBASE(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

(]C, xrefs: 004033FD
pAB, xrefs: 004033AB
... %d%%, xrefs: 004034C8

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB
API String ID: 651206458-3635341587
Opcode ID: cb4c91118d633cdc657fe6c8c56820a3b26f1ee58aa4180b17ceb2c9431ae53d
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: cb4c91118d633cdc657fe6c8c56820a3b26f1ee58aa4180b17ceb2c9431ae53d
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427E91,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427E91,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNELBASE(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
`G, xrefs: 0040246E
Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: Could not initialize OLE, xrefs: 004024F1

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: 24a83029d4f3eb6b8224e6a0cc99006e4a6954edb210bc1d043aa7a0e93d4657
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: 24a83029d4f3eb6b8224e6a0cc99006e4a6954edb210bc1d043aa7a0e93d4657
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427E91,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427E91,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNELBASE(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: command="%s", xrefs: 00402241
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 74ef5a14a6f8c8123d655539c6805aa003933a2e0a90bea7bf53c56d4936f751
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 74ef5a14a6f8c8123d655539c6805aa003933a2e0a90bea7bf53c56d4936f751
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(00000000), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-2868596620
Opcode ID: 75b6b9353ede79e610d5310b3a83a8c1eb75e4e149413938720fcfc08436b0a8
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: 75b6b9353ede79e610d5310b3a83a8c1eb75e4e149413938720fcfc08436b0a8
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Uniqueness

Uniqueness Score: -1.00%

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Uniqueness

Uniqueness Score: -1.00%

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Uniqueness

Uniqueness Score: -1.00%

Function 004067AA Relevance: 3.1, APIs: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00405D85: CharNextW.USER32(-00000002,?,00461E18,004E30C8,004067C1,00461E18,00461E18,00406CDA,?,-00000002,00406CDA,?,004CF0A0), ref: 00405D93
Part of subcall function 00405D85: CharNextW.USER32(00000000), ref: 00405D98
Part of subcall function 00405D85: CharNextW.USER32(00000000), ref: 00405DB0

lstrlenW.KERNEL32(00461E18,004E30C8,00000000,00461E18,00461E18,00406CDA,?,-00000002,00406CDA,?,004CF0A0), ref: 0040680A
GetFileAttributesW.KERNELBASE(00461E18,00461E18), ref: 00406817

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID:
API String ID: 3248276644-0
Opcode ID: 09bd9f4f4bc4ae5b1ae8a956b705f631aaf87a84e9a2d6cedc9e286269f99e42
Instruction ID: c271629f7750957e5fd102afcb20a97c51063d27386b99ed5bca430d7485d950
Opcode Fuzzy Hash: 09bd9f4f4bc4ae5b1ae8a956b705f631aaf87a84e9a2d6cedc9e286269f99e42
Instruction Fuzzy Hash: 9201F72210592215D61277360C49D6F19848E46778317453FF813B32D2DF3CC972D0BE

Uniqueness

Uniqueness Score: -1.00%

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Uniqueness

Uniqueness Score: -1.00%

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Uniqueness

Uniqueness Score: -1.00%

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Uniqueness

Uniqueness Score: -1.00%

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Uniqueness

Uniqueness Score: -1.00%

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Uniqueness

Uniqueness Score: -1.00%

Function 00403885 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403AFD,?), ref: 00403890

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 983617adc3fb59bada791ca239273a70529ab93e183a396e050099d658997f71
Instruction ID: 859c8e5cf93c3f84440f38a6d8c6a0cb0ce917112422b96fb642ee91708591da
Opcode Fuzzy Hash: 983617adc3fb59bada791ca239273a70529ab93e183a396e050099d658997f71
Instruction Fuzzy Hash: 1BC01231504700D7E5206FB99D4EB043A54A74037DB544B7AF4F5F11F1C77C4645852D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427E91,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNEL32(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNEL32(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

{, xrefs: 0040537E
New install of "%s" to "%s", xrefs: 004051AE

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: b870e07e0f90b65775997a4172df4cb72c50b11c5a38a9ad208b9f3c2b6ee9f0
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: b870e07e0f90b65775997a4172df4cb72c50b11c5a38a9ad208b9f3c2b6ee9f0
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

M, xrefs: 00404B6F
@, xrefs: 00404BBC
, xrefs: 00404F65
N, xrefs: 00404C32

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427E91,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

F, xrefs: 004046A0
A, xrefs: 00404662

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Uniqueness

Uniqueness Score: -1.00%

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

%s: failed opening file "%s", xrefs: 00406F38
GetTTFNameString, xrefs: 00406F33
name, xrefs: 00406FEB

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Uniqueness

Uniqueness Score: -1.00%

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427E91,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00427E91,74DF23A0,00000000), ref: 00406A73

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952
F, xrefs: 00406858
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
F, xrefs: 00406A7F

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Uniqueness

Uniqueness Score: -1.00%

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

Process32FirstW, xrefs: 004065E9
EnumProcessModules, xrefs: 004064B6
Unknown, xrefs: 00406528
Module32FirstW, xrefs: 004065FF
Module32NextW, xrefs: 0040660A
PSAPI.DLL, xrefs: 00406490
CreateToolhelp32Snapshot, xrefs: 004065E1
Kernel32.DLL, xrefs: 004065C7
Process32NextW, xrefs: 004065F4
GetModuleBaseNameW, xrefs: 004064C0
EnumProcesses, xrefs: 004064AE

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
EnableWindow.USER32(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Uniqueness

Uniqueness Score: -1.00%

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

open, xrefs: 0040430B
F, xrefs: 004042D3
N, xrefs: 00404298

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

%s=%s, xrefs: 00406B6F
NUL, xrefs: 00406ACA
^F, xrefs: 00406ACF
[Rename], xrefs: 00406BF4, 00406C03
plF, xrefs: 00406B54

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 7eba5588e31dbe8d60aed41eef07a2ac5faacf0d5bbe736eb3a00d236a23317c
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 7eba5588e31dbe8d60aed41eef07a2ac5faacf0d5bbe736eb3a00d236a23317c
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Uniqueness

Uniqueness Score: -1.00%

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),0040A678), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\")
API String ID: 3734993849-2495899890
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Uniqueness

Uniqueness Score: -1.00%

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 6c1c61ef5032ccf90c018dfb7ef966ae83b5c21018cc5ffe60bed7be14a03e13
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 6c1c61ef5032ccf90c018dfb7ef966ae83b5c21018cc5ffe60bed7be14a03e13
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Uniqueness

Uniqueness Score: -1.00%

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00445D80,00427E91,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00427E91,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427E91,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(006ED14F,00000064,006EF1E8), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Uniqueness

Uniqueness Score: -1.00%

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Uniqueness

Uniqueness Score: -1.00%

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(00000000), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 30a9f30ffce614aff23d91e5a274339f7b18f56dfa2a9d4bf8bd5c228ca3d296
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 30a9f30ffce614aff23d91e5a274339f7b18f56dfa2a9d4bf8bd5c228ca3d296
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 1ebce3df12df367927eba5803e4039b1c10173b09545cb528426889d817ad681
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 1ebce3df12df367927eba5803e4039b1c10173b09545cb528426889d817ad681
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 5eded073d719063d7dd2b7ed0f4ab774b9adb8237686967b3f1148e91f7db3db
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 5eded073d719063d7dd2b7ed0f4ab774b9adb8237686967b3f1148e91f7db3db
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Uniqueness

Uniqueness Score: -1.00%

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Uniqueness

Uniqueness Score: -1.00%

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Uniqueness

Uniqueness Score: -1.00%

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: d23cd8c8fb9b260c3d1ef9fc8486076281a242565aede0b62d0bd991a5e4a72c
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: d23cd8c8fb9b260c3d1ef9fc8486076281a242565aede0b62d0bd991a5e4a72c
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Uniqueness

Uniqueness Score: -1.00%

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNELBASE(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 76b1160061a8bcde82d673e25faa9719cd8acd17af1c4b15f649e1f749d05235
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 76b1160061a8bcde82d673e25faa9719cd8acd17af1c4b15f649e1f749d05235
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Uniqueness

Uniqueness Score: -1.00%

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

..., xrefs: 004062BF
%02x%c, xrefs: 0040629C

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Uniqueness

Uniqueness Score: -1.00%

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-3044885674
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Skipping section: "%s", xrefs: 004050E1
Section: "%s", xrefs: 004050A5

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Uniqueness

Uniqueness Score: -1.00%

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00427E91,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Uniqueness

Uniqueness Score: -1.00%

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Uniqueness

Uniqueness Score: -1.00%

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Uniqueness

Uniqueness Score: -1.00%

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Uniqueness

Uniqueness Score: -1.00%

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00427E91,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00427E91,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 4d879d2c8321bb463321977456507b10eaea5390416c5072baed3c839463aa30
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 4d879d2c8321bb463321977456507b10eaea5390416c5072baed3c839463aa30
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Uniqueness

Uniqueness Score: -1.00%

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: be3f33bca0c5f1204a4a496ffc1b00969947ff7659ffa90b0b167d1f8fab4121
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: be3f33bca0c5f1204a4a496ffc1b00969947ff7659ffa90b0b167d1f8fab4121
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Uniqueness

Uniqueness Score: -1.00%

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Uniqueness

Uniqueness Score: -1.00%

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\"), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory("C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\")
API String ID: 3509786178-2051539241
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.2205094540.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2205031486.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205134751.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000043C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205205900.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2205331479.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5kplayer-setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Uniqueness

Uniqueness Score: -1.00%

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5kplayer-setup.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5kp.exe_62a77edd96bbf36f4741e2a9b852effc9e803e_f76daea9_f1600ac1-62a3-4192-80c6-43550a3d8940\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER238.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2784.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER27B4.tmp.xml

C:\Users\user\AppData\Local\Temp\5kplayer\5kp.7z

C:\Users\user\AppData\Local\Temp\5kplayer\5kp.exe

C:\Users\user\AppData\Local\Temp\nsr8AE6.tmp\nsis7zU.dll

C:\Users\user\AppData\Roaming\Digiarty\unique.bin

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
5kplayer-setup.exe

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190
filestringCOMMON

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18
libraryloaderCOMMON

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Function 0040337F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 175
fileCOMMON

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83
libraryCOMMON

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59
synchronizationCOMMON

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31
memorylibraryloaderCOMMON

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre