directly after the "download issue" we see /wp-login.php requests with "404" results. Can you shed some light on this?
The wp-login.php request is coming from a different IP address that the stub EXE attempt to download the associated .bin files. That wp-login.php attempt isn't related to the SetupBuilder matter.